A complete Drupal migration copies the codebase, Composer dependencies, public and private files, configuration secrets, and database; then you test the new installation before changing DNS. The safest sequence is to inventory and freeze changes, make protected backups, rebuild a compatible stack, restore files and SQL, update settings.php, clear caches, test through a temporary hostname, and keep the old server available for rollback.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a Drupal move actually includes
Moving only the web directory is not a migration. A working Drupal site is the combination of several components that must remain consistent:
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Drupal 6 Content Administration | $45.99 | Buy on Amazon |
| 2 |
|
Drupal For Dummies | $12.37 | Buy on Amazon |
| 3 |
|
Teacher Record Book | $4.89 | Buy on Amazon |
| 4 |
|
Drupal 7 Multi Sites Configuration | $24.99 | Buy on Amazon |
| 5 |
|
Drupal 5 Views Recipes | $57.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Application code: Drupal core, contributed and custom modules, themes, libraries, and any web-server configuration kept with the project.
- Composer metadata and dependencies:
composer.json,composer.lock, and the dependency tree generated from them. - Public files: usually the site-specific
sites/default/filesdirectory, although a multisite installation can use another directory. - Private files: the directory configured for private-file storage, which must remain outside unintended public access.
- Configuration and secrets:
settings.php, included settings files, database credentials, the hash salt, trusted-host patterns, and environment-specific overrides. - Database: content, users, configuration, field data, cache tables, queue data, and any application-specific tables.
Leaving out one of these can produce a site that appears to load but has missing images, failed logins, broken forms, absent configuration, or inaccessible private documents.
Choose a migration method before touching the source site
Your access level, Drupal generation, site size, and downtime tolerance determine the practical workflow. These are the supported patterns described in Drupal and Drush guidance:
#1 Best Overall
- Used Book in Good Condition
| Situation | Typical workflow | Important consideration |
|---|---|---|
| Composer-managed Drupal with SSH | Clone the repository, run composer install, transfer files with SSH or rsync, and dump/import SQL with Drush or native database clients. |
Rebuilding from the repository is safer than copying only the document root. |
| Archive-based transfer | Use the archive command available in your installed Drush version to package code, files, and database, then restore with a compatible workflow. | Archive command names changed: Drush 14 documents archive:dump; older documentation describes archive:restore, while the current Composer guide says archive restore was removed in Drush 13. |
| No shell access | Use the Backup and Migrate module or your host’s database and file-management tools. | Browser uploads are a poor fit for very large SQL dumps; host-native import tools are more reliable. |
| Drupal 7 or another legacy, non-Composer site | Copy the code and files, import the SQL dump, edit settings.php, adjust the base URL where applicable, and change DNS after testing. |
Drupal 7 instructions describe the general sequence, but newer Drupal versions use different commands and security practices. |
1. Inventory the source and schedule a freeze
Before creating a backup, record the versions and integrations that the destination must support. Document the Drupal and Drush versions, PHP version, database engine and version, web-server document root, public-files location, private-files location, Composer files, cron jobs, mail delivery, queues, payment or webhook integrations, and the DNS records that will change.
PHP and database compatibility are restoration requirements, not optional notes. Drupal’s documentation specifically advises documenting the PHP and database versions used by the site so compatibility can be checked during restoration.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsPlan for writes during the move
Any order, registration, comment, form submission, editorial change, or other write that occurs after the final database dump will not exist in that dump. Schedule a maintenance window, put the old site in maintenance or read-only mode for the final capture, or use another process that prevents writes. Lower the DNS TTL ahead of the cutover so resolvers can update sooner, while remembering that existing cached records can still delay traffic changes.
Capture a rollback point
Keep the source database untouched until the destination has passed functional tests. Preserve the exact SQL dump, code commit, Composer lock file, settings backup, and transfer checksums used for the cutover. Do not destroy the old environment when the first page on the new server loads; it is your fastest rollback option.
2. Back up every rebuildable component
Export the database
With Drush available, create a SQL dump using:
drush sql:dump > backup.sqlThe equivalent native command depends on the database engine and its client utilities. Record the dump filename and checksum, and make sure the command completed without truncation or errors. A database export alone is not a full Drupal backup.
Save Composer-managed code
Commit or otherwise preserve the repository state that produced the running site, including composer.json and composer.lock. Also preserve custom modules, themes, libraries, patches, and deployment scripts. Files ignored by version control can still be essential: back up settings.php, included local settings files, certificates, private keys, and other secrets through a protected channel.
Recommended Free Tools
Copy public and private files
Copy the complete site-specific public-files directory, normally sites/default/files, including image styles and generated assets that your deployment expects. Locate the configured private-files directory and copy it separately. Check for additional asset directories used by custom code or multisite settings.
Rank #2
Use checksums and an untouched copy
After creating the SQL dump and file archive, calculate checksums and compare them after transfer. Keep one untouched copy away from the old server. Drupal’s user guide warns: “For security reasons, avoid storing this file on your hosting server anywhere under the Drupal site root.” That warning applies especially to SQL dumps, which can contain passwords, email addresses, tokens, and unpublished content.
3. Protect backups before transferring them
- Store SQL dumps and archives outside every web-accessible directory.
- Restrict filesystem permissions so the web server and intended administrators are the only accounts that can read them.
- Encrypt backups when they leave the server or when your threat model requires it.
- Do not commit
settings.php, database passwords, API tokens, or private keys to a public repository. - Retain the original dump unchanged; work on a copy if you need to inspect or transform it.
Do not place a downloadable archive in the Drupal document root as a temporary convenience. If a backup has been exposed, remove it, rotate credentials contained in it, and treat the old copy as compromised.
4. Provision a compatible destination
Create an empty database and a dedicated database user on the new server. Install a PHP and database stack compatible with the source, and enable the PHP extensions required by your Drupal version and modules. Match the web-server document root and ensure the destination can write to the configured files directories without making private files public.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRebuild Composer sites from source control
Clone or copy the repository at the exact commit you intend to run, then install dependencies from the lock file:
composer installDo not assume that copying only the web directory reproduces a Composer-managed deployment. The lock file determines dependency versions, while the repository contains custom code that may not be present in a generated directory.
Prepare scheduled and background work
Recreate cron jobs, queue workers, mail delivery settings, and any container volume mounts or service accounts. A site can pass a page test while silently failing cron or queues because those jobs still point to the old path, hostname, credentials, or PHP binary.
5. Transfer code and files
Restore the codebase first, then copy public files, private files, and any additional directories required by custom code. Drush aliases can support drush rsync for remote file synchronization. For large trees, SSH-based synchronization is generally more dependable than uploading many files through a browser because it can preserve directory structure and resume or verify transfers.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Keep track of everything from attendance to test scores
- Spiral bound
- Measures 8-1/2" x 11"
Check paths after the copy
- Confirm that the document root points to the intended Drupal web directory.
- Confirm that the public-files path in configuration matches the directory you copied.
- Confirm that the private-files path exists and is outside unintended public access.
- Preserve ownership and permissions expected by the web server and deployment user.
- Check SELinux, AppArmor, container volume, or filesystem policies if PHP can see a directory but cannot write to it.
6. Update settings.php for the new environment
Edit the destination copy of settings.php; do not overwrite it with a file that still contains the old server’s credentials or paths. The $databases definition must use the destination database name, host, username, password, port, and driver. If the database is on a separate service, the host may not be localhost.
Also verify the following settings:
$settings['hash_salt']: retain the site’s intended secret rather than casually generating a different value during a move; changing it can invalidate security-sensitive values.- Trusted host patterns: include the temporary test hostname and final domain as appropriate, without allowing arbitrary host headers.
- File paths: point public and private files to the restored directories on the destination.
- Environment overrides: update reverse-proxy, HTTPS, cache, configuration-split, and service-specific settings that differ between servers.
Keep credentials in a protected settings include or secret-management system rather than a public repository. A typical database block contains the keys database, username, password, host, port, and driver; preserve the syntax used by your Drupal version and database driver.
Changing domains safely
If the move also changes the domain, review environment-specific URLs, redirect rules, webhook endpoints, and serialized data. Do not perform a blind SQL search-and-replace across every table: serialized values can be corrupted when string lengths change, and URLs may appear in configuration or content with different escaping. Use Drupal-aware procedures for URL updates and then test representative content, redirects, and integrations.
7. Import the database
Create the destination database as an empty database before importing. Confirm that the destination user has the privileges required by Drupal, then import through SSH or a native client.
Drush import
With the destination code and settings in place, either of these Drush forms can feed the dump to the database client:
drush sql:cli < backup.sqldrush sqlc < backup.sqlUse the command supported by the installed Drush version. If Drush cannot connect, test the database host, port, credentials, firewall rules, and PHP database extension before retrying.
Native client import
The native mysql or psql client is appropriate when the database server is reachable over SSH or through host-provided tooling. For a large dump, avoid a browser upload that can time out or exceed an upload limit; use an SSH session or the hosting provider’s server-side import facility instead.
Verify the import
Check that the import completed without errors and that the destination contains expected tables, users, content, and configuration. Compare representative database counts with the source. If the final source dump was taken before a write freeze, do not import an earlier copy after allowing new writes; repeat the final dump and import.
8. Rebuild caches and correct permissions
After the database import and settings update, rebuild Drupal caches with the version-appropriate command:
drush crThen verify ownership and write permissions on public and private files directories. If cache rebuild fails, inspect the PHP error output and Drupal logs for an incorrect database connection, missing extension, unwritable files path, stale settings include, or an incompatible module.
9. Test the new site before changing DNS
Use a temporary hostname or a local hosts-file override so you can exercise the new server while public DNS still points to the old one. Test as both an anonymous visitor and an authenticated administrator.
Page and account checks
- Open representative anonymous pages and confirm clean URLs, redirects, and HTTPS behavior.
- Log in, visit administrative pages, edit content, upload a file, and submit forms.
- Search for known content and compare results with the source.
- Open original images and newly generated image styles.
- Download private files through the intended access-control path and verify that guessing a public URL does not expose them.
Operational and integration checks
- Run cron and confirm that queues advance instead of accumulating.
- Send test mail and inspect delivery logs.
- Exercise payment, webhook, API, and external-service integrations in their safe test mode where available.
- Check redirects, canonical URLs, robots behavior, certificates, and mixed-content warnings.
- Review PHP, web-server, database, and Drupal logs while performing the tests.
Compare representative content and database counts between old and new environments. A successful homepage response is not evidence that uploads, private files, cron, or integrations work.
10. Cut over DNS and monitor the result
- Put the old site in maintenance or read-only mode for the final capture, if possible.
- Take the final SQL dump and repeat any file synchronization needed for uploads created since the earlier backup.
- Import the final dump, rebuild caches, and run the highest-risk smoke tests again.
- Point the relevant DNS records to the new server.
- Watch access logs, error logs, queue activity, mail, and integration callbacks as traffic moves.
- Keep the old server, exact backups, and rollback notes until traffic and functional tests remain clean for a period appropriate to your site.
If new writes reached the old site during cutover, stop accepting additional writes, create another final dump, import it, and repeat the affected tests. Do not merge two databases by manually copying a few tables unless you have a Drupal-aware, application-specific plan.
Common failure modes and fixes
The site shows a database connection error
Recheck the destination database name, host, port, username, password, and driver in settings.php. Confirm that the database user can connect from the web server and that network rules permit the connection. Verify that the PHP extension for the selected database engine is installed.
Best Value
- Used Book in Good Condition
Images are missing or uploads fail
Confirm that the complete public-files directory was copied, that the configured path matches its destination, and that the web-server account can read and write where Drupal requires it. Rebuild caches and image styles after correcting ownership or paths.
Private files are exposed or inaccessible
Check the private-files setting, web-server deny rules, and filesystem permissions. Private files should not be reachable through an unintended static URL. Test both an authorized download and an unauthorized request.
Trusted-host or redirect errors appear
Add the temporary test hostname and final hostname to the intended trusted-host patterns, then review reverse-proxy and HTTPS settings. Remove temporary hostnames before declaring the migration complete if they are not part of the production environment.
Drush archive commands do not work
Run the command documented for the installed Drush release. Drush 14 documents archive:dump; archive-restore instructions from older releases do not automatically apply to Drush 13 and later Composer workflows. Fall back to separate code, file, and SQL backups when archive support is unavailable.
The destination works but cron, queues, or mail do not
Recreate scheduled jobs with the destination paths and PHP binary, confirm queue workers can reach the database, and update mail credentials or relay restrictions. Inspect logs while triggering each job manually.
When shell access is unavailable
The Backup and Migrate module provides an administrator-oriented alternative for backing up and restoring databases and files, with Drush integration where available. It can simplify a control-panel-only move, but the same safeguards still apply: protect the backup, verify PHP and database compatibility, restore private files, test through a temporary hostname, and retain a rollback copy.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →For a large site, ask the host for server-side SQL import and file-transfer options rather than uploading a multi-gigabyte dump through a browser. If you cannot safely edit DNS, database permissions, or web-server access rules, a managed Drupal migration service or an experienced administrator can reduce the risk of an extended outage.
Quick Recap
Final migration checklist
- Drupal, Drush, PHP, database, Composer, paths, cron, mail, and DNS details recorded.
- Source writes frozen for the final dump.
- SQL dump, repository state, lock file, public files, private files, settings, and secrets backed up.
- Backups protected outside the web root, with an off-server copy and checksums.
- Compatible destination stack, database, user, document root, extensions, and writable directories prepared.
- Code rebuilt from the repository and dependencies installed.
settings.phpupdated for database, hash salt, trusted hosts, files, and environment settings.- Database imported and verified; caches rebuilt with
drush cr. - Anonymous, authenticated, administrative, upload, private-file, cron, queue, mail, integration, HTTPS, and log tests passed.
- DNS changed only after testing, with the old server and verified backups retained for rollback.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
