This document provides best practices for long-term support of a Drupal site, including training users and staff, documentation, auditing, monitoring, security reviews, and keeping the site and modules updated. It emphasizes the importance of documentation, communication, and ongoing education to ensure a solid foundation and prevent problems. Regular auditing, monitoring, and security reviews are also recommended to catch any issues.

1. BADCamp 2012
Supporting a Drupal Over the Longterm
Anne Stefanyk (@eskimoYogi) & Meghan Sweet (@meghsweet)
4 November, 2012

2. Site Launches!

3. Now What?

4. Empower Your Users

5. Drupal Web Team
• Learning Drupal Takes Time
• Early & Often Team Engagement
• Train the Trainer
• Backup Expert Level Support
• Effective Documentation

6. Content Manager Training
• Onsite Training Sessions
• Web Team Trainers
• FAQ / Forums
• Help Videos
• Training Materials

7. Documentation
Detailed logs in source code
Extensive commenting
Onscreen help
Training Videos
FAQ Capture

8. Recruiting
Succession Plans
Internships
Drupal Give
Stop Gap Solutions

9. Support Best Practices

10. Ideal Solid Foundation
• UX Strategy
• Documentation
• Early Client Engagement
• QA by Web Stakeholders
• Scalable Architecture

11. Communication
Ticketing Tool
Expectation Management
Expect Ongoing Education

12. QA Best Practices
• Development, Testing & Production
• Stakeholder Sign-off by Review
• Regular Release Cycle
• Batch work

13. Audits and Monitoring
Prevention is better than cure

14. Auditing
Periodic Auditing is important!
Make a check-list.

15. Auditing Code Base
- Hacked! module
- Custom Modules- what do they do?
- Contributed Modules- updates, errors?
- Drupal Core- update and/or upgrade?
- Comments in code
- Drupal Coding standards
- Red flags

16. Auditing Development Environment
- Version Control
- Development Server Setup: Dev > Test > Prod
-What is the development workflow?

17. Auditing Configuration
- Panels/Context/Display Suite, used properly?
- Live Updating? Feeds?
- Site Logs
- Permissions and Roles- PHP filter
- Spam Prevention
- Performance Optimization
-SEO Checklist Module

18. Auditing Theme
- Are themes up to date?
- Base Theme used? Or Hacked?
- Custom PHP logic in tpl files?
- Javascript Libraries
- CSS structure
- Responsive- What techniques?
- Red flags- are tpl files out of control?

19. Auditing Performance
- Front End-Performance
Caching, CSS/JS aggregation, Images
- Backend Performance
Slow custom code, out-of-date modules, caching
- Server performance
- Traffic Levels- anonymous or logged in.

20. Monitoring
- Most of the time in recovery is figuring out what’s broken
- Train your clients how to monitor and write good tickets

21. Monitoring
- Use Syslog to write Drupal logs to text file
- Cron and caching configured and on?
- Total Admin Control or create admin views
- Are your admins educated?
- Every time you have an issue- start to monitor.
-Google Analytics

22. Security Review
- Most security holes are created in the configuration and
theme.
- Security Review module will help!

23. Security Review
- File system permissions
- Input format
- Content (nodes, comments and fields in Drupal 7)
- Error reporting
- Private file
- Allowed upload extension
- Database error
- Failed logins
- Drupal admin permissions
- Username as password
- Password included in user emails
- PHP access

24. Training is key.
Users need Drupal
awareness!

25. Detecting Problems
- Spam-Mollom, Captcha, Admin Views
- Use Version Control to check diffs- revert
to good version
- Hacked! Module - switch to unhacked
contrib module
- Security Review Module will look for spam
in content.
- Use a good hosting company

26. Security & Module Updates
What to do with those error messages?

27. Updates
Keep on top of Updates- within 30 days
for security updates.
Read the update notes for non-security
updates.
Finding a bug in a contrib module.
Do Not Hack Core! No exceptions.
Planning for Custom Modules
Staying in tune with Advances in

28. Version Upgrades
Timing
Community Catch-up
New Modules
Consider a Rebuild?
Testing
What’s the plan?

29. Community Connection

30. Groups.Drupal.org
Internal Knowledge Sharing
Local User Group Meet-ups
Drupal Camps, Cons & Summits

31. Taking Over
Another’s Work

32. discovery
read the documentation
talk to all stakeholders
get clear line of sight to priorities
review the laundry list

33. Key Points
Continual Love & Attention
Keep Documentation Fresh
Use good communication and
feedback/QA tools
Foster Drupal Talent
Community Contribution

34. Thank You!
@chapter_three