A Drupal website audit helps you understand the technical condition of your site and decide what to address first. It can support a project takeover, investigate recurring issues or prepare for an upgrade.
I offer an assessment with a scope agreed with you, followed by a report connecting each finding to its implications and recommended actions. The aim is not to collect automated warnings, but to give your team information it can act on.
When should you audit your Drupal website?
An audit is useful when updates become difficult, the same issues keep recurring or no one has a reliable view of the architecture. It can also support a supplier handover and help separate urgent work from improvements that can be scheduled.
Before a significant change, an assessment can examine whether the platform is ready to support new functionality. For an upgrade, it identifies dependencies, adaptations and checks to plan for, rather than promising a straightforward process before the site has been reviewed.
What the audit covers
Application security and dependencies
The scope can cover Drupal core, modules, themes and PHP dependencies, applicable security advisories, permissions and file access arrangements. Findings are interpreted in the context of the website and the environments actually examined.
Performance and caching
Depending on available access, the assessment can examine response times, expensive queries, rendering and cache usage. Measurements state their conditions, including tested pages, environment, cache state and relevant user profiles.
Custom code and architecture
The review examines selected areas of custom modules and themes: code organisation, use of Drupal APIs, component responsibilities and fragile implementation choices. Style issues are distinguished from problems that may affect behaviour, security or maintainability.
Configuration, deployment and operations
The audit can include configuration management, differences between environments, delivery steps and backup arrangements. The aim is to identify operations that are difficult to reproduce and dependencies on undocumented project knowledge.
Drupal upgrade readiness
To prepare for an upgrade, I review project constraints and the components that need attention. Upgrade Status can help identify compatibility issues; its results need to be complemented by a review of code, integrations and user journeys to test.
Technical SEO, where included in scope
Selected checks can cover metadata, URLs, redirects, indexing directives and the consistency of language versions. This technical review does not replace a full assessment of search demand, competitors or content strategy.
What you receive
A summary for decision-making
The summary sets out priority issues, identified risks and assessment limitations. It helps the project owner make decisions without first working through every technical detail.
A documented technical report
Each finding identifies the affected area, observed evidence, possible impact and recommendation. Reproduced issues, risks requiring confirmation and suggested improvements are kept distinct so that a hypothesis is not presented as a confirmed incident.
A prioritised action plan
Recommendations are ordered by importance and dependencies between tasks. Where enough information is available, the report provides an indicative effort estimate; an audit estimate is not, by itself, a fixed-price commitment to implementation.
How the audit works
Scoping establishes your objectives, the areas to examine, the time allocated and the deliverables. This makes clear what will be checked and what remains outside the engagement.
We then arrange access or transfer of a working copy, including the necessary code, configuration and data. Transfer methods, any anonymisation and retention arrangements are agreed before collection. Sensitive access details should not be sent through a public form.
The assessment combines manual review with checks suited to the project. Depending on the environment, tools such as Composer audit, Coder or Upgrade Status can support the work. They provide evidence, not proof that a website has no vulnerabilities or is fully maintainable.
The review meeting is an opportunity to discuss findings, priorities and next steps. Your team can use the report to plan fixes, and implementation can also be scoped as a separate engagement.
A documented audit reference
In 2020, I carried out a technical and functional audit of FDJ Gaming Solutions’ Drupal 8 CMS, including a review of development practices and maintainability recommendations. This reference is presented in its historical context.
Read the FDJ Gaming Solutions audit case study
Frequently asked questions
Does the audit include implementing fixes?
Not automatically. Assessment and implementation are separate scopes. The report helps you decide what to address; your team can carry out the work, or implementation can be covered by a separate proposal.
Is this a penetration test or an accessibility audit?
No, unless a specific scope has been explicitly agreed. A Drupal technical review should not be presented as a penetration test, security certification or complete accessibility compliance audit.
What budget and access are required?
Budget depends on the objectives, website size, custom code and depth of assessment. Required access is agreed during scoping. Without code or a usable environment, some conclusions will be limited to what can be observed.
Let’s define the scope of your audit
Tell me about your website, the issues you are facing and the decisions you need to make. We can then identify the areas to examine and the information needed for a suitable proposal.