How updates work in Drupal CMS

Drupal CMS ships an interface for reviewing and applying security updates to your site, and can send email notifications about security announcements that affect it. This page explains what updates are, who is responsible for applying them, and the ways to apply them.

Security updates

Any software occasionally has bugs, and some bugs have security implications: they create vulnerabilities that malicious users could exploit to gain unauthorized access or otherwise compromise your site. When security-related bugs are fixed in Drupal CMS or in the modules and themes your site uses, the fix is released as a security update.

Apply security updates regularly to keep your site secure. Because Drupal CMS is not locked to a specific vendor, who applies them depends on your situation. Whoever does it, understand the process and confirm that someone owns it.

Regular updates

Drupal CMS, modules, and themes also release periodic updates that add features and fix bugs without security implications. These updates are less critical than security updates. As a general rule, apply them as long as they do not cause problems with your site.

Ways to apply updates

The built-in update UI is convenient, especially for smaller sites and less complex environments, but it is one of several options. The UI also does not work on all hosting providers: many providers with Drupal-specific hosting plans have their own system for tracking and applying security updates. Check with your hosting provider to see what options are available.

Some hosting providers offer specialized tools, such as a one-click update feature or automated patching, that handle updates behind the scenes. These can save time and reduce the chance of manual errors, especially when recovering from a failed update.

Many projects instead follow a workflow built on quality assurance testing and peer review. Security updates, like any other code change, are tested in a development environment, reviewed, and deployed to the live site only after all checks pass. This approach reduces the risk of unexpected downtime; the deployment workflow page describes it in detail.

The best update path depends on your project’s complexity, team structure, and hosting environment.

Where to go next

• Back up your site before you apply any update.
• Update Drupal core applies core patch releases through the UI.
• Update modules and themes does the same for extensions.