"Drupal development services" covers a wide range of actual work, and clients often don't know which of those services they need until something's already broken. Here's a practical breakdown of what a Drupal engagement typically includes, so you can scope your own project accurately.
Security maintenance — the non-negotiable baseline
Drupal core and contrib module security advisories go out regularly, and unpatched sites are actively scanned for known vulnerabilities within days of a disclosure. A professional maintenance service includes:
- Monitoring Drupal's security advisory feed and applying core/contrib patches, typically within 48–72 hours for anything rated "critical" or "highly critical"
- Running a module audit at least twice a year to remove unused contrib modules — every installed module is attack surface whether it's actively used or not
- Keeping PHP version current (Drupal 10 requires PHP 8.1+; Drupal 11 requires PHP 8.3+) since running an unsupported PHP version blocks core security updates
Budget $500–$1,500 CAD/month for security maintenance alone on a mid-complexity site, scaling with module count.
Version upgrades — the work everyone defers
Drupal's major version upgrades (7 to 9/10, and 9 to 10/11) range from moderate to near-total rebuilds depending on how many contrib modules and custom code the site carries. Drupal 7 reached end of life in January 2025, meaning any site still on D7 is now running without security support — a real liability for anything handling customer data under PIPEDA. Realistic upgrade cost ranges:
- Drupal 9 to 10: $5,000–$15,000 CAD for a standard site (most modules have compatible releases)
- Drupal 7 to 10/11: $30,000–$90,000 CAD, effectively a rebuild, since the underlying architecture changed completely between 7 and 8+
Custom module development
When contrib modules don't cover a specific business requirement — a custom booking system, a proprietary integration, a non-standard permission structure — custom module development is the right tool. This should follow Drupal's coding standards and use its plugin/service architecture (not procedural hacks in a .theme file) so the module survives future core upgrades without a rewrite. Expect $3,000–$12,000 CAD per custom module depending on complexity and how many entity types it touches.
Performance and caching work
Drupal's caching system (internal page cache, dynamic page cache, BigPipe, and Views caching) is powerful but needs deliberate configuration — it doesn't self-tune. Professional performance work typically includes:
- Auditing cache tags and contexts so cached content invalidates correctly instead of either staying stale or never actually caching
- Configuring a CDN (Cloudflare, Fastly) with proper cache-control headers for anonymous traffic
- Database query optimization for Views-heavy pages, particularly ones with multiple relationships or exposed filters
Front-end theming
Drupal theming today typically uses Twig templates with a modern component workflow — many shops build with Storybook-driven component libraries (via the UI Patterns module) so front-end components stay in sync between the design system and the actual rendered markup. This is distinct from custom module development and is usually priced separately, in the $15,000–$40,000 CAD range for a full custom theme.
Integration work
Connecting Drupal to a CRM, ERP, payment gateway, or identity provider is typically the most variable-cost category, ranging from $4,000 CAD for a simple webhook-based sync to $50,000+ CAD for a two-way, real-time integration with an enterprise system with its own data model to reconcile against.
How to scope your own engagement
Before requesting quotes, identify which of the above categories you actually need — a site that's secure, current, and just needs a new landing page doesn't need the same engagement as a Drupal 7 site with custom modules nobody's touched in six years. Being specific about which category you're in gets you a far more accurate quote than "we need Drupal help."
Tell us your Drupal version and what's currently broken, and we'll tell you which of these service categories actually applies to your situation.
Surrey, BC
A full-service digital agency working in WordPress, Drupal, Shopify, Webflow, React, and React Native. We partner with universities, governments, and growing brands to ship sites and products that hold up after launch.
