How To Update Drupal

At this point, it is worth clarifying that there are two different types of processes for ‘updating’ Drupal.

1. Upgrading Drupal process
2. Updating Drupal process

There is the ‘upgrading’ process which involves changing your website from one major Drupal version to another major Drupal version – for example, from Drupal 8 to Drupal 9, and there is the process of updating Drupal from one minor version to another minor version – for example, from Drupal 8.1 to Drupal 8.2. This is officially called ‘updating’ in Drupal speak.

Upgrading is more complex than updating and usually requires significant technical knowledge. For support and advice with upgrades, we recommend contacting your Drupal agency.

Why you should keep your Drupal site updated

Failing to regularly update your Drupal website can lead to serious issues, including:

Security vulnerabilities:

Older versions of Drupal often contain bugs and security flaws that hackers can exploit. These are typically fixed in the latest updates.

Performance issues:

New releases include enhancements that improve speed, mobile responsiveness, and overall site performance.

Lack of new features:

Sticking with outdated software means missing out on valuable new features that enhance user experience and boost your site’s digital capabilities.

In short, keeping your Drupal site up-to-date is essential for maintaining security, speed, and functionality. An outdated site not only frustrates users but is also more susceptible to hacking, data breaches, or ransomware attacks.

Read on to learn how to safely update your Drupal site and protect your digital presence.

Ways to update Drupal

There are several ways to update your Drupal site, depending on your technical skills and preferences.

At present, Drupal does not support automatic updates, though it’s a key focus area for the platform’s future development—so stay tuned!

For now, most site owners choose between two main methods:

Manual updates – Ideal for beginners or those without extensive technical knowledge of Drupal. This method involves downloading update files and replacing them manually on your server.
Composer-based updates – Recommended for developers or users comfortable with command-line tools. Composer allows for greater control and is the preferred method for managing dependencies in modern Drupal sites.

Drupal update methods comparison table

This checklist comparison table helps you decide between manually updating Drupal and using Composer. It compares key steps, technical requirements, and user-friendliness for each method.

We’ll explore both of these methods in detail below to help you choose the right one.

Note: There’s also a third method using Drush, a command-line shell for Drupal. However, Drush updates are primarily relevant to Drupal 7 and earlier versions. If you’re using Drupal 6 or 7, check out Drupal.org for detailed guidance tailored to legacy versions.

Before Updating – A Quick but Important Warning

Always backup your site before running any updates.

A site backup is a complete copy of your Drupal website’s files, database, and content. It acts as a safety net – if anything goes wrong during the update process, you can quickly restore your site and avoid downtime or data loss.

While most Drupal updates are straightforward, there’s always a small risk of errors or conflicts. Without a backup, you could be left with a broken or inaccessible site.

Need help with a backup? Check out our Ultimate Guide to Drupal Website Optimisation for step-by-step instructions.

How to update Drupal manually

If you’re new to Drupal or prefer a straightforward approach, manual updates using an FTP client are usually the best option.

Before you start:

• Ensure you have permission to administer software updates.
• Download the latest Drupal update package and save it outside your webroot.
• Back up any custom changes to files like .htaccess or robots.txt – you’ll need to restore these later.

Step 1: Put Your Site into Maintenance Mode

Navigate to Administration > Configuration > Development > Maintenance mode, check “Put site into maintenance mode”, and save.

Step 2: Update default.settings.php if Required

Some Drupal updates modify default.settings.php. Check the release notes on Drupal.org to see if this is required.

If it is needed:

• Download the new default.settings.php
• Copy your custom settings from your backup into it
• Rename it to settings.php and replace the old file in /sites/*.

Step 3: Remove Old Core Files

Using your FTP client, delete the Drupal top-level files, /core, and /vendor directories.

Do not delete /modules, /profiles, /sites, or /themes.

Step 4: Upload New Files

Upload the new Drupal core files, including the top-level files, /core, and /vendor directories.

Restore any custom changes to files like .htaccess or robots.txt.

Step 5: Run the Update Script

In your browser, visit yourdomain.com/update.php and follow the prompts to finish the update.

Step 6: Test Your Site Thoroughly

After updating, check that everything looks and works as it should. If you notice any issues, try clearing your browser cache. If problems persist, you can revert to your backup or reach out to your Drupal support team.

Step 7: Take Your Site Out of Maintenance Mode

Once everything’s confirmed working, disable maintenance mode so your visitors can enjoy your updated site.

Following these steps carefully will keep your Drupal site secure, fast, and running smoothly.

How to update Drupal using Composer

Using Composer to update Drupal is ideal for users with technical knowledge and familiarity with Drupal’s system.

Before you start: If your site wasn’t initially set up with Composer or is running a version earlier than Drupal 8.8.0, you may need to update your composer.json file or switch to the drupal/recommended-project template.

To update Drupal, you first need to check whether your site uses Drupal/core-recommended or Drupal/core, as each has a different update command. You can find this out by running:
composer show drupal/core-recommended

Where you’re using Drupal/core-recommended, this will return relevant information. If this is the case, you can use the following command to update:
composer update drupal/core-recommended –with-dependencies

If you’re using Drupal/core instead, then you’ll see a message stating ‘Package Drupal/core-recommended not found’. The update command for Drupal/core is slightly different:
composer update drupal/core –with-dependencies

To finalise your Composer update, type your website’s URL followed by /update.php in a browser. This will update your Drupal database and complete the process. Make sure to check your site is still working and displaying correctly.

If you encounter any issues, it may be because there’s a dependency preventing Drupal core from updating. Alternatively, it could be due to poor settings or abandoned templates in Composer.

For further help and troubleshooting, read the instructions about updating with Composer on Drupal.org, or contact your Drupal agency.

We hope you found this guide on how to update Drupal helpful. For more expert advice, check out our Ultimate Drupal Optimisation Guide, packed with everything you need to keep your Drupal website running smoothly and efficiently.

If you would like customised, on-demand Drupal support, our award-winning agency – with over 20 years of experience – is here to help. Get in touch today to discuss your Drupal needs.