Where and How to Host Your Drupal Website

Drupal is a powerful, flexible open source content management system (CMS) that allows organizations to create and manage multiple websites — thousands even — and to use headless, hybrid, or traditional architectures. While the possibilities are endless with Drupal, businesses still need to support their applications with the infrastructure, security, and maintenance that their customers expect. As with any CMS, this can often be time-consuming and costly, leaving companies with less time and money for innovation.   

That’s why organizations should consider a Drupal hosting platform that’s offered as a service. A fully managed Drupal hosting platform provides the scalability, security, and support enterprises need, allowing them to focus on creating new features for customers.

On-premise, IaaS, and PaaS hosting: Which is right for you?

There are quite a few options for Drupal hosting. Let’s look at the most common.

On-premise Drupal hosting

Drupal sites can be hosted in an on-premise data center or private cloud. In this approach, an organization will own everything: the servers, storage, networking, virtualization technology, configuration and management, monitoring, support — you get the picture. It’s a lot. Costs here will be a mix of capital and operational expenses because of necessary hardware purchases and ongoing maintenance. While on-premise hosting was a popular option in the early 2000s, most organizations are well on their way to the cloud. 

IaaS providers

The next option: infrastructure-as-a-service (IaaS) providers. Sometimes known as DIY hosting, great examples of IaaS providers are typical public cloud suspects like AWS (Amazon Web Services), Microsoft Azure, or GCP (Google Cloud Platform); others include Rackspace or DigitalOcean. 

With this approach, organizations don’t own any of the infrastructure. Instead, they purchase it as needed and pay for it on a yearly, monthly, weekly, or even by-the-minute basis depending on business needs. They’re responsible for securing, optimizing, and maintaining the infrastructure, a labor-intensive and time-consuming responsibility. And, while companies won’t need to maintain the physical servers, databases, storage, and file systems themselves, they still need to select the right ones for their applications and ensure that they’ll scale during traffic spikes — not to mention making sure the company doesn’t rack up unnecessary bills with runaway cloud costs.

PaaS providers

PaaS or platform as a service is another alternative. With this option, organizations own their application (in this case, Drupal) and data but none of the infrastructure. The technology their application needs to scale and perform is built-in and fully managed. PaaS are typically billed as part of a subscription (yearly, monthly, or otherwise) and are consumption-based, meaning organizations pay for what they need. Sometimes support for the platform and even the application is included. With a PaaS provider, businesses also often get access to optimizations for their application as well as additional tools and features that provide value for their projects.

SaaS providers

SaaS or software as a service rounds out the options. This hosting alternative uses the cloud to store organizations’ apps and related files to the provider’s server, so customers can access companies’ software through the Internet. Organizations avoid managing the infrastructure requirements of hosting the software in-house, and when it needs updating, the upgrades can be conducted in a cloud environment. 

While there are benefits to each of the models above, a Drupal hosting PaaS option definitely offers the most bang for the buck, especially if organizations hope to reduce maintenance, eliminate runaway costs, and accelerate their time to market with new Drupal applications.

Web hosting requirements for your Drupal site

Now let’s look at key factors to consider when weighing managed Drupal hosting providers.

Basic Drupal system requirements

This is a must. To run and host a Drupal site or application, a provider needs to fulfill the baseline requirements outlined by the Drupal Association here.

Speed and performance

We mentioned this earlier, but we can’t stress it enough. The speed at which a site or app responds to user queries has serious repercussions. Just a one-second delay in response time can cause a 7% decrease in conversions. In addition, almost 80% of shoppers unhappy with a site’s performance say they’re less likely to purchase from the same site again. Finally, as page-load time climbs from 1 second to 3 seconds, the likelihood that a site visitor will leave rises 32%, according to Think with Google  — and that’s just a few of the damning statistics tied to website load times.

While organizations might be able to offset slow load times via compression or optimization, the platform chosen can make or break a Drupal site’s speed. Businesses should look for certain core requirements when it comes to speed:

• CDN support with purging 
• Varnish caching
• Memcache
   

A provider with performance reporting capabilities is another bonus. For example, tools like stack metrics and New Relic APM included with a provider like Acquia Cloud Platform mean developers can monitor their infrastructure and optimize their websites and applications, which improves performance.

Uptime and availability

Similar to speed, a provider’s reliability is paramount. For organizations of all sizes, for every minute that their site is down, they lose an average of $4,500. That increases to $11,600 per minute for large enterprises.

Hosting platforms typically offer a service level agreement (SLA) for their platform, which means that they guarantee that the platform will support an organization’s application. The industry standard is typically 99.95% uptime, but some platforms even go as far as to offer 99.99% uptime. 

Organizations should also look for a provider who offers automated backup and recovery. Should their site fail, businesses need to know that their data has been backed up and that data recovery will be timely. In addition, the SLA should include the maximum amount of time a provider can take to restore a company’s systems before a penalty is levied.

Security

What kind of security does the hosting provider offer? Offerings such as multi-factor authentication (MFA), as well as layered firewalls that allow only trusted network traffic, are key. Check too if the provider uses a security event log to monitor system integrity and if file permissions are restricted by default — remember: most site attacks try to take control of the web service. By restricting permission, unauthorized changes to the site code and malicious file uploads won’t execute. Lastly, look for a provider who offers a comprehensive backup solution for disaster recovery.

Compliance 

The regulatory standards imposed on a site will depend on an organization’s business category and the type of data it collects on customers. Find a provider that complies with the regulations — PCI-DSS, HIPAA, FedRAMP, Privacy Shield, GDPR, SOC I and II, ISO 27001 — that pertain to your organization.

Developer platforms and workflows

Almost all websites are dynamic, so organizations need a provider that offers testing and development options. At least one testing and development environment should let your business make improvements and modifications apart from your production systems. Such environments make it easier, safer, and faster to deploy reliable code across all digital experiences.

Look, too, for added out-of-the-box development tools that allow developer teams to quickly build and deploy Drupal sites. APIs, command-line tools, and integrations will also help streamline workflows at every stage of development.

Customer support

A hosting provider’s customer support is a distinguishing feature that needs close attention. When there are issues with hosting, organizations need to be able to quickly access the right technical support. If yours has a distributed workforce or a global presence, look for a provider who can offer support in all time zones and in multiple languages.

More than that, seek a provider who values open communication and partnership. Technology moves at a rapid clip these days, and the right provider will listen to an organization’s needs and help develop a plan that ensures its site(s) operate with maximum efficiency and are set up to scale. 

Reputation

Peer reviews are the name of the game in today’s world. It’s easy enough to find customer reviews and analyst reports that detail customers’ experiences with the hosting providers you’re debating. See what reviewers with similar job titles as you or who are at similarly sized companies have to say.

Price

What organizations pay to run their site will affect its profitability because of factors we mentioned earlier — speed, reliability, and so on. Of course, no one wants to pay more than they  have to for such outcomes, but opting for the least expensive choice may end up costing more. That’s because, while the quoted price may seem low for options like on-premise and IaaS, the overall price will be much higher because organizations, not the hosting provider, are responsible for meeting security and compliance requirements and all that they entail. And, if an organization should somehow fail to meet the requirements, there could be a breach. 

So any savings will disappear if a site goes down often, support is iffy, data is lost — perhaps permanently — and the organization’s reputation takes a hit.

Where to go from here

As you mull over the considerations provided here, consider your organization’s priorities. For some, a highly performant site is more important than being able to host a test system; for others, compliance and network security trump price. Each organization is different.

To learn about a managed Drupal cloud hosting provider that has many, if not all, the attributes listed here, learn about Acquia Cloud Platform and schedule a demo.