List of service providers who keep Drupal sites up to date

You are viewing a wiki page. You are welcome to join the group and then edit it. Be bold!

Keeping a site up to date with new releases is one of the most important things for keeping a site secure. Let's document the current landscape of hosting and service providers and what services they offer to keep your site secure (in alphabetical order):

Company/Service Core? Contrib Time for upgrade Cost Requires site-owner involvement
Acquia: Remote Administration Yes Yes < 48 Hours Yearly contract only Yes (testing and approval)
Advomatic Yes Yes < 24hrs for critical otherwise < 1 week Yearly or monthly contract Depends on configuration
Booker, Paul Yes Yes < 24 hrs for critical support customers, otherwise < 3 working days Monthly cost £27.50. £25.00 for non-profits No
Code Drop / Full Service Yes Yes < 24hrs for critical otherwise < 48hrs n/a No
Code Enigma hosting Yes Yes (not base themes) < 24 hrs for critical, otherwise < 3 working days N/A Core, no - contrib, yes (acceptance)
Cruiskeen Consulting Yes Yes <24 hours for critical issues, 72 hours others $30/mo. negotiable Flexible arrangement - our hosting only
CMS Updater Yes No < 1 hour € 29.99 per year No
Daymuse Studios / Managed Hosting Yes Yes 24 Hours for Core SA Starts $720/year & Free 13th Month No
Drop Guard updater service Yes Yes 1 hour - 5 days €0 - €99 For setup, ongoing involvement depends on configuration
Ixis Support Yes Yes 4 - 48 hours Yearly contract only Yes (approval)
myDropNinja Yes Yes Same day From $79/mo No
OpenConcept Yes Yes < 24hrs for critical otherwise < 48hrs Yearly contract only No
Pantheon hosting Yes No < 24hrs for critical Free development sites; basic plan starts at USD$25/month. Yes


I switched this to a table

greggles's picture

I switched this to a table format to help us compare specific details more directly, I think the details are really important and hope that we'll add more and more beyond what are there now.

CodeDrop appear to be a

DamienMcKenna's picture

CodeDrop appear to be a consulting firm and don't list hosting on their services page (, so I think we should either limit this to "Hosting companies that can/will automatically apply security updates" or expand it to "Companies that will apply security updates if you're paying their consulting rates."

Some other questions:

  • Would a managed hosting plan count? For example, Cruisekeen Consulting from Wisconsin charge $29.95/mo for a VPS and then have an option of Drupal site maintenance for $50 per quarter, so would that count?
  • Would it be worth expanding the list to separate normal updates vs security updates?
  • What do you mean by "Time for upgrade"?

Yes, I think that would

greggles's picture
  • Yes, I think that would count.
  • Sure :) Please do :)
  • The amount of time that passes before an upgrade is live - basically if people offer an SLA or a standard, let's list it out (since "time to patch" is an important consideration to staying secure).

FWIW, I think it's useful to

greggles's picture

FWIW, I think it's useful to list both consulting/support companies (whether they are time and materials or fixed price) and hosting companies (again, whether it's part of the hosting cost or part of an additional service) who make this process easier.

Yeah, Code Drop are a Drupal

benjy's picture

Yeah, Code Drop are a Drupal agency. We provide fully managed hosting to all of our clients which include prompt security updates for all core and contrib.

The title of this post is "service providers who keep Drupal sites up to date" - I believe we fall into that category.


DamienMcKenna's picture

But do you offer hosting without being a consulting client?

I think it'd be worth either splitting up the list into two - one list for hosting companies, one for consulting companies - or add an extra column at indicate the type of company.

No, only for our own clients.

benjy's picture

No, only for our own clients. I didn't realise that this post was targeted specific to hosting companies.


DamienMcKenna's picture

I think the goal of the list needs to be clarified further, my questions were not to call out anyone but just to help identify the confusion.

Well it came about because of

benjy's picture

Well it came about because of an interview the Security Team were responding to where they plugged the big three hosting providers for providing security updates.
Then I mentioned that it would be nice to give a general mention to all the agencies that offer security/support to their clients. From there, greggles created this thread. Hopefully that gives the background to this thread.

Yes, it came about because of

greggles's picture

Yes, it came about because of that, but the goal is...whatever we want it to be :) I don't think we can or should make an exhaustive comparison, but we should try to capture the most important bits.

My broad goal is to have as many Drupal sites updated and secure as quickly as possible after a release. I hope this page can help find "help" (whether hosting, consulting, or support) that will let them achieve a fast upgrade.

Problem with a "type" column

greg.harvey's picture

Problem with a "type" column is we are both, as we tend to do hosting and support for development clients, but we also have a ton of clients who we have never built a site for and just host / support / update. Two lists would work, we'd just be in both lists!

Added Pantheon

brad.curnow's picture

Pantheon offer one-click upgrade to the latest version, and I think in extreme cases will actually go ahead and update or patch core on your behalf ASAP. Have enjoyed the service so far!

The where

greg.harvey's picture

Is it worth adding location to the table? Wouldn't want it to get too busy, but US companies might not want a support contract with a company in Europe, for example. Just a thought... :-)

Would it be easier to add

aschiwi's picture

Would it be easier to add updates as a service to marketplace listings? Like similar to I feel like the data in the table will not provide that much additional information, because I doubt that a lot of providers will add their hourly rate or say yes to core but no to contrib.

Using Marketplace

mgifford's picture

This does seem like something for the Marketplace in many ways. The hosting pages are just so generic (but this would make sense to list it here)

This table is only really going to be useful if clients start using it.

Drop Guard - Drupal update automation

manuelBS's picture

Thanks for mentioning Drop Guard in the initial list. Let me provide you with some additional information.

Currently Drop Guard is in our closed beta phase, but we are open to schedule hangouts for demonstration purpose of Drop Guard features to interested people personally. Please find some features listed below:

  • Ability to completely automate updates including automated deployment to any code branch environments (included core, distributions, contrib updates)
  • Patch support - Drop Guard is able to apply module related patches automatically during updates.
  • Granularity by update types. This feature provides users with a fine grained control over the deployment process depending on the update type and its criticality.
    For example, a client may want to deploy highly critical updates immediately to his live environment (security first), but just get notifications for all other updates and then start the update process for some of them from the Drop Guard UI manually.
  • Automated test support. This feature allows users to process Behat tests added to their repository. Before a site will be deployed, these tests will run. Additionally, a user can test every update manually - on a separate feature branch instance if the underlying hosting systems allows this.
  • Free of charge subscription package for the Drupal community
  • Long list of feature wished from our testers that will be implemented later by priority

We don't depend on any hosting platform which means that any project can be connected to Drop Guard regardless of its hosting platform. To make the onboarding easier, we will integrate with several Drupal hosting provider's APIs in the near future.
Feel free to ask any further question or request free demos of the current status.
You can either contact me personally or sign up for a demo at

Could new service providers

paulbooker's picture

Could new service providers add themselves to the bottom of the list?

I noticed that Ixis added themselves above Pantheon and me. I don't particularly mind, but I think this kind of thing will probably cause friction.

Best, Paul

Or maybe we should do

benjy's picture

Or maybe we should do alphabetical?

Agreed - alphabetical makes

greggles's picture

Agreed - alphabetical makes sense to me. It's the order that the marketplace listings are ordered. I moved Drop Guard into place alphabetically.

Added Daymuse

chrisrcooper's picture

I continued the alphabetical streak. I suppose that makes the most sense, though folks utilizing this as a resource probably aren't coming with a name in mind. Sort by rand? Heh. Either way, great resource for folks looking to find a Drupal host with focussed features.

Follow me:
Daymuse's Drupal-related Blog:

SEO improvements for this page.

paulbooker's picture


Can we make the following SEO improvements:

Best, Paul

There is already a drupal

Greg Boggs's picture

There is already a drupal support landing page that comes up number 1 for drupal support. Perhaps a good step would be to add this page to that one?

There's a Drupal services page that lists what appears to be a couple hundred companies that likely provide security updates here:

That sounds like a great

paulbooker's picture

That sounds like a great idea. Thanks Greg.

If we could make 'support'

paulbooker's picture

If we could make 'support' under Professional Services link to our drupal support page that should help to get our page found on search engines.

Best, Paul

Created the following issues

paulbooker's picture

Created the following issues on