If you've tried to find out how much Drupal maintenance costs in the UK, you've probably noticed that almost nobody publishes their pricing. Agency websites talk about "bespoke retainers" and ask you to get in touch. Specialist services stay vague. This post is an attempt to give you something more useful.

We'll cover what Drupal maintenance actually involves, what drives cost variation, the main service models you'll encounter, and what should raise questions when you're evaluating a quote.

What Drupal maintenance actually involves

Before talking about cost, it's worth being clear about what you're buying. Drupal maintenance — specifically security maintenance — is not a single task. It includes:

  • Advisory monitoring. The Drupal Security Team publishes advisories for Drupal core and contributed modules. Someone needs to track these continuously — not check in monthly.
  • Assessment. Not every advisory affects every site. The module it covers might not be installed, or the severity might not warrant immediate action. Someone needs to read the advisory and make that call.
  • Testing. Updates should be applied to a staging or development copy of your site before going live, to catch conflicts with custom code or other modules.
  • Deployment. The actual update: applied, tested, pushed to production with a rollback plan in place if something breaks.
  • Reporting. A clear record of what was updated, what advisory it addressed, and what was checked — both for your own records and for any governance or compliance requirements.

A service that skips any of these steps is offering something different from what most people think they're getting. It's worth asking explicitly which of these are included.

What drives cost variation

Several factors determine how much ongoing Drupal maintenance should reasonably cost:

Number of contributed modules

Drupal core gets security updates a handful of times per year. The contributed modules on your site — the add-ons that handle contact forms, media, editorial workflow, e-commerce, and everything else — each have their own security advisories. A site with 50 contrib modules has a significantly larger advisory surface than one with 10. More modules means more advisories to monitor, assess, and test.

Custom code

If your site has custom modules or theme code, updates need to be tested against that custom code. Contrib updates can interact with custom implementations in unexpected ways. Sites with substantial custom development require more careful testing before deployment.

Environment setup

Testing properly requires a staging or development environment that mirrors production. If that doesn't exist, the person maintaining your site either has to set one up (a one-off cost) or is deploying to production without proper testing (a risk you should be aware of).

Drupal version

Sites on Drupal 10 or 11 — currently supported versions — are easier to maintain. Sites on Drupal 7 or 9, which have both reached end of life, have no security team behind them and no patches coming. These sites are in a different situation entirely, and the question of maintenance becomes entangled with the question of migration.

Reporting and communication requirements

Some clients want a quick summary email when an update is deployed. Others need detailed change records for internal audit processes or compliance reasons. More comprehensive reporting takes more time and affects the monthly cost.

The main service models

There are broadly four ways organisations handle Drupal maintenance in the UK, each with different cost structures:

Agency retainer

Large digital agencies typically offer maintenance as part of a broader support retainer, bundled alongside development capacity, strategic advice, and account management. These tend to be the most expensive option — not because maintenance itself is costly, but because you're paying for overhead and capacity you may not use. The maintenance component is rarely broken out as a separate line item, which makes it difficult to evaluate whether you're getting fair value for that specific service.

Useful if you have ongoing development needs alongside maintenance. Less suited to organisations that just need the site kept secure and don't need a full agency relationship.

Specialist maintenance service

Services that focus specifically on Drupal maintenance — monitoring, testing, deploying updates, reporting — without the broader agency overhead. Because this is their core work rather than a line in a larger retainer, pricing tends to be more transparent and the scope more clearly defined. Monthly cost is typically lower than an agency retainer for equivalent maintenance work.

Suited to organisations that have a site in reasonable shape and need it kept secure and up to date, without ongoing development requirements.

Developer on retainer

Some organisations retain a freelance Drupal developer for a set number of hours per month, with maintenance forming part of that time. This can work well if you have a range of small development tasks alongside maintenance, but it's often not the most cost-efficient way to cover pure maintenance. Developer hourly rates mean you're paying a development premium for work that is partly administrative — monitoring feeds, writing reports — rather than pure development.

Useful when you need a mix of maintenance and ad hoc development from someone who knows your site well.

In-house or DIY

Handling maintenance internally is not free, even if it looks like it on a spreadsheet. Someone on your team needs to monitor advisories, test updates, and deploy them — and that's time taken away from other work. The more significant cost is usually the opportunity cost: a developer spending two or three hours per month on security patches is a developer not building new features. It's also worth asking honestly whether the process is being done properly — staging environments, documentation, rollback capability — when it falls between other priorities.

Can work well for teams with the right skills and discipline. Worth auditing what's actually being done versus what you assume is being done.

What makes a price reasonable

Without a published market rate to compare against, it's difficult to benchmark a quote. A few proxies that are more useful than the headline number:

  • Is the scope clear? A good quote should specify what's included: core updates, contrib updates, staging environment, deployment process, reporting. If the scope isn't defined, the price is meaningless.
  • Is there a minimum contract? Maintenance services that require a minimum 12-month commitment are asking you to take a larger risk on a provider you haven't worked with. Month-to-month arrangements are fairer to the client.
  • What does the initial assessment look like? A proper maintenance provider should want to understand your site before quoting. A quote given without any review of what's on your site — how many modules, what Drupal version, whether a staging environment exists — is probably a standard rate card rather than a price calibrated to your situation.
  • How do they handle advisories for modules you're not running? The answer should be "we check your module list first." A service that applies every advisory regardless of your setup is either inefficient or not really checking.

A note on very low prices: Maintenance services that are significantly cheaper than others are usually cheaper for a reason — lower testing rigour, less comprehensive advisory coverage, automated deployment without human review. The risk in Drupal maintenance isn't paying slightly too much; it's paying for something that isn't actually being done properly. Ask specifically about the testing process before an update goes live.

How Nodely prices maintenance

We do a free security health check on your site before agreeing anything — Drupal version, outstanding advisories, module count, staging environment. That lets us give you a price that's based on what your site actually needs, not a standard rate card.

Pricing is monthly, with no minimum term. No retainer, no lock-in. If we're not doing what you need, you can stop.

What's included: Drupal core and contrib security updates tracked, tested on staging, and deployed within days of each advisory. Monthly report covering what was updated, what it addressed, and what we checked. No padding.

If you want to know where your site stands before making any decision, get in touch for a free security check. We'll tell you what's outstanding and what it would take to address it.

If you're evaluating providers more broadly, the questions in our guide to choosing a Drupal maintenance service are worth working through before you commit to anything.