Varbase Health Checklist: Best Practices We Follow

Varbase is Vardot's flagship enterprise Drupal distribution. With Varbase 11, it's also an enterprise layer built directly on Drupal CMS 2.0: the same official foundation the Drupal community maintains, extended with recipes, security defaults, and editorial workflows refined across hundreds of implementations.

Vardot's view: Most enterprise Drupal sites we audit don't fail because of any single missed update. They fail because small decisions (deferred patches, custom overrides in production, untested backups, undocumented workflows) compound quietly until a major upgrade exposes the debt all at once. A disciplined health-check cadence is the cheapest insurance against that outcome.

What Is a Varbase Health Check?

A Varbase health check is a structured review of an enterprise Drupal site running Vardot's Varbase distribution. It evaluates version currency, security posture, content governance, performance, and alignment with the current Varbase 11 and Drupal CMS 2.0 architecture. 

Vardot recommends a layered cadence: weekly (release notes, backup verification), monthly (staging updates, performance audits), quarterly (permissions, media cleanup), bi-annually (major upgrades, security advisories), and annually (architecture review). The practice prevents technical debt from blocking future Drupal upgrades, particularly ahead of Drupal 10 end of life on December 9, 2026.

What's New in Varbase

Varbase 11 is the first Varbase release built on Drupal CMS 2.0, rather than being shipped as a standalone profile-based distribution. Three shifts define the release:

Other release highlights

• Default editorial workflow (Draft → Needs Review → Published) with scheduling, contributed to Drupal CMS 2.0 by Vardot during the Starshot Initiative.
• Privacy recipe for cookie consent and regional compliance defaults.
• Auto-save forms to protect long-form content against accidental loss.
• Improved Dynamic Responsive Image Styles (Drimage Improved) for performance-optimized media delivery per breakpoint.
• 2-to-3-week release cadence with clear upgrade paths between versions.

Vardot's view: Varbase 11 is not a replacement for Varbase 10; it's the next step on the same road. Teams currently on Varbase 9 or 10.0.x (Drupal 10) should treat Varbase 10.1.x (Drupal 11.3) as the stable interim target and plan Varbase 11 adoption once their site's custom code is recipe-compatible. Jumping directly from Varbase 9 to Varbase 11 is possible but rarely the lowest-risk path.

Keep Varbase Healthy

We recommend some key practices to keep Varbase healthy, stable, performant, and secure.

1. Stay Current

• Update your Varbase frequently; our fast release cadence means new improvements and security fixes.
• Schedule regular maintenance windows to pull minor updates.
• Test in staging: Run updates on staging or QA environments and use automated testing where available.
• Avoid delays in upgrades; Long delays in upgrades can sharply increase technical debt and make migrations more complex.

2. Use the Right Foundation

• Version control everything: including custom code, configurations, and deployment scripts.
• Automation infrastructure: Use Docker, DDEV, and other tools to ensure environments are mirrored as closely as possible.
• Varbase uses Drupal recipes, Single Directory Components, and Bootstrap 5 to make reproducible builds easier.
• Automate testing and deployments: Use CI pipelines to run automated tests. Varbase ships with automated functional testing artifacts.
• Backup and test restores: Restoring the website to a working state means a more reliable website; back up both databases and files, and test periodically.

3. Enforce Content Governance

• Define clear editorial workflows and use moderation workflows to avoid overlapping permissions in production.
• Assign logical permissions to editorial, review, and developer roles, and be conservative with "admin" roles in production.
• Keep media clean: Adopt file naming conventions, use tagging or taxonomy for media reuse, and clean up files regularly.
• Autosave: The new Autosave functionality reduces accidental loss of content. Editors are encouraged to use revisions, especially for long-form content.

4. Security First

• Stay up to date by subscribing to Drupal security advisories.
• Leverage Varbase Security to enforce password policies, prevent username enumeration, and configure HTTP headers.
• Use configuration management to lock down sensitive settings and avoid manual overrides in production with version control.
• Review accounts, roles, and permissions: Regularly deactivate unused accounts and enforce multi-step authentication where possible.
• Use privacy and consent tools: Varbase's new Privacy recipe brings cookie management and consent management to ensure compliance with privacy regulations.

5. Optimize Across the Stack

• Use caching: enable Drupal's built-in caching and consider reverse proxy solutions. Add a CDN. This is supported out of the box in Varbase.
• Monitor and audit performance: Use tools like Google Lighthouse or similar to detect slow and heavy pages.
• Optimize media: With Varbase's modern responsive image tooling (Drimage Improved, SDC, and Bootstrap 5), you can deliver appropriately sized media per breakpoint.
• Review third-party scripts.
• Lazy load images, defer JavaScript where practical, and avoid using unused CSS/JS.
• Keep admin happy by optimizing Layout Builder and removing heavy admin-facing assets.

6. Document, Share, Repeat

• Document project architecture, workflows, development practices, deployment pipelines, backup procedures, and upgrade paths.
• Train website users by having clear manuals and onboarding checklists.
• Encourage best practices: Rules enforced early save technical debt; "never commit to production" could go a long way.
• Keep an eye on changes: Encourage your team to follow Varbase release notes, documentation, and community channels; knowing what's new helps you leverage new functionality and retire deprecated patterns.

7. Engage with the Community

• Track release notes for Varbase and contributed modules, and review their relevance to your website architecture.
• Contribute back: Consider publishing patches or documentation updates for custom modules or patterns that could benefit others.
• Plan major upgrades and leverage the recipe system to keep your custom code compatible with newer Drupal APIs.
• Join the conversation

Varbase Health Check Workflow

This is a suggested periodic workflow that we use, which you can adopt to keep your Varbase in great shape.

The health-check cadence above isn't a one-time project. It's an operating rhythm. The teams that sustain it avoid the emergency migrations, surprise security incidents, and stalled launches that make enterprise Drupal expensive. Teams that don't, eventually pay for it in a single bill.

If your Varbase site hasn't had a structured review in the last 12 months, or if you're assessing whether to target Varbase 10.1.x or Varbase 11 for your next upgrade, a Drupal audit will surface the specific risks and upgrade paths for your environment.

Varbase Resources

• Varbase Homepage
• Documentation
• Slack Community