Top 20 Drupal Development Companies in USA (2026): Drupal 10’s Deadline, Real Specialists and What You Own

Which Drupal version will your site be running on 10 December 2026?

Ask it first of any firm on this Top 20 Drupal Development Companies in USA list, because Drupal 10 reaches end of life on 9 December 2026, the same week Drupal 12 is due (Drupal core release schedule). In the week of 6 September 2026, 204,062 sites reporting to Drupal.org still ran Drupal 10, and 171,885 still ran Drupal 7, which lost security support in January 2025 (Drupal.org usage statistics). Add the Drupal 6, 8 and 9 sites, and 73 percent of reporting sites will be on a version with no security support once Drupal 10 goes.

The vendors do not all answer the question the same way.

Two of the twenty put Drupal at 100 percent of their published CMS work while their largest service lines are mobile apps or broad outsourced engineering, and seventeen also build on WordPress (Brain Station 23 analysis of Clutch profiles, read 15 September 2026). This guide shows which is which, prices the upgrade, and covers what you must hold in your own name before the final invoice.

Key takeaways

• 9 December 2026 is Drupal 10’s end of life, the same week Drupal 12 is scheduled for release (Drupal core release schedule).
• 171,885 sites still reported running Drupal 7 in September 2026, twenty months after its end of life (Drupal.org usage statistics).
• 73% of sites reporting to Drupal.org will run an unsupported major version after 9 December 2026 unless they upgrade (Drupal.org usage statistics).
• 12 Drupal core security advisories were published between April and July 2026, already more than the 8 in all of 2025, including one rated highly critical (Drupal security advisories).
• 26 April 2027 is the WCAG 2.1 AA compliance date for US state and local governments serving 50,000 people or more (ADA.gov).
• 60% is the median Drupal share of the twenty firms’ CMS work, and 17 of the 20 also list WordPress (Brain Station 23 analysis of Clutch profiles).
• $25,000 is the median minimum project across the twenty, and 14 publish $100 an hour or more (Clutch profiles).
• 41.2 detected accessibility errors per Drupal home page, against 52.8 on WordPress and 56.1 across all home pages (WebAIM Million 2026).

Drupal in 2026: a small share, a hard calendar

Drupal is a specialist platform. W3Techs finds it on 0.9 percent of websites whose content management system it can identify (W3Techs). Its weight sits in organisations that run large, structured, permission-heavy sites, which is visible in the firms below: seventeen of the twenty list education, nonprofit or government clients.

The calendar is what changes the brief. Drupal 7 reached end of life on 5 January 2025. Security support for Drupal 11.2 and 10.5 ended when Drupal 11.4 shipped in the week of 29 June 2026. Drupal 10 reaches end of life on 9 December 2026, and support for 11.3 and 10.6 ends that same week (Drupal core release schedule). PHP 8.2 loses security support on 31 December 2026 (PHP).

Many sites are already behind. Of the 649,424 sites that reported their Drupal core version to Drupal.org in the week of 6 September 2026, 171,885 ran Drupal 7, 91,895 ran Drupal 8 or 9, 204,062 ran Drupal 10 and 174,796 ran Drupal 11 (Drupal.org usage statistics). These are sites with the Update Status module reporting in, so the real number of Drupal sites is higher, but the proportions are the useful part.

Drupal 7 owners who cannot migrate in time have a paid option. The Drupal Association runs an Extended Security Support Provider Program, with HeroDevs and Tag1 Consulting as its certified vendors, and warns that an unsupported Drupal 7 site can fall out of compliance with FedRAMP, PCI, HIPAA and SOC 2 (Drupal 7 End of Life). Extended support is a bridge, not a destination.

Accessibility adds a second deadline for public bodies. The Department of Justice’s ADA Title II rule sets WCAG 2.1 AA as the standard for state and local government web content. An interim final rule published on 20 April 2026 moved the compliance date to 26 April 2027 for entities serving 50,000 people or more, and to 26 April 2028 for smaller ones and special districts (ADA.gov). For many Drupal sites, the version upgrade and the accessibility audit are now the same project.

So brief a Drupal vendor with four facts: the Drupal and PHP versions in production, the number of custom and contributed modules, the content types and migrations involved, and whether an accessibility standard applies to you.

What Drupal development costs in the US

Salary figures for Drupal work spread by about $40,000.

PayScale reports an average of $87,738 for a Drupal developer, but from 41 salary profiles last updated on 22 October 2025 (PayScale). The Bureau of Labor Statistics puts the median for all web developers at $92,650 in May 2025 (BLS). ZipRecruiter reports $111,938 for a Drupal developer as of 15 September 2026 (ZipRecruiter). Glassdoor reports $117,016 in average total pay from 274 salaries (Glassdoor). ZipRecruiter’s figure for a Drupal architect is $127,650 (ZipRecruiter, Drupal Architect).

The $39,912 spread has plain causes. PayScale’s figure rests on 41 profiles and is almost a year old. Glassdoor’s includes bonuses. And a Drupal architect who designs content models and migration plans is paid differently from a developer who builds themes.

Agency pricing reflects that seniority. The median minimum project across the twenty firms is $25,000, fourteen publish $100 an hour or more, and nine publish $150 to $199 (Clutch profiles, read 15 September 2026). Eleven report a most common project size of $50,000 or more.

Minimums run from $5,000 at Facet Interactive to $250,000 at Rightpoint. Eight factors decide where a quote lands inside that range.

The content model comes first, because content types, fields and taxonomies shape every template and migration. Migration from Drupal 7 or another CMS is usually the largest single line. Custom modules matter because each one is code nobody else maintains. A design system or theme rebuild follows, then integrations with CRM, single sign-on and search. Accessibility to a named WCAG level, multisite and multilingual setups, and hosting with security monitoring complete the list. Ask every vendor to price these lines separately.

The Top 20 Drupal Development Companies in USA, compared

We used Clutch’s directory of Drupal developers in the United States, sorted by Clutch Rank and read on 15 September 2026. It lists 1,097 firms. The first two rows, Vardot and Pare & Co, were paid placements, and we removed them. Pare & Co also appears in the organic ranking, so it keeps that organic position. Firms 2 to 21 below are the next 20 in Clutch Rank order.

Brain Station 23 is placed first because we publish this article. We are US-headquartered, but Drupal does not appear in our published Clutch focus, so Clutch’s ranking did not place us in its top 20 and we are not claiming it did.

Every overall rating below sits between 4.7 and 5.0, so the stars do not separate these firms. The Drupal Focus column does: it shows Drupal as a share of each firm’s published CMS work, with that firm’s largest service line for context.

#	Company	Best For	Team Size	Drupal Focus	Key Tech Stack	Industries Served	Locations
1	Brain Station 23 — brainstation-23.com	Adding cost-controlled PHP engineers to an in-house Drupal team	250 – 999	Drupal not in published focus; staff augmentation 60% of services	PHP, Laravel, Java, .NET, Python	Retail, medical, telecoms, education, financial services	Springfield VA; Bangladesh, UAE, England, Malaysia, Germany
2	BairesDev — bairesdev.com	Large nearshore teams across many stacks	1,000 – 9,999	Drupal 100% of CMS; web development 15% of services	Drupal, .NET, React Native, Angular, PHP, Java	IT, financial services, medical, advertising	San Francisco; Buenos Aires, Sao Paulo, Mexico City, Bogota, Barcelona
3	Dedicated Developers — dedicateddevelopers.com	Healthcare and hospitality apps with a Drupal back end	10 – 49	Drupal 100% of CMS; mobile 65% of services	Drupal, React Native, .NET, Angular, PHP, Swift	Medical, hospitality, e-commerce, education	Atlanta, New York, Boston
4	Urban Insight — urbaninsight.com	Arts, nonprofit and public-sector Drupal sites	10 – 49	Drupal 78%; web development 50%	Drupal, WordPress, React, PHP	Arts, nonprofit, business services, education, government	Los Angeles
5	Suffescom Solutions — suffescom.com	Fintech and healthcare apps on a lower hourly budget	250 – 999	Drupal 15% (joint largest of 12 CMSs); mobile and web 40% each	Drupal, WordPress, Adobe Experience Manager, Next.js, Node.js	Financial services, medical, real estate, e-commerce	New York, Wilmington DE; Mohali, Dubai, London, Sydney
6	Five Jars — fivejars.com	Nonprofit and education sites across Drupal and Sitecore	10 – 49	Drupal 50%; web development 50%	Drupal, Sitecore, WordPress, Sanity, Laravel, Next.js	Nonprofit, education, arts, medical, legal	Brooklyn, Arlington VA; Warsaw
7	Rightpoint — rightpoint.com	Enterprise digital products with large budgets	250 – 999	Drupal 33% (behind Squarespace 34%); mobile 45%	Squarespace, Drupal, WordPress, Swift, Java	Consumer products, financial services, medical, automotive	Chicago, Boston, Plano, Atlanta
8	Unleashed Technologies — unleashed-technologies.com	Mid-market Drupal sites with legacy systems	10 – 49	Drupal 83%; web development 50%	Drupal, WordPress, custom development, e-commerce	Manufacturing, medical, education, financial services, nonprofit	Ellicott City MD
9	Promet Source — prometsource.com	Government and education Drupal sites with support	50 – 249	Drupal 75%; web development 40%	Drupal, WordPress, UX, application support	Government, education, utilities, IT, medical	Chicago
10	FocusReactive — focusreactive.com	Headless builds with Drupal as one of several CMSs	10 – 49	Drupal 25% (behind Sanity 50%); web development 50%	Sanity, Drupal, WordPress, Next.js, React	Advertising, business services, education, financial services	London, Warsaw; New York
11	Facet Interactive — facetinteractive.com	Drupal sites connected to HubSpot or Salesforce, with AI work	10 – 49	Drupal 80%; ten service lines at 10% each	Drupal, WordPress, HubSpot, Salesforce, PHP, Python	Automotive, education, financial services, media, nonprofit	El Segundo CA
12	Sandstorm Design — sandstormdesign.com	Large UX-led Drupal programmes for mid-market organisations	10 – 49	Drupal 62%; UX and web development 40% each	Drupal, WordPress, .NET	Consumer products, education, financial services, medical, nonprofit	Chicago
13	DesignHammer — designhammer.com	Nonprofit and education sites across Drupal and WordPress	10 – 49	Drupal 56%; web development 50%	Drupal, WordPress, Ektron, Laravel, Symfony	Nonprofit, education, IT, energy, government	Durham, Hillsborough NC
14	August Ash — augustash.com	Manufacturers wanting a Drupal site plus SEO and paid search	10 – 49	Drupal 60%; web development 30%	Drupal, WordPress, PHP, e-commerce, SEO	Manufacturing, business services, e-commerce, education	Bloomington MN
15	Third and Grove — thirdandgrove.com	Mid-market Drupal and commerce builds	50 – 249	Drupal 88%; web development 50%	Drupal, WordPress, Symfony, Laravel, PHP	Consumer products, financial services, e-commerce, business services	Boston
16	Perpetual — perpetualny.com	UX-led products where WordPress leads and Drupal supports	50 – 249	Drupal 33% (behind WordPress 67%); UX 30%	WordPress, Drupal, Node.js, React, low-code	IT, advertising, financial services, media, medical	New York
17	Off-Site Services — oss-usa.com	Small-team Drupal development and support on a modest rate	10 – 49	Drupal 60%; web development 70%	Drupal, WordPress, Joomla, Angular, React, Symfony	Advertising, financial services, manufacturing, nonprofit	New York
18	Nika Agency — nika.agency	Tech and B2B brands wanting design-led Drupal or WordPress	10 – 49	Drupal and WordPress 50% each; design and development 30% each	Drupal, WordPress, UX, branding	IT, business services, manufacturing	San Jose CA
19	Pare & Co — pare.co	Education and healthcare organisations wanting strategy-led Drupal	10 – 49	Drupal 67%; web development 30%	Drupal, WordPress, React, PHP, JavaScript	Education, medical, financial services, government, nonprofit	Providence RI
20	Savas Labs — savaslabs.com	Healthcare and education Drupal work with product design	10 – 49	Drupal 60%; web development 20%	Drupal, WordPress, React, React Native, PHP	Medical, education, nonprofit, financial services, media	New York, San Francisco
21	INOXOFT — inoxoft.com	Fintech and education software where Drupal is a minor part	50 – 249	Drupal 10% (one of ten CMSs); custom software and web 40% each	Node.js, React, Flutter, Python, Drupal, Sitecore	Financial services, education, real estate, automotive	Newark DE; Wroclaw, Lviv

Team sizes, service splits, CMS splits, industries and locations are from each firm’s published Clutch profile, read 15 September 2026. “Best For” is our reading of that data. Engagement models and certifications are not published consistently across these profiles, so we have left them out rather than guess.

Profiles are grouped by the kind of buyer each firm suits, and the numbers match the table. Each caution comes from the Review Highlights that Clutch publishes from the firm’s verified reviews. Certifications are self-published and unverified by us. None of these Clutch profiles list Drupal Association certified partner status, so check the Drupal.org marketplace and ask directly.

1. Brain Station 23

We publish this article and placed ourselves first, so read this entry as the publisher’s pick. Drupal does not appear in our published Clutch focus, where PHP is 12 percent of our languages, so we are not a Drupal specialist in the way most firms below are. Most of our work, 60 percent, is engineers embedded in client teams, at a $25 to $49 band that only two firms below match. Where we help with the risks in this guide is process: ISO 27001 and SOC 2 Type II controls over access, change and patching. Our 21 reviews score Quality at 5.0 and Cost at 4.9, and reviewers have asked for tighter internal coordination. If you want an agency to plan and own a Drupal 10 to 11 upgrade from audit to launch, choose from the firms below.

For Drupal-first agencies

4. Urban Insight

Drupal is 78 percent of Urban Insight’s CMS work and PHP 70 percent of its languages. Arts and nonprofits make up half its industries, and government is on the list. Its 37 reviews rate it 5.0, and Clutch’s summary puts projects at $28,000 to $275,000, with a $50,000 minimum. Reviewers credit communication and technical skill. A few said more design hours would have helped the final product, so fix the design allowance before signing.

8. Unleashed Technologies

Drupal is 83 percent of Unleashed Technologies’ CMS work, and reviewers point to its handling of legacy systems. Mid-market companies are 65 percent of its clients. Its 39 reviews rate it 4.9, but Schedule is 4.5, joint lowest sub-score on this list. Clutch’s summary cites projects from $3,000 to over $200,000. Some clients experienced setbacks during project management transitions, which senior staff then resolved. Name the project lead in the contract.

9. Promet Source

Promet Source has the largest government share on this list, at 30 percent of its industries, and Drupal is 75 percent of its CMS work. Application support is 20 percent of its services. Its 13 reviews give it 4.7, the lowest overall rating here, with Cost at 4.5. Clutch’s summary cites projects of $46,000 to $400,000, and some clients suggested clearer flat-rate pricing. One client noted time-zone friction with an overseas developer.

11. Facet Interactive

Facet Interactive spreads its services across ten lines at 10 percent each, including three AI lines and CRM consulting split evenly between HubSpot and Salesforce, while Drupal is 80 percent of its CMS work. Its $5,000 minimum is the lowest here. Its 25 reviews rate it 4.9, and Clutch’s summary cites projects from $6,000 to nearly $1 million. Some clients felt project management overhead was excessive for the budget. Agree the management ratio up front.

15. Third and Grove

Third and Grove has the highest Drupal share on this list among web-led agencies, at 88 percent of its CMS work, and PHP is 75 percent of its languages. Mid-market companies are 90 percent of its clients. Clutch’s summary cites projects from $50,000 to over $1 million and credits it with making sites easier to manage. Its eight reviews rate it 4.9, and Clutch lists no improvement area, but eight reviews say little about patterns.

19. Pare & Co

Drupal is 67 percent of Pare & Co’s CMS work, and education and medical clients are 30 percent of its industries each. Enterprise and mid-market clients split evenly. It also bought a sponsored placement on this directory, which we removed; the entry here is its organic rank. Its 18 reviews rate it 5.0, with Cost lowest at 4.6. Some clients said more back-end resources would help, because a small team can be stretched on complex projects.

For two-CMS teams

6. Five Jars

Drupal is half of Five Jars’ CMS work, with Sitecore and WordPress at 20 percent each. Nonprofit and education clients make up 55 percent of its industries. Its 32 reviews score 4.9 on every sub-score, and Clutch’s summary cites projects from $5,000 to over $1 million. Reviewers credit project management and responsiveness. Some noted occasional delays in communication or fixes because of time-zone differences. Agree a response time for urgent issues.

12. Sandstorm Design

Sandstorm Design is the oldest firm here, and its most common reviewed project is $200,000 to $999,999, the largest band on this list. Its $100,000 minimum is the second highest, and Clutch’s summary cites projects of $120,000 to $700,000. Drupal is 62 percent of its CMS work. Its 12 reviews rate it 4.8, with Cost at 4.5. Some reviews note delays on complex projects from stakeholder approvals and changing requirements.

13. DesignHammer

Drupal is 56 percent of DesignHammer’s CMS work, with WordPress at 33 and Ektron at 11. Nonprofit is its largest industry at 20 percent, and government is on its list. Its 16 reviews rate it 4.9, with Quality at 5.0, and Clutch’s summary cites projects from $10,000 to over $200,000. Reviewers credit project management and trust. A few said email replies could be slower at times, so agree a channel and response time.

14. August Ash

August Ash spreads its services across marketing and development: web development is 30 percent, and seven other lines, including SEO and pay per click, are 10 percent each. Drupal is 60 percent of its CMS work, and manufacturing is its largest industry. Its 23 reviews rate it 4.8, and Clutch’s summary notes some clients met unexpected costs. Some also found Basecamp clunky for day-to-day communication.

17. Off-Site Services

Web development is 70 percent of Off-Site Services’ work, the highest share here, and Drupal 60 percent of its CMS work. Clutch’s summary describes teams of two to five people. All 50 reviews score 5.0 on every sub-score, which leaves little to compare, and its $50 to $99 band is below most firms here. Some clients had early trouble understanding scope and technical details, which settled as projects progressed.

18. Nika Agency

Nika Agency splits its CMS work evenly between Drupal and WordPress, and design, UX and branding make up 70 percent of its services. IT is half its industries. Its 47 reviews rate it 5.0, and Clutch’s summary cites $1,250 a month for ongoing support up to $150,000 projects. Reviewers credit meeting tight deadlines. Some wanted a clearer division of labour and more proactive project momentum.

20. Savas Labs

Drupal is 60 percent of Savas Labs’ CMS work, and medical and education clients make up 55 percent of its industries. Its services are spread across seven lines, including product design and digital strategy. Its 34 reviews rate it 5.0, and Clutch’s summary cites projects from $20,000 to over $1 million. Some clients noted delays when project team members changed. Put a named-team clause in the contract.

For scale, mobile and staff augmentation

2. BairesDev

Drupal is the only CMS in BairesDev’s published focus, but web development is 15 percent of a ten-line services split, so Drupal is a small part of its business. Enterprises are half its clients. Its 63 reviews rate it 4.9, with Cost lowest at 4.6, and Clutch’s summary cites projects from $10,000 to over $5 million. Reviewers value time-zone alignment. A few noted minor language barriers. Interview engineers individually.

3. Dedicated Developers

Dedicated Developers lists Drupal as its only CMS, but mobile apps are 65 percent of its services, and medical clients are 40 percent of its industries. Small businesses are 60 percent of its clients. Its 56 reviews rate it 5.0, and its most common reviewed project is under $50,000. Reviewers credit how it guides clients new to app development. Some wanted more detailed progress documentation during the build.

5. Suffescom Solutions

Suffescom Solutions lists twelve CMSs, with Drupal, WordPress and Adobe Experience Manager tied at 15 percent. It has the most reviews on this list, 121, and every sub-score is 4.9. Financial services and medical are 35 percent of its industries each, and its $25 to $49 band is joint lowest here. Some clients noted a lack of creative input, so bring your own product and design direction.

7. Rightpoint

Rightpoint’s $250,000 minimum is the highest on this list, and enterprises are 60 percent of its clients. Mobile apps are its largest service at 45 percent, and Drupal is 33 percent of its CMS work, just behind Squarespace. Its 20 reviews rate it 4.9, with Cost lowest at 4.6, and Clutch’s summary cites projects of $50,000 to $500,000. A few clients said initial scoping underestimated complexity, which caused temporary disruption.

21. INOXOFT

INOXOFT lists ten CMSs at 10 percent each, Drupal among them, and its frameworks are Node.js, React and Flutter. Financial services is 40 percent of its industries. Its 74 reviews rate it 5.0, and Clutch’s summary cites projects from $2,300 to over $2 million, with a $25 to $49 band. Reviewers credit project management and adaptability. Some wanted more design variations early on. Treat it as a software firm first.

For headless and UX-led builds

10. FocusReactive

FocusReactive is the youngest firm here, and Sanity is half its CMS work, with Drupal and WordPress at 25 percent each. Next.js is 70 percent of its frameworks. Small businesses are 80 percent of its clients, and it lists London first among its offices. Its 26 reviews rate it 4.9 and describe faster sites and SEO gains. Some clients wanted more proactive suggestions for improvements.

16. Perpetual

WordPress is 67 percent of Perpetual’s CMS work and Drupal 33, and UX and UI design is its largest service at 30 percent. Its 97 reviews are the second most here and rate it 4.9, with Cost at 4.6. Clutch’s summary cites projects from $2,500 to $500,000, and clients split evenly by size. Some wanted more proactive test-case definition and a clearer split between project and product management.

What the twenty profiles show

We tallied the published data behind every profile. The result is not a ranking. It is a baseline for this Top 20 Drupal Development Companies in USA list, so a proposal far outside it stands out.

Drupal share hides how much CMS work a firm does. Drupal’s share of each firm’s CMS split runs from 10 to 100 percent, with a median of 60 percent. It is the largest CMS for fourteen firms. But the two firms at 100 percent, BairesDev and Dedicated Developers, are a 1,000-plus-person outsourcing firm and a mobile-first studio (Brain Station 23 analysis of Clutch profiles, read 15 September 2026).

Most are two-CMS shops. Seventeen of the twenty also list WordPress. That can be useful when you are still choosing, and it is a reason to ask any firm why it recommends Drupal for your site.

The sectors are public-interest. Sixteen list education clients, eleven nonprofit, four government, and seventeen list at least one of the three. Thirteen list medical clients.

Prices sit at senior levels. Minimums run from $5,000 to $250,000, with a median of $25,000. Fourteen firms publish $100 an hour or more, and eleven report a most common project of $50,000 or more.

Cost is the weakest score. The twenty carry 811 reviews, with a median of 33, and four firms hold 44 percent of them. Three firms score identically on all four sub-scores. Of the other seventeen, Cost is the lowest or joint-lowest for fourteen and Schedule for six.

The cautions are about people and handovers. Clutch’s review summaries flag project management or team changes for five firms and communication, time zones or tools for five. Scoping or timelines and design come up for three each, and documentation, proactivity and back-end capacity once each. Third and Grove has no improvement area listed.

Most are small and US-based. Seventeen firms have fewer than 250 staff and thirteen have 10 to 49. Five list offices outside the US.

How to shortlist a Drupal development company

Order the filters so the first one removes the most firms.

Step 1: Name your version. A Drupal 7 migration, a Drupal 10 to 11 upgrade and a new Drupal 11 build are different jobs, and firms quote them differently.

Step 2: Check the Drupal share and the largest service line. A high Drupal share at a mobile-first firm means something different from the same share at a web agency.

Step 3: Match your budget to the minimum. Minimums run from $5,000 to $250,000, so this step removes much of the list.

Step 4: Ask for a dated upgrade plan. A serious vendor puts your move off Drupal 10 or 7 on a calendar, with the module audit first.

Step 5: Ask about the patch window. Drupal core security windows fall on the third Wednesday of each month (Drupal core release schedule). Ask how fast updates reach production.

Step 6: Check accessibility evidence. Ask for a recent WCAG 2.1 AA audit the firm delivered, especially if the ADA Title II rule applies to you.

Step 7: Buy a site audit. A fixed-fee review of modules, custom code, PHP version and hosting shows how the firm works before you commit.

How to buy Drupal development: four engagement models

The engagement model decides who pays when a content migration finds ten years of edge cases.

Fixed price moves overrun risk to the vendor, who prices it in. It suits an upgrade that follows a completed audit, or a new build with a settled content model. It fails when migration data is still unknown.

Time and materials keeps the risk with you. It suits Drupal 7 migrations and complex integrations. Cap each phase and review burn every week.

Support retainer covers security updates, minor-version upgrades and a monthly block of changes. It is the line many Drupal sites skip, and the 204,062 sites still on Drupal 10 show how easily upgrades slip.

Staff augmentation adds Drupal developers to your team. BairesDev, Facet Interactive, Off-Site Services and Brain Station 23 publish staff augmentation lines. It fails when nobody in-house owns the module list.

The technical question: getting off Drupal 7 and Drupal 10

Most Drupal work is on sites that already exist. The order of the steps decides whether the move is an upgrade or a rebuild.

The steps, in the order that keeps them safest:

Step 1: Record versions and dates. Note the Drupal core minor, PHP version and database in production, and when each loses support (Drupal core release schedule; PHP).

Step 2: Audit modules. List every contributed and custom module, whether it has a release for the target version, and whether it is covered by the security advisory policy.

Step 3: Decide upgrade or migration. Drupal 10 to 11 is an in-place upgrade once deprecated code is fixed. Drupal 7 to 11 is a migration: content, users and files are moved into a new site.

Step 4: Fix deprecations on the current version. Clear deprecated API use in custom code and themes before changing the major version.

Step 5: Upgrade PHP. Move to PHP 8.3 or newer, which has security support to the end of 2027 or later (PHP).

Step 6: Test on staging with real content. Check editorial workflows, permissions, forms, search and integrations, and run an accessibility scan before launch.

Step 7: Plan the next major. Drupal 12 is due the week of 7 December 2026; put the Drupal 11 to 12 move on the calendar now.

Red flags: eight answers to walk away from

Some answers in a sales call should end it, or at least move a firm down the list.

“Drupal 10 will be fine for years.” It reaches end of life on 9 December 2026.

“We apply security updates quarterly.” Drupal core has a security window every month.

“Your Drupal 7 site still works.” It has had no security support since 5 January 2025.

“We’ll rebuild those modules from scratch.” Ask what already exists in contributed modules before paying for custom code.

“Hosting is on our account.” Hosting, backups and access belong under your company’s name.

“We’ll check accessibility at the end.” If WCAG 2.1 AA applies to you, it has to shape the components from the start.

“There’ll be a new team for the next phase.” Five firms here have review cautions about project management or team changes.

“WordPress would be easier.” It may be. Ask why, in writing, before you change platforms.

After launch: what the build quote leaves out

The list tells you who can build a Drupal site. This part covers what owners wish they had settled before the final invoice, and what recurs for as long as the site runs.

What you must own before the final invoice

The code repository with its full history, including custom modules, themes and configuration exports, not a zip.

Hosting, database and backups, under your company’s billing, with the agency added as a user you can remove.

An administrator account that belongs to you, with the agency’s accounts on separate logins.

Domain, DNS, CDN and email sending, in your name.

Third-party accounts, such as search, CRM, forms, analytics and translation services, under your billing.

A module list and a runbook, covering every contributed and custom module, deployment steps, cron jobs and how to restore from backup.

The bill that arrives after launch

The build quote covers the site. The rest recurs.

The recurring lines are hosting and CDN, core and contributed security updates, minor and major upgrades at each support window, PHP and server upgrades, accessibility testing for new components, extended support contracts if a Drupal 7 site stays up, and change requests. Get the retainer price in writing before signing the build, and compare vendors on three years of cost.

Security is a recurring cost

Drupal’s core security workload rose this year. Drupal.org published 12 core security advisories between April and July 2026, against 8 in all of 2025. They included a highly critical SQL injection fix on 20 May and critical fixes for cross-site scripting and PHP object injection (Drupal security advisories).

Those counts cover core only; contributed modules carry their own advisories. A site on Drupal 7 or 9 receives none of these fixes. The average US data breach cost a record USD 11.5 million in IBM’s 2026 report (IBM Cost of a Data Breach Report 2026). Ask vendors how many days a core security release takes to reach production, and who watches the contributed module advisories.

Accessibility is legal exposure

Drupal starts from a better baseline than most platforms. WebAIM found an average of 41.2 detected errors on Drupal home pages, against 52.8 on WordPress and 56.1 across all home pages (WebAIM Million 2026). A better average is not compliance.

For public bodies the standard is now written into federal regulation: WCAG 2.1 AA, with compliance dates of 26 April 2027 and 26 April 2028 depending on size (ADA.gov). Private organisations face lawsuits instead: more than 5,000 digital accessibility lawsuits had been filed by the end of 2025 (UsableNet). Name the WCAG level in the contract, and test forms, menus and documents with a keyboard and a screen reader.

Contract clauses that surface in month nine

These rarely come up in a sales call and often decide the relationship later. This is not legal advice; have your own counsel review any agreement.

IP assignment on payment, covering custom modules, themes, configuration and design files.

Account ownership, naming hosting, domain, CDN, third-party services and administrator access as yours.

Update terms, stating how many days a Drupal core or contributed security release takes to reach production.

Version responsibility, stating who tracks Drupal and PHP support dates and when they must warn you.

Accessibility standard, naming WCAG 2.1 AA or 2.2 AA and who pays to fix failures found after launch.

Named team and transition assistance, a fixed number of hours at an agreed rate if you move vendors.

Rate escalation caps, subcontracting disclosure, liability caps and insurance, and non-solicitation in both directions.

How to leave without losing the site

Confirm ownership of the repository, hosting and domain first. Export the configuration, module list and a full database backup, and record walkthroughs of custom modules, migrations and integrations while relations are cordial.

On the last day, remove the agency’s Drupal accounts and hosting access, rotate API keys and database passwords, and revoke deploy keys and SSH access.

Hire in-house or hire a Drupal development company

Start with the wage. ZipRecruiter puts a US Drupal developer at $111,938, and Glassdoor reports $117,016 in average total pay (ZipRecruiter, Glassdoor). A single hire at those figures costs more each year than the most common project size for nine of the twenty firms, before benefits.

Hire in-house when the site is central to operations, changes every week, and you can keep at least two people who know the modules and content model.

Hire a Drupal development company for a migration, a major-version upgrade, an accessibility remediation or a support retainer you cannot staff. Keep every account in your name so the choice stays reversible.

Combine the two when you have a site manager or developer but need specialist help with upgrades, security or accessibility.

FAQ

Conclusion

The data behind this Top 20 Drupal Development Companies in USA list says three things. The calendar is urgent: Drupal 10 ends on 9 December 2026, and 73 percent of reporting sites will be on an unsupported major version if they do not move. Drupal depth is uneven, and seventeen of the twenty firms also build on WordPress. And the work is priced as senior engineering, around a $25,000 median minimum.

Any of the twenty can build a Drupal site. What decides the next three years is the upkeep: which version and PHP release it runs, how fast each monthly security window reaches production, whether accessibility is built in rather than bolted on, and whether the repository, hosting and administrator accounts are in your name on the day you choose someone else.

Sources

• https://clutch.co/us/developers/drupal?sort_by=ClutchRank
• https://clutch.co/profile/brain-station-23
• https://www.drupal.org/about/core/policies/core-release-cycles/schedule
• https://www.drupal.org/project/usage/drupal
• https://www.drupal.org/security/core
• https://www.drupal.org/about/drupal-7/d7eol
• https://w3techs.com/technologies/details/cm-drupal
• https://www.ada.gov/resources/2024-03-08-web-rule/
• https://webaim.org/projects/million/
• https://www.php.net/supported-versions.php
• https://www.payscale.com/research/US/Job=Drupal_Developer/Salary
• https://www.bls.gov/ooh/computer-and-information-technology/web-developers.htm
• https://www.ziprecruiter.com/Salaries/Drupal-Developer-Salary
• https://www.ziprecruiter.com/Salaries/Drupal-Architect-Salary
• https://www.glassdoor.com/Salaries/drupal-developer-salary-SRCH_KO0,16.htm
• https://www.ibm.com/reports/data-breach
• https://blog.usablenet.com/ada-web-lawsuit-trends-2026