Site Building

13.5. Updating the Core Software for Drupal 8, 9, and 10


Update the core software, either through the administrative interface or by using Drush.

Site prerequisites


Sprout Video
  1. Make a complete backup of your site. Refer to Section 12.3, “Concept: Data Backups”.
  2. Open settings.php (/sites/default/settings.php) in any plain text editor. Find the line with the $settings[update_free_access] variable. By default, it is set to "FALSE" due to security reasons. Change the setting to "TRUE":

    $settings['update_free_access'] = TRUE;
  3. Disable any caching technique (memcache, varnish, and so on) your application might be using.
  4. Put your site in maintenance mode. See Section 11.2, “Enabling and Disabling Maintenance Mode”.
  5. If you are using Composer to manage dependencies, skip the next six steps, and instead see Section 3.5, “Using Composer to Download and Update Files” for instructions on downloading updated files. Continue with the update.php step.
  6. Download the tar.gz or zip file archive for the latest version of Drupal core for the branch you are currently using (such as 8.x or 9.x) from Drupal Core Downloads. See Section 3.4, “Preparing to Install” for more details on how to find the latest version.
  7. Upload the archive file to your web hosting server.
  8. Extract the archive file to a temporary directory on your server (should be outside the directory where the site is hosted). Your hosting control panel’s file manager should provide a way to extract the files. Or, if you have terminal access to your hosting server (running Linux), you can use a command like:

    tar -xzf drupal-8.3.2.tar.gz
  9. In your site hosting directory, delete the core and vendor directories, and all files that are not in a subdirectory, including .htaccess, composer.json, and autoload.php. Don’t delete custom and customized files because you may end up losing the custom functionality stored in them.
  10. Copy the core and vendor directories and the non-custom/non-customized files that you deleted in the preceding step from the temporary directory to your site directory.
  11. Run the update.php script using either of the following:

    • Visit in your browser (where is your site’s URL). Click Continue in the first screen to run the updates and successfully complete the script.
    • Run the following Drush command: drush updatedb
  12. If you get any error or warning, re-run the update.php script again till all the updates have been completed successfully.
  13. Open settings.php (/sites/default/settings.php) in a text editor. Find the line with the $settings[update_free_access] variable and update it to "FALSE":

    $settings['update_free_access'] = FALSE;
  14. Click Administration pages to return to the administration section of your site.
  15. Take your site out of maintenance mode. See Section 11.2, “Enabling and Disabling Maintenance Mode”.
  16. Clear the cache. See Section 12.2, “Clearing the Cache”.
  17. Re-enable any caching technique you disabled at Step 3.
  18. You should have the updated version running. You can verify the current version of your software by checking the Status report (see Section 12.5, “Concept: Status Report”).

Additional resources


Written and edited by Surendra Mohan, Boris Doesborgh, and Jojy Alphonso at Red Crackle.

Drupal User Guide