Drupal Web Development Company: Drupal Development, Migrations, Upgrades and Support

Updated October 2026 · Written and maintained by the Progression Agency strategy team

A Drupal web development company plans, builds and looks after websites on Drupal, the open-source CMS that universities, public agencies, nonprofits and large publishers choose when content models, permissions and languages get complicated. We build new Drupal 11 sites, take over existing ones, write custom modules and themes, and move Drupal 7 and Drupal 10 sites onto a supported release before their security support runs out. We also tell you when Drupal is the wrong tool and WordPress or a headless build would cost less to run. Send us your current site and we will put scope, timeline and price in writing first.

What does a Drupal web development company do?

A Drupal web development company designs the content model, builds the site in Drupal and keeps it patched and current afterward. For a buyer that means one accountable team for the code, the editing screens and the upgrade calendar, rather than a single freelancer who moves on after launch.

What we build in Drupal

New Drupal 11 sites, Drupal rescue work on sites another team built, custom modules for rules no contributed module covers, themes made from reusable components, integrations with your CRM and other systems, upgrades from one release to the next, and ongoing support. The common thread is delivery as configuration and code that your next developer can read without a guide.

Who hires a Drupal development company

Higher education departments, public agencies, nonprofits and associations, publishers with large archives, and B2B companies whose sites carry many content types and several editor roles. The usual buyer has either outgrown a simpler CMS or inherited a Drupal site that nobody on staff wants to touch.

When we will tell you Drupal is the wrong choice

A brochure site, a team of one or two editors with no developer budget, or a launch that has to happen next month on a small budget usually runs cheaper on WordPress development or a hosted builder. We say so in the proposal. Drupal earns its cost when content models, permissions or languages get complicated, and not before.

Drupal development services

Our Drupal development services cover a site’s whole life, from the first build to the support contract. Drupal web development services range from a single module to a full platform, so the table separates them and each row can be quoted on its own. These Drupal website development services are scoped in writing after a discovery step.

Custom Drupal development

Custom Drupal development is code written for your site’s own rules: a pricing calculator, a multi-step approval, an import from an internal system. We first check whether configuration or a contributed module already does the job, because every line of custom code is a line someone has to carry through each future upgrade.

Drupal module development

Drupal module development starts in the contributed ecosystem, since a maintained module with security coverage is usually safer than anything built in-house. When nothing fits, we write a custom module that follows Drupal’s published coding standards, which apply to code in Drupal and its contributed modules, so the next developer meets familiar structure.

Drupal theme development

Drupal theme development at our shop is component based. Since Drupal 10.3, Single-Directory Components are part of core’s render system, combining HTML, CSS and JavaScript for one interface element in a reusable unit. Editors reuse the same components on every page, and a designer changes one folder instead of hunting through templates.

Drupal 7, 10 and 11 support dates and your upgrade deadline

Support windows set your upgrade calendar. Drupal 7 end of life came on January 5, 2025, and Drupal 10 end of life arrives on December 9, 2026. The table gives the dates on Drupal’s core release schedule as of October 27, 2026; they can move, so we recheck them before every quote.

How long will Drupal 10 be supported?

Until December 9, 2026. Drupal 10.6.0 is the last minor release of Drupal 10, and the schedule lists the end of security support for 10.6.x in the week of December 7, 2026. After that, security fixes stop, so a site still on Drupal 10 needs to be on Drupal 11 before then. At the time of this check that is about six weeks away.

Sites still running Drupal 7

A Drupal 7 migration is overdue; security support ended on January 5, 2025. The Drupal 7 end-of-life page describes a paid extended security support program run through the Drupal Association, with vetted, certified vendors, for sites that cannot move yet. Treat it as a bridge that buys time, not as a supported release. The same page warns that unsupported software can put a site out of step with compliance frameworks such as PCI and HIPAA. Any vendor contract stays with you.

Is Drupal going away?

No. Drupal 11 is current, 11.4.x is the active release line on the schedule, and Drupal 12 is scheduled for the week of December 7, 2026. Drupal’s own site also promotes Drupal CMS, a packaged starting point aimed at marketers, designers and content creators, with version 2.0 announced. What goes away is old versions: every major release has an end date.

Drupal migration services: moving to Drupal 11

Our Drupal migration services cover two different jobs: upgrading a Drupal 10 site to 11, and moving content from Drupal 7 or another platform into a new build. Drupal upgrade services of both kinds start with an inventory of what the site actually contains.

Drupal 10 to Drupal 11: deprecated code and Upgrade Status

Get current on the latest Drupal 10 release first, then clear deprecated code before switching majors. Drupal’s own upgrade guide points to deprecation checking tools, and the Upgrade Status module reviews a site’s readiness by running static analysis and checks on themes, libraries and configuration. Hosting matters too: the PHP requirements page lists PHP 8.3 as supported and 8.2 as not supported for the current Drupal 11 releases.

Drupal 7 to Drupal 11 is a migration, not an update

An update cannot be applied to a Drupal 7 site. Its data moves into a fresh site on a current release through the Migrate and Migrate Drupal modules that ship in core, as the upgrade documentation explains. Content types, field definitions and roles come across as configuration, while nodes, users and taxonomy terms come across as content. Themes cannot be migrated and are rebuilt. The route is the same whether you plan a Drupal 7 to Drupal 10 migration or go straight to 11.

Contributed modules with no Drupal 11 release

The upgrade documentation warns that not every contributed module has an automatic upgrade path. For each module without a Drupal 11 release we choose between three moves: help patch it, replace it with a module that does the same job, or write a small custom module. The right one depends on how central the feature is and how active the maintainer remains.

Cut-over: redirects, content parity and rollback

Launch day is a checklist: a redirect map covering every old address, a crawl of the staging site to confirm content parity, a backup that has been restored at least once as a test, and a rollback plan if a check fails. The generic process sits on our website migration page. One-off migration support with redirect mapping starts from $3,200 on our one-off SEO projects list.

Moving to Drupal, or away from it

Platform moves run in both directions, and the right answer depends on the content model rather than loyalty to a CMS.

WordPress to Drupal migration

A WordPress to Drupal migration makes sense when a site has outgrown WordPress roles and content types: many editors needing different permissions, structured content that plugins have stretched thin, or several languages. We map posts, custom post types and custom fields onto Drupal content types and fields, and move media and users with them. If the site is simple, we say it should stay where it is.

Drupal to WordPress or a headless CMS

Some Drupal sites cost more to run than their content justifies. When the content model is simple and the team is small, a move to WordPress or a headless CMS can lower upkeep. Our website migration team handles that direction, our WordPress development team builds the target, and headless WordPress covers the decoupled option.

Importing from a legacy or proprietary CMS

Sites on an older proprietary system arrive as database exports, XML feeds, spreadsheets or pages scraped from the live site. We write import scripts against Drupal’s Migrate API, clean the content in staging and keep a mapping sheet that shows where every field landed, so your editors can check the result themselves.

Drupal website redesign without a rebuild

A Drupal website redesign does not have to mean a new platform. If the content model and the editor workflows still work, the visible layer can change while the structure underneath stays put.

A new theme on the same content model

We keep the content types, fields, taxonomies and URLs, and replace the theme: new layouts, type, color, components and templates. Editors keep the screens they know, the data stays where it is and the risk is limited to the presentation layer.

Layout Builder and editor-built pages

Layout Builder is a core module that lets editors and site builders assemble visual layouts, with default layouts per content type and overrides on individual items, as the Layout Builder documentation describes. We use it where marketing teams must build landing pages without a developer, and we limit it to approved components so pages stay on brand.

When a redesign has to become a rebuild

If the site runs a release that no longer gets security fixes, if the theme depends on Drupal 7 patterns that cannot be ported, or if the content model fights every new page, new paint will not hold. We say so before design starts. Our website redesign page covers the general case, and the guide on traffic drops after a redesign shows what to protect.

Drupal web design and the editor experience

Drupal web design serves two audiences: visitors and the people who publish. A Drupal web design company that only shows homepage mockups leaves editors with a site they cannot safely change.

Designing components editors cannot break

We design a set of components with fixed spacing, type and color rules and a small number of options on each. Editors choose a component, fill in fields and cannot drift off brand, because the freedom they have is the freedom we designed in.

Roles, drafts and content moderation

Drupal core includes the Workflows and Content Moderation modules, and Content Moderation expands on the plain unpublished and published states. We set up review steps around how your departments really approve content, and pair them with roles so that only the right people publish.

Accessibility built into the theme

Drupal accessibility depends on the theme and the content, not on the CMS alone. We build themes to the WCAG 2.2 Level AA criteria, the W3C Recommendation published December 12, 2024. It added AA criteria such as Focus Not Obscured (Minimum) and Target Size (Minimum), which hit sticky headers and small buttons first. Each component is tested on its own. More on accessible website design.

Drupal for enterprise: multisite and multilingual estates

Drupal for enterprise work usually means many sites, many editors and many languages sharing one platform.

Drupal multisite: one codebase, many sites

Drupal can serve separate, independent sites from a single codebase, and the multisite documentation notes that each site keeps its own database, configuration, files and domain. The upside is one codebase to patch. The trade-off is the same fact seen from the other side: every site on that codebase takes an update together, so a change one site needs is a change for all. We weigh that before recommending multisite over separate installs.

Multilingual Drupal for translated content and interface

The Language, Interface Translation, Content Translation and Configuration Translation modules ship with Drupal core, per the multilingual guide. A Drupal multilingual build therefore starts without extra translation modules: editors translate content field by field, while interface strings and configuration are translated separately. Page design for several languages is covered on our multilingual websites page.

Governance for many editors and departments

Large estates fail on ownership, not technology. We map which department owns which section, which roles publish, which templates are locked and who approves a new component. The result is a one-page governance sheet that a new team can read in ten minutes.

Headless Drupal and decoupled front ends

Headless Drupal keeps Drupal as the place where content is modeled and edited, and hands presentation to a separate front end. A Drupal decoupled build suits teams that need one content source for a site, an app and a kiosk, or that have front-end engineers who want their own framework.

JSON:API in core and GraphQL as a contributed module

The JSON:API module is part of Drupal core and exposes content for create, read, update and delete over HTTP with no configuration required. GraphQL is a contributed module, not core, and its latest release works with Drupal 10.4 and 11. We default to JSON:API and add GraphQL when a front end needs to ask for exactly the fields it renders.

Next.js or React on the front

Our front-end engineers build the presentation layer in Next.js development or React development and deploy it separately. Editors keep the Drupal admin screens, and previews are wired so a draft renders on the real front end before it is published.

When decoupling is not worth it

Two stacks mean two deployments, two sets of dependencies and two things to monitor. A standard Drupal theme serves a site with ordinary needs more cheaply. Our guides on headless or traditional CMS and headless CMS options set out how to decide.

Drupal ecommerce with Drupal Commerce

Drupal ecommerce means Drupal Commerce, a framework for building stores rather than a boxed shop. Drupal Commerce development suits catalogs where content and commerce overlap.

Where Commerce fits

The Drupal Commerce project describes itself as a framework, with custom product types, product variations, multiple order types, checkout flows and promotions. That flexibility fits stores whose products are also rich content, or whose buying process has unusual rules. We scope memberships, event registration and donation flows case by case, checking which modules cover them before we promise a build.

Where Shopify or WooCommerce fits better

For a plain catalog with standard checkout, a hosted platform or WooCommerce costs less to build and less to keep running. We build those as well, and our ecommerce development page explains how we choose.

Payment fields and PCI scope on Commerce sites

The Commerce project page says its payment API connects to more than 100 gateways, and it tells site owners that protecting merchants and customers from fraud is their responsibility. We favor gateway-hosted payment fields so card numbers never touch the Drupal server, which keeps PCI scope smaller. That is a design choice, not a compliance certification.

Drupal integrations: CRM, marketing automation, search and sign-in

Most Drupal sites have to exchange data with something else. We scope each connection before any code: what moves, in which direction, how often and what happens when it fails.

Salesforce and other CRMs

A Drupal Salesforce integration usually runs through the Salesforce Suite, modules that synchronize Drupal entities such as users, nodes and files with Salesforce objects, pushing and pulling data in real time or on cron. Its current release lists support for Drupal 10.3 and 11. HubSpot and other CRMs connect through their APIs or contributed modules, which we check per project. See Salesforce development and CRM development.

Site search

The Search API module is a framework for searching any entity type with the engine you choose. Its built-in database backend suits testing and smaller sites, while larger ones are pointed to Solr or Elasticsearch. Views then display results, and facets let visitors narrow them.

Single sign-on and APIs

Sign-in through your identity provider, and APIs to and from internal systems, are scoped for credentials, error handling and logging before build starts. Our API development team handles the interfaces on the other side.

Is Drupal secure? Updates, advisories and Drupal website maintenance

Drupal security depends on update discipline more than on the code at rest. Our Drupal maintenance services and Drupal support services keep core, modules and libraries on supported releases, so Drupal website maintenance is a steady monthly rhythm instead of an emergency.

Security advisories and release windows

The Drupal Security Team publishes advisories for core and contributed projects, each with a risk rating, and sites can subscribe by email or RSS. Under its advisory policy, advisories cover stable releases only; development, alpha, beta and release candidate versions get none. The team can announce a critical fix ahead of a Wednesday release and warns that exploits may appear within hours or days, so we keep a staging copy ready.

Composer-managed updates and a staging copy

Drupal uses Composer to manage the libraries it depends on, and a site build can use it to manage modules too, with project templates shipping in core since Drupal 8.8.0. We run updates through Composer on a staging copy first, review the change list, run the tests and then deploy the same lock file to production.

Drupal performance optimization for editors and logged-in users

Page caching helps anonymous visitors, but editors and members are logged in and need other work: tuned queries, cached blocks, lean Views and sensible image styles. Drupal performance optimization here means profiling the slow admin screens and member pages, not only the homepage. Front-end speed beyond Drupal sits with our speed optimization team.

Drupal vs WordPress: which one for which site

Neither wins everywhere. The decision comes down to the content model, who edits it, how many languages are involved and who you can hire to look after it.

Why is Drupal better than WordPress?

It is better when the problem is structure: content types that reference each other, fine-grained permissions, several languages or several sites on one platform. It is not better for a small team that needs to launch quickly and keep costs low. The honest answer is that they solve different problems.

When to use Drupal

Use Drupal when content is complex, many people publish under different rules, the site must serve several languages or departments, and the organization expects the platform to last a decade. Skip it when a template and a handful of pages would do.

Is Drupal worth it?

It is worth it when you need what it does and budget for what it takes: skilled developers, update discipline and a clear content model. It is poor value when those needs are missing. Our WordPress development page covers the other path, and CMS platforms compared puts more options side by side.

Drupal for universities, nonprofits and government

Drupal for higher education, Drupal for nonprofits and Drupal for government share a pattern: many contributors, long-lived content and public accountability.

University and college sites

Universities run hundreds of pages owned by dozens of departments, with faculty profiles, program listings, news and events. Drupal’s permissions, content types and multisite option suit that shape. For the marketing side of the same institutions, see higher education marketing.

Nonprofit sites

Nonprofits need donation paths, event pages, program stories and volunteer sign-ups, usually edited by a small staff. We build what the team can maintain, and our nonprofit website design page shows the wider scope.

Public-sector sites, Section 508 and ADA Title II web rules

Section 508 applies to federal agencies, and its 2017 update aligned requirements with WCAG 2.0. State and local governments fall under the ADA Title II web rule, whose 28 CFR 35.200 requires WCAG 2.1 Level A and AA. The Department of Justice extended the compliance dates in April 2026: April 26, 2027 for entities with 50,000 people or more, and April 26, 2028 for smaller ones and special district governments. See government website design and government marketing. General information, not legal advice.

How to build a Drupal website: our process

To build a Drupal website well, the order matters: structure first, design second, code third, with a staging copy at every stage.

The first two weeks: discovery, content model and audit

We interview the people who publish, list the content types and fields, and agree who owns what. For an existing site, a Drupal site audit reviews code, configuration, modules, hosting and content, and ends with a written scope and a price.

Prototype, build sprints and editor training

A clickable prototype comes before any theme work, so editors test the screens they will use. Build then runs in short sprints with a demo at each end, and editor training is recorded for new hires.

QA on staging, launch and the 30 days after

Everything is tested on a staging copy: forms, redirects, permissions, accessibility checks and a restore from backup. We launch, then watch the logs and triage anything that surfaces through the first 30 days.

Hire Drupal developers: engagement models

When you hire Drupal developers, you choose a model before you choose a person. The same Drupal web developer costs different amounts and carries different risk depending on how the work is organized. Many teams hire dedicated Drupal developers when work is steady and a project team when it is not.

Our dedicated developers page explains how that model works, and white label web development covers the partner arrangement.

What a dedicated Drupal developer arrangement includes

A named developer, a shared board of priorities, access to your repository and staging, and code review. Drupal developers on this model work inside your process, and you can stop or change direction with notice.

PHP skills behind Drupal work

Drupal is written in PHP, so good Drupal work rests on solid PHP: object-oriented design, dependency management and testing. Our PHP development page covers the language side of the stack.

How AI assistants answer Drupal agency and upgrade questions

When a buyer asks an assistant for a Drupal web development company or about the upgrade deadline, the answer is assembled from drupal.org for version and support facts and from agency pages that state services, process, prices and limits plainly.

What buyers ask assistants about Drupal

Four questions come up again and again: what a Drupal site costs, when the upgrade deadline is, whether to choose Drupal or WordPress, and who maintains the site afterward. This page answers each in a sentence you can quote.

What we publish so the answer is accurate

Dates with the schedule they come from, ownership terms, the steps of our process, price context and the cases where we advise against Drupal. If you want your own pages to be quotable in the same way, our SEO services team can help.

How to choose a Drupal agency

Choosing a Drupal agency comes down to evidence. Compare every Drupal web development company on your shortlist, along with other Drupal agencies and Drupal development companies, on how they answer the questions below. A Drupal web agency that cannot show an upgrade plan passes that risk to you.

Questions to ask a Drupal development agency

Put these to any Drupal web development agency before you sign.

• What is your plan for moving this site from its current release to the next one?
• Is there a staging environment that mirrors production, and who pays for it?
• How is configuration managed, and is it exported to version control?
• Who owns the code repository, the hosting account and the admin accounts?
• Which contributed modules will you use, and who tracks their security advisories?

Red flags

No plan for Drupal 11, patched core files, no QA environment, and contracts that tie the code or hosting to the agency. A Drupal development firm that cannot show these basics is a risk. Ask for the contribution record on drupal.org of the developers who will work on your site; it is public, so a firm that claims one can show it.

Whichever team you pick, the following items should sit in accounts you control from the first day.

Drupal consulting before you commit

Drupal consulting is a short paid review before a big decision: stay or leave Drupal, upgrade or rebuild, one site or several. Drupal consulting services end in a written recommendation and a price for the work, which you can use with any vendor.

Progression is based in New York City, so if you want a Drupal development company New York teams can meet, that is us; as a Drupal development company in USA coverage, we work remotely with clients in all 50 states and worldwide.

How much does a Drupal website cost to build and run?

How much does Drupal cost? The software is free, so the cost is whatever it takes to build, host and support the site. A Drupal web development company prices the build after a written scope, and this section shows what shapes it.

Drupal has no license fee

Drupal is open source and free to use, and drupal.org links the GPL as its license. There is no license to buy. You pay for the build, hosting, third-party services and the support that keeps the site current.

What we quote, and how

Drupal builds, migrations and support are quoted after a written scope that follows discovery. Drupal development cost moves with the number of content types, custom modules, integrations, sites, languages and migrated pages. We publish no Drupal package price, because one would be wrong for most projects.

Our fixed-scope website rows as context

For marketing sites, our published fixed-scope rows give a sense of scale. They are context for simple sites, not Drupal prices.

Full tiers are on fixed-scope website pricing. A conversation about a Drupal project starts with a free proposal.

Related services

These pages cover the work that sits next to a Drupal project.

• WordPress development: when the simpler CMS is the right call
• Website migration: redirects, parity and cut-over
• CMS platforms compared
• Headless or traditional CMS
• Headless CMS options
• Headless WordPress
• Software development
• Web development services
• Fixed-scope website pricing
• Custom website development
• Accessible website design
• SEO services
• One-off SEO projects
• PHP development
• Nonprofit website design
• Government website design
• Government marketing
• Higher education marketing
• Multilingual websites
• Website redesign
• Traffic drop after a redesign
• Website security
• Website maintenance
• API development
• CRM development
• Salesforce development
• Dedicated developers
• White label web development
• Next.js development
• React development
• Speed optimization
• Ecommerce development
• Enterprise SEO
• Drupal SEO agency
• CMS web development company

Frequently asked questions