Drupal site audit and evaluation
Get your Drupal website or platform reviewed by our team of experts
The output
The output of this service is a concise, plain-English report that surfaces issues and sets out actionable recommendations across (not limited to):
- Performance, reliability and security
- Code quality, custom modules and theming (including accessibility)
- Architecture review: Drupal application and server configuration
- Compatibility and best practice across all supported Drupal versions
- Delivered by an Acquia Triple-Certified Drupal expert
- A prioritised roadmap of recommendations, scored by impact, effort and risk
What areas does a Drupal site audit and evaluation cover?
Every Drupal site is unique, so every audit is too. After scoping the effort to match your site’s size and complexity, we align on your audit objectives and concentrate the analysis where our efforts will deliver the greatest level of impact and return on investment for your organisation.
Areas we typically assess include:
- Performance & scalability: Core Web Vitals, caching (Drupal, reverse proxy, CDN), image optimisation, render blocking, database/query efficiency, and load behaviour.
- Security: patch status, module risk, configuration hardening, headers, input sanitisation, file handling, secrets management, and third-party exposure.
- Custom modules: architecture, API usage, deprecated code, test coverage, stability, and upgrade paths.
- Theme & Front-end (incl. Accessibility): Twig practices, component structure, CSS/JS delivery, ARIA usage, colour contrast, keyboard support, semantics, and UX performance.
- Drupal configuration: content types, fields, views, workflows, caching, cron, search, and configuration management hygiene.
- Code quality & standards: adherence to Drupal coding standards, static analysis findings, complexity, duplication, and CI quality gates.
- Server & hosting: PHP/DB versions, opcache, web server tuning, TLS, backups, logging, and environment parity.
- Architecture: integration patterns, decoupling strategy, scalability, observability, and resilience.
- Users & permissions: roles, least-privilege access, editorial workflows, and audit logging.
- Technical on-site SEO: metadata, structured data, redirects, canonicalisation, sitemaps, and performance signals affecting crawlability.
This approach is grounded in validating your site against industry and Drupal best-practice standards, turning findings into clear, prioritised recommendations you can act on.
Examples of tools that we use to carry out the audit
Performing a Drupal site audit is a much more efficient process these days than it was in the past. Many of the checks that previously had to be carried out manually have now been scripted and automated.
There are four important Drupal modules that we generally call upon during an audit that collectively save a lot of manual leg work, and enable our experts to spend more time deep diving into the complex areas:
Site Audit
Site Audit is a Drupal analysis tool (Drush) that produces comprehensive best-practice reports on performance, security, caching, cron, content, database, and extensions, with clear pass/fail checks and actionable recommendations to improve site health.
Security Review
Security Review is a Drupal module that scans common security misconfigurations and vulnerabilities, permissions, input filters, file uploads, and database errors. It reports actionable fixes, helping harden sites and enforce Drupal security best practices.
Hacked!
Hacked! scans your Drupal installation to detect core and contributed modules/themes that have been modified from their released versions, highlighting the differences so you can restore clean code and maintain upgrade integrity.
Coder
Coder is a Drupal developer tool that checks custom code against Drupal coding standards and best practices, flags deprecated APIs and potential bugs. This module gives a good indication of the underlying code quality on the site.
Further tools
In addition to Drupal-based modules, we use a range of external tools that reveal how your site is built, benchmark quality, and surface issues before they reach production:
- SonarQube: static code analysis with Drupal-focused rulesets, highlighting code smells, vulnerabilities and coverage trends
- Nessus & OWASP Zed Attack Proxy: penetration testing tools validate security posture, common OWASP risks and more
- Google Lighthouse: high-level audits across performance, accessibility, SEO and best practices, with clear scoring and fixes
- New Relic: monitoring to highlight slow transactions, expensive database calls and troublesome integrations
- Sentry: real-time error tracking with rich stack traces and
- axe/Pa11y: automated accessibility checks that detect common accessibility problems and suggest remediation
Together, these complement our Drupal audits across security, performance, code quality and accessibility.
Who will complete the audit?
We bring together a senior, cross-disciplinary team to ensure depth, breadth and balance across front-end code, back-end code, and infrastructure:
- Senior Drupal Developer (Acquia Triple-Certified): deep review of configuration, architecture, security posture, code quality and custom modules, including deprecated API usage and upgrade paths.
- Senior Drupal Themer / Front-end Developer (Acquia Front-end Specialist): assessment of the theming layer, component implementation, UI performance and accessibility conformance.
- Senior System Administrator: analysis of hosting estate, server configuration, caching layers, performance tuning and security hardening.
- Technical Architect (10+ years’ Drupal experience): validates overall solution design, risk, scalability and maintainability; shapes the prioritised remediation roadmap.
All findings are consolidated and peer-reviewed by the Technical Architect and/or the Zoocha Technical Director, ensuring recommendations are feasible, sequenced by impact/effort/risk, and presented in a clear, secure final report for your team.
The process
Zoocha to sign any required NDA, data confidentiality or information security agreement in order to legally protect your assets
Zoocha will request a full backup of your site and provide a suitable, highly secure location for you to provide your site to us. Zoocha will guide on Data Sanitisation as required.
Zoocha will set up the site on a private, secure internal server, isolated from the outside world, where there is no chance of automated emails being triggered, or real-world interactions
Zoocha review all the high-level technical aspects of the site, so that it is understood where best to focus efforts to give the most value, looking at the scale of impact and task complexity
Zoocha will agree on priorities and objectives for the audit with the client
Zoocha specialists will then dig into, highlight any problem areas and offer recommendations, solutions, and/or mitigations for each issue or opportunity identified
We will then score every finding on impact, effort and risk to generate a prioritised, actionable backlog
The Zoocha Technical Director and/or Technical Architect will then review the audit before passing it on to the client and presenting the findings and recommendations back