Whilst making updates might seem scary and beginners often worry about breaking their site, it’s actually a relatively simple and straightforward process. We’ll guide you through exactly how to update Drupal in this blog.

Before we move on, it’s worth clarifying that there are two different types of ‘updates’ available for Drupal – and the two often get confused.

We’ll be focusing on how to update Drupal from one minor version to another minor version – for example, from Drupal 8.1 to Drupal 8.2. This is officially called ‘updating’ in Drupal speak.

We won’t be covering the different similarly-named ‘upgrading’ process which involves changing your website from one major Drupal version to another major Drupal version – for example, from Drupal 8 to Drupal 9.

Upgrading is more complex than updating and usually requires significant technical knowledge. For support and advice with upgrades, we recommend contacting your Drupal agency.

why update Drupal

If you don’t update your Drupal website regularly, you face the following risks:

• Security vulnerabilities: older Drupal versions have security weaknesses and bugs which can be exploited by hackers; these vulnerabilities are patched in the latest updates.
• Poor performance: new Drupal versions are designed to overcome issues and improve key areas of site performance such as speed and mobile responsiveness,
• Missing out on features: using old Drupal software will mean you don’t have access to any new features designed to maximise digital performance and engage users.

To sum up, updates are essential to keep your site secure and performing at its best. Without updates, your users may have a frustrating experience and exit your site.

More importantly, outdated Drupal website versions are more vulnerable to security risks, such as being hacked or infected with ransomware. So make sure to read on to get your Drupal site software up-to-date…

ways to update Drupal

Depending on your preferences and technical skills, you can update Drupal in different ways.

Currently, Drupal doesn’t offer automatic updates but it’s one of the platform’s strategic initiatives so we hope it will be available shortly – watch this space!

For now, most website owners need to choose between making manual updates or using Composer.

Manual updates are recommended for beginners or anyone who doesn’t have a great deal of technical Drupal knowledge. If you do have technical skills and are familiar with the Drupal system, then using Composer is usually the best option.

We’ll cover both of these options for how to update Drupal in detail below.

There is also a third option for updating – using Drush. However, as this is only suitable for Drupal 7 and earlier versions, we won’t be covering it in this blog. If you have a Drupal 6 or 7 site, Drupal.org has lots of great, free advice tailored for your site needs.

before updating – a warning!

Before updating your site, make sure to store a backup version.

A site backup is a copy of all of your Drupal site’s files, content and information. If something goes wrong during your software update, you’ll then be able to revert to the backup quickly and keep your site fully-functioning.

Whilst most Drupal updates run smoothly and don’t cause any problems, it’s important to have a backup – just in case! Otherwise you could end up offline or with a broken site.

We explain how to make Drupal backups in our Drupal website optimisation ultimate guide.

how to update Drupal manually

If you’re a Drupal beginner or lacking technical Drupal knowledge, then updating your website via manual installation is usually the best option.

To do this, you need to have user permission to administer software updates. We’ll cover manual updates using an FTP client but if you’d prefer to use shell access instead, then see Drupal.org for more information.

Before commencing, you’ll also need to download the relevant Drupal website update and save it (anywhere outside of your Webroot). You should also make sure to save a copy of any changes you’ve made to files like .htaccess or robots.txt, as you’ll need to reinstate these modifications after updating.

To begin updating, put your site into maintenance mode by going to Administration > Configuration > Development > Maintenance mode. Tick the ‘Put site into maintenance mode’ box and save.

Sometimes, Drupal updates feature changes to the default.settings.php file. If this is the case, you’ll find information in the relevant Drupal version release notes.

If applicable, you’ll need to download the new default.settings.php file. Next, copy any site-specific and custom entries from your latest backup into it, and change the new default.settings.php file name to settings.php. This will mean that it overwrites your previous settings.php file. Finally, locate the new, updated file in your /sites/* directory.

Following this, or if no default.settings.php updates are required, you’ll need to remove your Drupal top-level directory files, core directory and vendor directory using an FTP client.

You can do this by manually selecting the files in your Drupal top-level directory and deleting them. Repeat this process with core and vendor directories. Be super-careful not to delete any modules, profiles, sites or themes.

Finally, locate the Drupal software update you saved earlier and upload the new core, vendor and top-level directory files into your Drupal directory. Now is also a good time to reinstate any manual modifications previously made to files like .htaccess or robots.txt.

To complete the manual update process, you simply need to type your website’s URL followed by /update.php in a browser. And then, you’re done!

Make sure to give your site a thorough inspection to ensure everything is working and displaying correctly. In case of any problems, try clearing your browser cookies, reverting to a backup version, or contacting your Drupal agency.

how to update Drupal using Composer

We now explain how to update Drupal using Composer. This is usually the best option if you have technical knowledge and are confident using the Drupal system.

Before beginning, you may need to make your Composer-ready by modifying your composer.json – this is only applicable if your site was initially created without Composer. If you’re updating from a version earlier than Drupal 8.8.0, you might also need to change to the Drupal/recommended-project template.

To update Drupal, you first need to check whether your site uses Drupal/core-recommended or Drupal/core, as each has a different update command. You can find this out by running:
composer show drupal/core-recommended

Where you’re using Drupal/core-recommended, this will return relevant information. If this is the case, you can use the following command to update:
composer update drupal/core-recommended –with-dependencies

If you’re using Drupal/core instead, then you’ll see a message stating ‘Package Drupal/core-recommended not found’. The update command for Drupal/core is slightly different:
composer update drupal/core –with-dependencies

To finalise your Composer update, type your website’s URL followed by /update.php in a browser. This will update your Drupal database and complete the process. Make sure to check your site is still working and displaying correctly.

If you encounter any issues, it may be because there’s a dependency preventing Drupal core from updating. Alternatively, it could be due to poor settings or abandoned templates in Composer.

For further help and troubleshooting, read the instructions about updating with Composer on Drupal.org, or contact your Drupal agency.

We hope you enjoyed this blog about how to update Drupal. For more expert Drupal tips, read our ultimate Drupal optimisation guide which covers everything you need to know about optimising and maintaining your Drupal website.

Or, for on-demand Drupal support from an award-winning agency with more than two decades of experience, please get in touch.