Drupal security, performance and code audits

Find out what is really going on inside your Drupal site. A senior engineer reviews it and gives you a prioritized list of what to fix, and what can wait.

Request an audit

When an audit makes sense

  • The site is slow and nobody can say exactly why
  • You have taken over a site from another agency or developer
  • You are planning a Drupal 11 upgrade or a redesign and want to know what you are dealing with
  • A security incident, a failed update or an insurance questionnaire has raised questions
  • You want an independent opinion before investing more in the platform

What we review

Security

  • Drupal core and contributed module versions against published security advisories
  • User roles, permissions and administrator accounts
  • Text formats, file upload settings and other common misconfigurations
  • Exposed files, configuration and development tools on the live site

Performance

  • Drupal caching configuration, CDN and reverse proxy setup
  • Slow pages, heavy Views and database queries
  • Core Web Vitals, images, scripts and third-party tags
  • Cron, queues and background jobs

Code and upgrade readiness

  • Custom modules and theme: structure, deprecated APIs and maintainability
  • Contributed modules that are abandoned or block a Drupal 11 upgrade
  • Deployment, configuration management and backups

How it works

  1. 1

    Scope

    A short call or email exchange about the site and your concerns. We agree the scope and price of the audit before it starts.

  2. 2

    Access

    You share read access to the code and a copy of the site, or staging access. We do not need to change anything on production.

  3. 3

    Review

    A senior engineer works through the site using automated tools and a manual review.

  4. 4

    Report and walkthrough

    You get a plain-language report, ordered by risk and effort, and we walk you through it.

What you get

A written report that explains each finding, why it matters and what it would take to fix it, ordered so you can deal with the most important issues first. It is yours to keep and to use with any developer. If you want us to fix what we find, we estimate that work separately.

Frequently asked questions

Is an automated scan enough?
Automated tools catch outdated modules and some misconfigurations. Many real problems, such as risky permissions, fragile custom code or slow queries, only show up in a manual review.
Will the audit affect our live site?
No. We work from the code and a copy of the site or a staging environment.
Do we have to hire you to fix the issues?
No. The report is written so that any competent Drupal developer, including your own team, can act on it.
Our site is broken right now. Is an audit the right first step?
No, fix the urgent problem first. Our Drupal help service is set up for that, and an audit can follow once things are stable.

Something broken right now? Get urgent Drupal help.

Related articles

Get a clear picture of your Drupal site

Tell us what worries you about the site and we will suggest the right audit scope.

Request an audit