Drupal hosting for a public body starts with supported versions. Drupal's PHP requirements page lists PHP 8.3 and 8.4 as supported for Drupal 11, and Drupal 10 will reach end of life on 9 December 2026. Those two facts set the floor for any hosting requirement written this year.
The rest of the requirement can be built from public sources a buyer can cite in an evaluation record. Drupal security releases come out in published Wednesday windows, weekly for contributed projects and monthly for core, and the NCSC's 14 cloud security principles work well as a question set. Neither the NCSC's principle on asset protection and resilience nor the Government Cloud First policy requires a UK data location, so a body that wants one has to say so in the requirement.
What should a public body require from Drupal hosting?
A public body should require Drupal hosting that keeps PHP, the database and the web server inside Drupal's supported list, applies security releases to an agreed timescale and hands back the codebase, database and files on exit. Write each of those as a term the host can be scored on and held to.
Around that core sit the operational questions: environments, backups and restore testing, where the data lives, certification, denial of service protection, logging and incident notice. Where the host and the development supplier are different companies, the requirement also has to say which of them applies Drupal security releases. Operating system and PHP updates belong with the host. Core and contributed module updates change the codebase and need a deployment, so they can sit with either party, and the contract should name one.
Which PHP and database versions does Drupal 11 support?
Drupal's PHP requirements page lists PHP 8.3 and 8.4 as supported for Drupal 11, with PHP 8.5 supported on Drupal 11.3 and 11.4 only. PHP 8.1 and 8.2 are not supported on Drupal 11, and the database server requirements list MySQL 8.0, MariaDB 10.6, PostgreSQL 16 and SQLite 3.45 as the lowest versions for Drupal 11.
Drupal 10 requires at least PHP 8.1, and its database minimums sit lower, as the table shows.
| Component | Lowest version listed for Drupal 10 | Lowest version listed for Drupal 11 |
|---|---|---|
| PHP | 8.1 | 8.3 |
| MySQL | 5.7.8 | 8.0 |
| MariaDB | 10.3.7 | 10.6 |
| PostgreSQL | 12 | 16 |
| SQLite | 3.26 | 3.45 |
On the web server, Drupal requires Apache 2.4.7 or greater, or Nginx 1.1 or later. As of Drupal 11.0.0 it does not support Microsoft IIS, so a site on IIS has a platform move to plan before it can upgrade. Drupal also notes that recommended PHP versions "will remain supported longer", which gives a requirement good reason to ask for the recommended version where one is listed rather than the minimum.
What a Drupal 10 site needs to do before 9 December 2026 is covered in our piece on Drupal 10 end of life.
Drupal security releases arrive on a published timetable
Security release windows are every Wednesday for contributed projects and "one Wednesday a month (usually the third Wednesday) for Drupal core". Releases go out between 16:00 and 22:00 UTC, and highly critical issues may be released outside that window. Every announcement is posted to an email list, with RSS feeds for core, contributed projects and public service announcements, and the team also posts on Mastodon and Bluesky.
Each advisory carries a score out of 25 under a system based on the NIST Common Misuse Scoring System. A score of 20 to 25 is Highly Critical and 15 to 19 is Critical. Below those sit Moderately Critical at 10 to 14, Less Critical at 5 to 9 and Not Critical at 0 to 4.
Advisory coverage has limits a host should know about. Only supported versions of Drupal receive Security Team support, and the team states that, in general, it "does not review core nor contributed code". A contributed project is covered only where it has opted in, which drupal.org shows with a shield and the line "Stable releases for this project are covered by the security advisory policy." Development, alpha, beta and release candidate releases get no advisories at all.
We suggest the hosting contract measures patch time from the Wednesday release, with a shorter commitment for Critical and Highly Critical advisories than for the lower bands.
Does Drupal hosting have to be in the UK?
Drupal hosting for a public body does not have to be in the UK under the NCSC cloud security principles or the Cloud First policy. The NCSC's principle on asset protection and resilience asks that "you should be confident that you know where your data is, and who can access your data", and that you understand which jurisdiction applies and "whether this is acceptable to you".
The Government Cloud First policy tells buyers to "default to Public Cloud first, using other solutions only where this is not possible." It states: "This approach is mandatory for central government, and strongly recommended to the wider public sector." On location, it asks buyers to "perform due diligence using ICO guidance and NCSC guidance" and sets no UK residency rule.
A UK location is a reasonable choice for a body that wants one. Put it in the requirement and extend it to backup copies, because the guidance leaves that decision with the buyer.
Using the NCSC cloud security principles as the frame
The NCSC's 14 principles run from data in transit protection to secure use of the service. They map onto Drupal hosting closely enough to organise a requirement around them. The mapping below is our own, and the NCSC does not publish it.
| Hosting topic | NCSC principle |
|---|---|
| Patching the platform and Drupal | 5 Operational security |
| Environments and the route to production | 7 Secure development, 12 Secure service administration |
| Subcontracted data centres and services | 8 Supply chain security |
| Denial of service protection | 11 External interface protection |
| Logs and incident notice | 13 Audit information and alerting for customers |
| Data location, backups and exit | 2 Asset protection and resilience |
The sanitisation section of principle 2 asks for confidence that "your data is erased when resources are moved or re-provisioned, or when you request it to be erased", which is the exit clause. Its resilience section asks whether "you can protect your data from ransomware attacks", which is the restore test in another form.
For denial of service, the NCSC's DoS guidance sets out four practices: understand your service, understand your defences, create a response plan and test your response.
What to ask a Drupal host, and what a strong answer sounds like
These questions work as written in a requirement or at clarification. Score the evidence behind each answer as well as the answer.
- Which PHP, database and web server versions will our site run on? A strong answer names them against drupal.org's requirements pages and gives a plan for Drupal 10 end of life. A weak one says "we keep everything up to date".
- Who applies Drupal core and contributed security releases, and how soon after the Wednesday window? A strong answer names the responsible supplier, subscribes to the advisory list and gives a time per risk level. A weak one says "patches are applied regularly".
- Which of our contributed modules lack security advisory coverage? A strong answer comes from checking each project page for the coverage shield, with a plan for the gaps.
- What environments do we get, and how does code reach production? Look for separate development, staging and production environments and a defined release path. Edits made directly on the live site are the weak answer.
- Where is our data, including every backup copy, and under which jurisdiction? A strong answer names the locations. "In the cloud" is not an answer to principle 2.
- How often do you back up, and when did you last test a restore for a customer? Frequency, retention and a dated restore test make a strong answer. Our piece on business continuity and disaster recovery for websites covers what a test should show.
- Which certificates cover this service, and can we see the scope statement and certificate number? Check them as set out in what to check on a supplier's ISO 27001 certificate and Cyber Essentials requirements.
- What protects the site from denial of service, and when was the response plan last tested? Named upstream protection and a tested plan are strong. "We have a firewall" is weak.
- On exit, how do we get the codebase, database and files, and how is our data erased afterwards? A strong answer gives formats, a timescale and the sanitisation step. "We will cooperate" leaves the exit undefined.
How Axistwelve hosts Drupal
Axistwelve runs its own secure hosting in UK data centres and has partnerships with AWS, Microsoft Azure, Platform.sh and Acquia. We are a LocalGov Drupal certified supplier, and our ISO 27001:2022 certification is held through BSI. The service is described on our secure hosting page.
Before you go to market for Drupal hosting
- Current versions: record the PHP, database and web server versions your site runs today and compare them with Drupal's requirements pages.
- Module coverage: list your contributed modules and check each project page for the security advisory shield.
- Data location: decide whether you want a UK location and write it in, covering backups.
- Route to market: G-Cloud 15 (RM1557.15) started on 6 August 2026, and Lot 1a covers infrastructure and platform services. The buyer changes in G-Cloud 15 are covered separately.
- Exit: agree the hand-back formats and the erasure step before award, when the host still has a reason to commit to them.
Frequently asked questions
Can Drupal 11 run on a Windows server?
Drupal 11 can run on Windows with Apache, because Drupal's web server page says it requires Apache 2.4.7 or greater "hosted on UNIX/Linux, OS X, or Windows". It cannot run on Microsoft IIS, which Drupal stopped supporting at 11.0.0. A Drupal 10 site on IIS needs a web server change as part of its upgrade.
Does a council have to follow the Cloud First policy?
A council is not bound by the Cloud First policy in the way central government is. The Government Cloud First policy describes the approach as mandatory for central government and strongly recommended to the wider public sector.
Who runs G-Cloud 15 for Drupal hosting?
G-Cloud 15 is run by the Government Commercial Agency, which is what Crown Commercial Service became on 1 April 2026. Lot 1a covers infrastructure and platform as a service, and the agreement page says "Cloud hosting offers the capability to deploy, manage and run software."
