Varbase Health Checklist | The Vardot Blog

Ala Batayneh September 11, 2025

Varbase is our flagship solution, an enterprise-ready Drupal distribution that provides a strong foundation for any digital project. And like any other software, having regular updates and smart workflows in place will help the software realize its full potential.

In this post, we'll cover:

Latest Varbase features and release highlights
Best practices for long-term longevity and security
Recommended maintenance checklist you can adopt today

What’s New in Varbase

Varbase 10.0.x and beyond bring major improvements, smart defaults, modern tools, and optional AI integration.

Feature highlights:

AI-powered features: Varbase now includes an optional Varbase AI module to help automate content workflows and provide smart editorial tools. It integrates with AI providers such as OpenAI.
Privacy management: A new Varbase Privacy recipe provides a default configuration for cookie consent.
Auto-save form: Auto-save form functionality helps prevent content loss by periodically saving data during longer sessions
Navigation Extra Tools: Varbase Admin UI is enabled by default to enhance navigation setup and menus.
Modernized stack: Varbase 10 uses Drupal 10/11, Bootstrap 5.3.x, CKEditor 5, Single Directory Component (SDC), and recipes for smoother upgrades and builds.
Varbase release cadence: Varbase follows a 2-3 weeks release cycle, with focus on minor releases that introduce new features.
Strong upgrades and version support: Every Varbase release comes with clear upgrade paths and support.

Keep Varbase Healthy

We recommend some key practices to keep Varbarse healthy, stable, performant, and secure.

1. Stay current

Update your Varbase frequently; our fast release cadence means new improvements and security fixes.
Schedule regular maintenance windows to pull minor updates.
Test in staging: Run updates on staging or QA environments and use automated testing where available.
Avoid delay in upgrades; Long delays in upgrades can sharply increase technical debt and make migrations more complex.

2. Use the Right Foundation

Version control everything: including custom code, configurations, and deployment scripts.
Automation infrastructure: Use Docker, DDEV, and other tools to ensure environments are mirrored as closely as possible.
Varbase uses Drupal recipes, Single Directory Components, and Boostrap 5 to make reproducible builds easier.
Automate testing and deployments: Use CI pipelines to run automated tests. Varbase ships with automated functional testing artifacts.
Backup and test restores: Restoring the website to a working state means a more reliable website, backing up both databases and files, and testing periodically.

3. Enforce Content Governance

Define clear editorial workflows and use moderation workflows to avoid overlapping permissions in production.
Assign logical permissions to editorial, review, and developer roles, and be conservative with "admin" roles in production.
Keep media clean: Adopt file naming conventions, use tagging or taxonomy for media reuse, and clean up files regularly.
Autosave: The new Autosave functionality reduces accidental loss of content. Editors are encouraged to use revisions, especially for long-form content.

4. Security First

Stay up to date by subscribing to Drupal security advisories.
Leverage Varbase Security to enforce password policies, prevent username enumeration, and configure HTTP headers.
Use configuration management to lock down sensitive settings and avoid manual overrides in production with version control.
Review accounts, roles, and permissions: Regularly deactivate unused accounts, and enforce multi-step authentication where possible.
Use privacy and consent tools: Varbase's new Privacy recipe brings cookie management and consent management to ensure compliance with privacy regulations.

5. Optimize Across Stack

Use caching: enable Drupal's built-in caching and consider reverse proxy solutions. Add CDN. This is supported out of the box in Varbase.
Monitor and audit performance: Use tools like Google Lighthouse or similar to detect slow and heavy pages.
Optimize media: With Varbase's modern responsive image tooling (Drimage Improved, SDC, and Bootstrap 5), you can deliver appropriately sized media per breakpoint.
Review third-party scripts.
Lazy load images, defer JavaScript where practical, and avoid using unused CSS/JS.
Keep admin happy by optimizing Layout Builder and remove heavy admin-facing assets.

6. Document, Share, Repeat

Document project architecture, workflows, development practices, deployment pipelines, backup procedures, and upgrade paths.
Train website users by having clear manuals and onboarding checklists.
Encourage best practices: Rules enforced early save technical debt, "never commit to production" could go a long way.
Keep an eye on changes: Encourage your team to follow Varbase release notes, documentation, and community channels, knowing what's new helps you leverage new functionality and retire deprecateed patterns.

7. Engage with Community

Track release notes for Varbase and contributed modules, and review their relevance to your website architecture.
Contribute back: Consider publishing patches or documentation updates for custom modules or patterns that could benefit others.
Plan major upgrades and leverage the recipe system to keep your custom code compatible with newer Drupal APIs.
Join the conversation

Varbase Health-Check Workflow

This is a suggested periodic workflow that we use, which you can adopt to keep your Varbase in great shape.

Weekly	Review Varbase release notes and updates Plan minor version upgrades Ensure backups run successfully and test restores on staging copy
Monthly	Pull Varbase updates in staging environment Run automateed test (functional, manual regression checks) Audit performance and identify slow pages
Quarterly	Review user accounts and permissions. Cleanup Media Library and remove unused assets. Review workflow changes and new features
Bi-annual	Run full site upgrade path simulation. Upgrade major/minor Varbase version Review custom code compatibility Review security advisories Update/patch vulnerable modules Audit site configurations
Annual	Conduct post-mortem (what worked, what suprized us, etc) Assess architecture and workflows Assess adopting new strategies (media, AI tooling, headless)

You can adapt the cadence for the health-check depending on your traffic volume, website size, or editorial velocity. It's a combination of disciplined workflow, proactive maintenance, and smart utilization of features.

Varbase started as a starter-kit, and it's becoming a living open ecosystem on top of Drupal's flexibility. Our engineering, distribution strategy, rigorous maintenance practices, and development iterations prepared a platform reliable for years.

Image by Pexels from Pixabay