A Drupal care plan is a productized retainer: monthly billing, fixed scope, predictable inclusions. The model exists because the Drupal-site-and-engineering combination is the actual product most teams need, but agencies historically sold them as separate line items. This post breaks down what each tier includes and how to pick.
The three tiers
| Inclusion | Essential ($499) | Professional ($999) | Enterprise ($1,999+) |
|---|---|---|---|
| Managed Drupal hosting (Hetzner-backed) | Yes | Yes | Yes |
| PHP runtime support | PHP 8.3+ | PHP 8.3+ | PHP 8.3+ |
| Security patch SLA | 1 business day | 1 business day | 4 hours, emergency |
| Drupal core and contrib updates | Monthly | Monthly | Monthly |
| Backups | Daily, 14 day retention | Daily, 30 day retention | Daily, 90 day retention |
| Staging environment | Shared | Dedicated | Dedicated + branch envs |
| Bundled dev hours per month | 4 | 10 | 25 |
| Support response SLA | 1 business day | 4 business hours | 1 hour, emergency |
| Performance report | Quarterly | Monthly | Monthly + advisory |
| Dedicated account manager | — | — | Yes |
| Uptime SLA | 99.5% | 99.9% | 99.95% |
The full matrix lives on the care plans page; this post explains how to read it.
What each line really means
Managed hosting
The hosting line is not a separate product you also buy. The plan price includes the production environment, Redis cache, Varnish layer, CDN, SSL, and SSH access. There is no "hosting tier" to pick on top of the care plan tier; they are the same thing.
Underneath, the infrastructure is Hetzner dedicated or VPS depending on traffic, with WebEvra-managed Drupal-aware tuning. You do not see Hetzner; you see the Drupal site.
PHP runtime support
All tiers run on PHP 8.3 or newer. As D11 moves to require newer PHP, the runtime is bumped on your environment without ceremony. You are not paying extra for runtime upgrades.
Security patch SLA
This is the line that matters more than any other. Drupal security advisories are released on an unpredictable schedule. The SLA tells you how long before WebEvra has the patch on your site after the advisory is published.
- Essential: 1 business day. Adequate for marketing sites and most B2B.
- Professional: 1 business day. Same SLA, but Professional gets faster general support response.
- Enterprise: 4 hours, with emergency escalation. Right for revenue-generating, regulated, or high-traffic sites.
Bundled dev hours
The dev hours are the hidden value of the care plan model. Most Drupal teams have a steady backlog of small things: a tweak to a content type, a new field, an integration update, a content migration. The bundled hours absorb that backlog without a per-task contract.
- Essential: 4 hours/month. Right for sites in steady state with occasional small changes.
- Professional: 10 hours/month. Right for active sites where the marketing team has a real backlog.
- Enterprise: 25 hours/month. Right for sites under continuous development.
Hours roll over for one cycle. They are senior engineer hours; we do not staff care plans with juniors.
Backups
Daily database backups, weekly file backups, retained off-host. Tested by quarterly restore. The retention window scales with tier because the most common reason to need an old backup is a content rollback (someone deleted a page three weeks ago and no one noticed); 14 days is short, 30 is comfortable, 90 is generous.
Performance report
Monthly (or quarterly on Essential) PDF and Slack message: uptime number, p95 page load, slow query summary, error rate trend, security advisories applied this period, hours used. The report is short on purpose; it is meant to be read in 90 seconds and used as the talking-point doc with your stakeholders.
How to pick a tier
Three questions, in order:
- How sensitive is the site to downtime or a security incident? If "very," go Enterprise. The 4-hour patch SLA pays for itself in one avoided incident.
- How many hours of Drupal work per month do you actually use? If under 4, Essential. If 4 to 10, Professional. Over 10, Enterprise.
- Do you need a dedicated account manager and structured monthly advisory? Only Enterprise.
Most teams land on Professional. Essential is right for static or near-static sites; Enterprise is right for revenue-generating production.
The math against the alternatives
Care plans are not the cheapest hosting option in absolute terms. Pantheon Performance Small at $159/month is cheaper than Essential. The math works out in WebEvra's favor when you include the dev work that Pantheon and similar managed Drupal hosts do not include.
A typical Pantheon-Performance-Medium customer pays $399/month for hosting and $1,000 to $2,000/month for agency Drupal work. Total: $1,400 to $2,400/month. WebEvra Professional at $999/month with 10 dev hours included covers most of that for half the cost.
The exact numbers for your situation are on the Pantheon cost calculator. Same calculator pattern, different inputs, on the Acquia comparison.
What is not in any tier
To be honest about scope:
- Net-new feature builds beyond bundled hours. A bundled-hours overrun is billed at the same senior rate; we tell you in advance if the work is going to spill.
- Migration projects. A D7-to-D11 migration is a separate fixed-price engagement, not a care-plan inclusion. After the migration completes, the site rolls onto a care plan.
- Major theme rebuilds. Same logic — separate scope, separate engagement.
- Third-party software licenses. If you need a paid Drupal module or a SaaS integration, the license is on you. We deploy and configure it under bundled hours.
How to start
Free 30 minute audit. We talk about your stack, what you are paying today, what you are getting for it, and which tier (if any) fits. No pitch on the call; we send the proposal afterward if there is one to make. Book at cal.com/webevra or email [email protected].