Essential Things to Know About Varbase

Varbase is Vardot's open-source enterprise Drupal distribution. It bundles the modules, configuration, and editorial tooling that most Drupal projects need into one pre-configured starting point, so teams build on a tested foundation instead of assembling and configuring everything from scratch.

What is Varbase?

Varbase is a Drupal distribution: a packaged set of Drupal core plus selected contributed modules, themes, and pre-defined configuration that Vardot maintains as a product.

The purpose is to remove the repetitive setup at the start of every Drupal build. Vardot's project page estimates the distribution saves teams over 200 hours of setup, and it ships with more than 100 pre-configured features.

It is built on the DRY principle, Don't Repeat Yourself. Rather than rebuilding the same media, SEO, and editorial configuration on each project, teams start from Varbase and customize from there.

The distribution is free and open-source under the same license as Drupal, with no licensing cost, and it has been refined across hundreds of Vardot implementations.

What changed in Varbase 11?

The biggest change is architectural: Varbase moved from a monolithic installation profile to Drupal recipes, and it is now built on Drupal CMS 2.0 rather than shipping as a standalone profile. This matters because it changes how sites are upgraded and how features are adopted.

In Varbase 10 and earlier, functionality came from custom Varbase modules (such as varbase_core, varbase_media, and varbase_editor) installed through a Drupal installation profile.

In Varbase 11, those are replaced by composable recipes (such as varbase_content_base, varbase_media_base, and varbase_editor_base) applied to a standard Drupal 11 site.

Recipes can be applied independently, so a team can take just Varbase's media handling onto an existing Drupal site without adopting the whole distribution.

Varbase 11 sits on three recipe layers: Drupal core recipes, Drupal CMS 2.0 recipes, and Varbase's own enterprise recipes on top.

Two practical points to plan around: Varbase 11 requires PHP 8.3 or later, and there is no in-place upgrade path from Varbase 10 to 11, because the shift from modules to recipes is too fundamental for an automated migration.

Moving to Varbase 11 is a rebuild-and-migrate project, not a version bump.

Varbase vs building on Drupal core from scratch

The value of a distribution is the setup you do not have to do. The table below compares starting from plain Drupal core against starting from Varbase.

Plain Drupal core gives you total control and no opinions. Varbase trades some of that blank-slate flexibility for a hardened, opinionated baseline.

For teams that value control over speed, core is fine. For teams that want to skip repetitive setup and start from proven defaults, Varbase is the faster path.

What do you get out of the box?

Varbase preconfigures the systems most enterprise sites need on day one. The headline capabilities are media management, SEO, editorial experience, and multilingual support.

Media is handled through drag-and-drop uploads with DropzoneJS, focal-point cropping for consistent previews across breakpoints, and a central media browser. SEO ships with sensible defaults, meta tag control, and XML sitemap generation.

The editorial experience runs on the Gin admin theme and a content workflow that moves through Draft, Needs Review, and Published with scheduling built in. Marketers assemble pages from pre-built, brand-compliant components using Drupal Canvas, which Varbase extends with enterprise section styles and a components library on Bootstrap 5.3 and Single Directory Components, so layout changes do not require a developer ticket.

How does Varbase handle AI?

AI in Varbase is optional, governed, and delivered through recipes rather than bolted on. Vardot is a Gold Sponsor of the Drupal AI Initiative, and Varbase AI builds on the same AI modules the wider Drupal community maintains.

The foundation is the varbase_ai_base recipe, which configures the core AI modules, an OpenAI integration, and role-based permissions.

On top of that, teams can enable an AI editor assistant in CKEditor 5 for grammar, rewrites, and summaries, automatic image alt-text generation and taxonomy tagging that help maintain WCAG accessibility and metadata at scale, and AI agents (varbase_ai_agents) that provide admin-facing chatbots for tasks like content moderation and site auditing.

Because these are separate recipes, an organization turns on only the AI it wants, with keys and permissions under its own control. This is the responsible-AI posture Vardot recommends: AI as a governed assistant inside the CMS, not an unmanaged add-on.

How does Varbase automate workflows?

Varbase uses the ECA framework, Event-Condition-Action, to automate site behavior without custom code. This moves business logic out of custom PHP modules and into structured, configurable rules, which keeps the upgrade path cleaner.

An automation is defined as an event that triggers it (for example, content moving to a new state), the conditions that must be met, and the actions that follow (a notification, an API call, a status change).

Alongside automation, Varbase includes governance safeguards: a Trash module for soft-deletes, so content can be recovered rather than lost, and Content Lock to prevent two editors from overwriting each other on large teams.

Is Varbase secure and compliant?

Varbase is built with security by design, and its security updates are synchronized with Drupal core. When the Drupal Security Team publishes an advisory, Vardot issues corresponding recipe updates so protection reaches Varbase sites promptly.

On compliance, Varbase provides recipes and defaults aimed at common enterprise requirements: WCAG-oriented accessibility, GDPR and privacy configuration, anti-spam through CAPTCHA, and tiered roles and permissions for governed access.

Its multilingual support is a particular strength, with mature right-to-left handling and Arabic-optimized, SEO-aware defaults, which matters for organizations serving MENA audiences alongside global ones.

How does Varbase scale for enterprise?

Varbase supports the multi-site patterns global organizations need, and it is engineered for reliable, repeatable delivery. Two orchestration strategies are common: virtual sites managed within a single database for centralized control, and a shared codebase where multiple sites run distinct databases for data separation.

The developer workflow is built for velocity and stability. Local setup uses DDEV with commands like ddev install-varbase, functional testing runs on Playwright and Gherkin-style scenarios, and deployment runs through CI pipelines. That testing-first approach is how a distribution used across many sites stays stable through upgrades.

Who is Varbase for?

Varbase fits organizations that run complex, long-lived Drupal sites and want a governed, fast starting point rather than a blank slate. It is strongest for enterprises, government, higher education, nonprofits and UN agencies, and media publishers: the sectors where multilingual reach, accessibility, editorial governance, and security all matter at once.

It is less necessary for a small brochure site or a simple blog, where plain Drupal core or a lighter setup is enough. The distribution earns its value when the site has real content operations, multiple editors, several languages, or a fleet of sub-sites to manage.

The Vardot point of view

Choose a distribution for the maintenance you avoid over five years, not just the setup you skip in the first week. The real cost of a Drupal build is rarely the initial launch. It is the slow accumulation of custom overrides and deferred updates that make the next upgrade expensive.

Varbase 11's recipe-based architecture is aimed squarely at that problem: features arrive and update as recipes aligned to Drupal core, which keeps technical debt from quietly compounding until it blocks a migration.

Vardot builds and maintains Varbase as its flagship product. As a Drupal Diamond Certified Partner, a top-20 Drupal contributor worldwide, and a Gold Sponsor of the Drupal AI Initiative, Vardot has delivered enterprise Drupal for organizations including UNHCR, UNICEF, Georgetown University, and Al Jazeera.

Varbase packages that experience so teams start from a hardened baseline, and Vardot's delivery methodology, the Vardot Delivery System (Align, Blueprint, Accelerate, Assure, Operate), carries it from selection through long-term operation.