Service
Drupal audit
A fixed-price read of a Drupal platform you inherited or stopped trusting. Every risk in priority order, with the hours attached, and a straight answer on what needs doing now and what can wait. Report in 48 hours from the moment we have access.
Both platforms we took over in 2025 started with this audit, and they came back different. On AWHelp24 it surfaced backdoors in the codebase and credentials sitting in the webroot; Autowelt turned out to be in decent shape, and the report said so. Either answer is worth having before you commit money to the next twelve months.
Scope
What we look at
-
Core and contrib status
Every module checked against its current release and any open security advisory. Most sites turn out to have fewer real exposures than the update list suggests, and we say which is which.
-
Custom code
The modules and theme written specifically for this site: deprecated APIs, patterns that will break on upgrade, and the business logic that lives in code nobody documented.
-
Security posture
Roles and permissions, credentials committed to the repository, exposed endpoints, file handling. We flag what an upgrade would change here too.
-
Performance and caching
Cache configuration, slow queries and front-end weight, plus how much of the current speed depends on traffic still being low.
-
Upgrade path
What it takes to reach a supported Drupal version, in hours, with every contrib gap and custom rewrite listed by name.
-
Operations
Deployment, environments, backups, rollback. The question we answer is whether a fix can be shipped safely on the day it is needed.
Pricing
Fixed price, fixed scope
-
$600 — Platform audit
One Drupal site, up to roughly 80 modules, single environment. Report within 48 hours of getting access.
-
$1,500 — Deep audit
Multisite, 150+ modules, Drupal Commerce or custom integrations. Report within 5 working days.
What you receive
- A risk register: every finding graded by severity and written so a non-technical owner can act on it.
- Hours against each fix, so you can turn the report into a budget without another call.
- The order to fix things in, and what is safe to leave alone.
- An upgrade assessment: what a move to a supported Drupal version costs, and what blocks it today.
- A 45-minute walkthrough call with the engineer who wrote the report, included in the price.
How it runs
- Day 0. NDA if you want one, then access: repository or a site copy, an admin account, hosting details.
- Day 1. Automated baseline across modules, advisories, performance and configuration, then manual review of the custom code, which is the part scanners cannot do.
- Day 2. Report delivered, walkthrough call booked.
What we need from you
- Read access to the repository, or an exported copy of the codebase.
- An administrator account on a non-production environment where possible.
- Hosting and deployment context: where it runs and how code gets there.
- One technical contact for questions.
Do not send production secrets. If credentials are sitting in the repository, that finding goes in the report.
If you decide to fix it with us
The audit fee is credited against your first month of support, or against the upgrade project, if you start within 60 days. Either way the report is yours, and it is written so another team could work from it.
What this is not
It is not an SEO audit, a design review, or a scanner report with our logo on the cover. A senior engineer reads the platform and writes down what owning it will cost you over the next two years.
Recent builds
Where we shipped this
Talk through the build
Send the platform, constraints, and timeline. We'll reply with the engineering questions that decide scope.
- Reply within one business day, weekday hours UA / EU.
- 30-minute discovery call when it is useful.
- Scope written around deliverables, risks, and ownership.