Varbase Health Checklist: Best Practices We Follow

Varbase is Vardot's flagship enterprise Drupal distribution. With Varbase 11, it's also an enterprise layer built directly on Drupal CMS 2.0: the same official foundation the Drupal community maintains, extended with recipes, security defaults, and editorial workflows refined across hundreds of implementations.

That shift matters for site health. Varbase 11's recipe-based architecture changes how sites are upgraded, how features are adopted, and how long technical debt can safely accumulate before it blocks a migration. With Drupal 10 reaching end of life on December 9, 2026, enterprise teams have a narrow window to bring their Varbase sites into a healthy state before the upgrade path gets more expensive.

This post covers:

• What Varbase 11 introduces, and what it means for existing Varbase sites.
• The practices we apply to keep enterprise Varbase installations stable, secure, and upgrade-ready.
• A health-check workflow you can adopt this quarter.

What Is a Varbase Health Check?

What's New in Varbase

Varbase 11 is the first Varbase release built on Drupal CMS 2.0, rather than being shipped as a standalone profile-based distribution. Three shifts define the release:

Other release highlights

• Default editorial workflow (Draft → Needs Review → Published) with scheduling, contributed to Drupal CMS 2.0 by Vardot during the Starshot Initiative.
• Privacy recipe for cookie consent and regional compliance defaults.
• Auto-save forms to protect long-form content against accidental loss.
• Improved Dynamic Responsive Image Styles (Drimage Improved) for performance-optimized media delivery per breakpoint.
• 2-to-3-week release cadence with clear upgrade paths between versions.

Keep Varbase Healthy

We recommend some key practices to keep Varbase healthy, stable, performant, and secure.

1. Stay Current

• Update your Varbase frequently; our fast release cadence means new improvements and security fixes.
• Schedule regular maintenance windows to pull minor updates.
• Test in staging: Run updates on staging or QA environments and use automated testing where available.
• Avoid delay in upgrades; Long delays in upgrades can sharply increase technical debt and make migrations more complex.

2. Use the Right Foundation

• Version control everything: including custom code, configurations, and deployment scripts.
• Automation infrastructure: Use Docker, DDEV, and other tools to ensure environments are mirrored as closely as possible.
• Varbase uses Drupal recipes, Single Directory Components, and Bootstrap 5 to make reproducible builds easier.
• Automate testing and deployments: Use CI pipelines to run automated tests. Varbase ships with automated functional testing artifacts.
• Backup and test restores: Restoring the website to a working state means a more reliable website, backing up both databases and files, and testing periodically.

3. Enforce Content Governance

• Define clear editorial workflows and use moderation workflows to avoid overlapping permissions in production.
• Assign logical permissions to editorial, review, and developer roles, and be conservative with "admin" roles in production.
• Keep media clean: Adopt file naming conventions, use tagging or taxonomy for media reuse, and clean up files regularly.
• Autosave: The new Autosave functionality reduces accidental loss of content. Editors are encouraged to use revisions, especially for long-form content.

4. Security First

• Stay up to date by subscribing to Drupal security advisories.
• Leverage Varbase Security to enforce password policies, prevent username enumeration, and configure HTTP headers.
• Use configuration management to lock down sensitive settings and avoid manual overrides in production with version control.
• Review accounts, roles, and permissions: Regularly deactivate unused accounts, and enforce multi-step authentication where possible.
• Use privacy and consent tools: Varbase's new Privacy recipe brings cookie management and consent management to ensure compliance with privacy regulations.

5. Optimize Across the Stack

• Use caching: enable Drupal's built-in caching and consider reverse proxy solutions. Add CDN. This is supported out of the box in Varbase.
• Monitor and audit performance: Use tools like Google Lighthouse or similar to detect slow and heavy pages.
• Optimize media: With Varbase's modern responsive image tooling (Drimage Improved, SDC, and Bootstrap 5), you can deliver appropriately sized media per breakpoint.
• Review third-party scripts.
• Lazy load images, defer JavaScript where practical, and avoid using unused CSS/JS.
• Keep admin happy by optimizing Layout Builder and remove heavy admin-facing assets.

6. Document, Share, Repeat

• Document project architecture, workflows, development practices, deployment pipelines, backup procedures, and upgrade paths.
• Train website users by having clear manuals and onboarding checklists.
• Encourage best practices: Rules enforced early save technical debt, "never commit to production" could go a long way.
• Keep an eye on changes: Encourage your team to follow Varbase release notes, documentation, and community channels, knowing what's new helps you leverage new functionality and retire deprecated patterns.

7. Engage with the Community

• Track release notes for Varbase and contributed modules, and review their relevance to your website architecture.
• Contribute back: Consider publishing patches or documentation updates for custom modules or patterns that could benefit others.
• Plan major upgrades and leverage the recipe system to keep your custom code compatible with newer Drupal APIs.
• Join the conversation

Varbase Health Check Workflow

This is a suggested periodic workflow that we use, which you can adopt to keep your Varbase in great shape.

The health-check cadence above isn't a one-time project. It's an operating rhythm. The teams that sustain it avoid the emergency migrations, surprise security incidents, and stalled launches that make enterprise Drupal expensive. Teams that don't, eventually pay for it in a single bill.

If your Varbase site hasn't had a structured review in the last 12 months, or if you're assessing whether to target Varbase 10.1.x or Varbase 11 for your next upgrade, a Drupal audit will surface the specific risks and upgrade paths for your environment.

Varbase Resources

• Varbase Homepage
• Documentation
• Slack Community