Know the day your Drupal code changes
On a Drupal site, code should change when you deploy and at no other time. A file that changes in between, in core, a module or settings.php, needs explaining. Alertica checks your site's files every day and tells you what changed and when. There's no module to install, our team sets it up with you on Pro, and there's a free plan that never expires.
- Ready-made checks for Drupal 8 and later
- Free plan that never expires
Watching before your next deploy
-
Connect your site
Add the site with an SFTP, FTPS or FTP login. Alertica only lists files, so a read-only login is enough, and it finds Drupal by itself, including the web folder of a Composer project.
-
Turn on Drupal Protection
Pick Drupal as the platform. The checks already know what Drupal writes for itself, like compiled templates and aggregated CSS, and leave it alone.
-
Choose who hears about it
Add the people on call for the site, by email or SMS, with Slack coming soon. The first scan reports any suspicious file that's already there.
What gets watched in Drupal
The checks are set for Drupal's own folders, and stay quiet about the files Drupal writes for itself.
-
Your site settings
settings.php holds your database password. Alertica alerts you when your settings change, and when a copy of the file turns up.
-
Drupal itself
Any change to Drupal's own code raises an alert. It should only change when you update it, so an alert between updates is worth a look.
-
Your modules
Any file added, changed or deleted in your modules, contributed or custom. Your own deploys show up too, so you can match each change to a release.
-
Your theme
The templates and code that draw every page. Anything added or changed there raises an alert.
-
Scripts among your uploads
The files folder is for uploads. A script there raises an alert, while the files Drupal generates for itself are left alone.
-
Files that shouldn't be there
A file your host's virus scanner flagged, known hacking tools, database backups, and developer leftovers like a .git folder.
Why Drupal teams pick Alertica
-
Outside Drupal
A security module runs inside Drupal, so an attacker with access to the files can turn it off. Alertica runs on our servers and only logs in to read.
-
Fits the way you deploy
Keep deploying with Composer and Git. Each deploy shows up in scan history, so a change nobody shipped stands out.
-
Secure by design
Alertica reads file names, sizes and timestamps, never what's inside. The login is encrypted with AES-256, and every account uses two-step sign-in.
-
Evidence for your audits
Scan history keeps every scan, the clean ones included, so you have evidence of when the site was checked and what each check found.
Questions Drupal teams ask
What Drupal Protection covers, how it handles deploys, and what it costs.
-
Which Drupal versions does it support?
The ready-made checks cover Drupal 8 and later, including sites built as Composer projects with Drupal in a web folder. Drupal 7, which reached end of life in January 2025, isn't covered by the ready-made checks.
-
Will every deploy set off an alert?
A deploy that changes core, a module or a theme raises an alert, which tells you the change was yours. vendor, node_modules and the files Drupal compiles and aggregates are skipped, so they don't add noise.
-
Does it replace Drupal security updates?
No. Security updates close the holes, and Alertica tells you when something got through anyway: a changed settings.php, a new file in a module or a script in public files. Keep applying the updates.
-
Is it safe to give Alertica access to our site?
Yes. Alertica is agentless and read-only: it lists files and never opens, changes or deletes them. The login is encrypted with AES-256, and every Alertica account uses two-step sign-in.
-
What does it cost?
Free covers one site with a weekly scan and the site-wide security check. Pro is $20 per site per month and runs every check daily, with SMS alerts and setup and onboarding with our team. Compare plans
-
Do I need to install a module?
No. Alertica connects with the SFTP or FTP login you give it and only lists files. There's no module, no agent and nothing on the server to keep updated.
Ready-made checks for other platforms
See your Drupal site from the outside
Tell us about your site. We'll turn on Drupal Protection with you and go through the first scan together.