Extending Drupal: How to install and manage modules

Tailored functionality: why modules matter in Drupal

Drupal is a powerful content management system by default, but its real flexibility comes from modules. With Drupal modules you can add SEO tools, contact forms, redirects, media management, security features, multilingual functions, APIs, shop functions, editorial workflows and many other features.

A module is additional code that extends, changes or adds functionality to Drupal. In everyday Drupal administration, you will mainly work with core modules, which are shipped with Drupal, contributed modules from the Drupal community and, in larger projects, custom modules developed specifically for one website or application.

Before installation: choosing the right Drupal module

Not every module that looks useful is a good choice for a production website. A poorly maintained or insecure module can affect stability, security and performance. Before installing any Drupal extension, check the following points carefully:

• Compatibility: Does the module support your Drupal version, for example Drupal 10 or Drupal 11?
• Maintenance status: Is the project actively maintained or has it been inactive for a long time?
• Security coverage: Is the module covered by the Drupal Security Team?
• Usage and community: Are there active installations, documentation and recent issue activity?
• Dependencies: Does the module require additional modules or PHP libraries?
• Purpose: Does it solve a real requirement or does it only add unnecessary complexity?

For SEO and AI-search-optimized websites, modules such as Metatag, Pathauto, Redirect, XML Sitemap or structured-data modules can be useful. Still, install only what you really need. Fewer modules usually mean less maintenance, a smaller attack surface and a cleaner administration experience.

Method 1: installing Drupal modules with Composer

Composer is the package manager for PHP and is standard in modern Drupal projects. Its main advantage is that it not only downloads the requested module but also handles required dependencies. This makes Composer the preferred method for professional Drupal sites, agency projects and production websites hosted with CURIAWEB.

Step-by-step with Composer

1. Connect to your hosting account or server via SSH.
2. Change to the main directory of your Drupal installation. Depending on the setup, Drupal may be located in public_html, web or docroot.
3. Find the module on drupal.org and copy the Composer command from the project page.
4. Run the command, for example:

composer require drupal/pathauto

After this step, the module code is part of the project, but the module still needs to be enabled. Composer usually adds the extension to composer.json and downloads the files to the correct module directory.

Enable the module after installation

You can enable a module either in the Drupal admin area or with Drush:

drush en pathauto -y

Alternatively, log in as an administrator, open Extend, search for the module, tick the checkbox and click Install. If Drupal detects additional dependencies, it will ask you to confirm them.

Method 2: installation through the Drupal admin interface

Some Drupal installations allow modules to be uploaded or installed from a URL through the admin interface. This is convenient for simple modules. For modules with several dependencies or required libraries, Composer is usually the safer and more reliable option.

1. Download the module from drupal.org as a .tar.gz or .zip archive, or copy the download URL.
2. Log in to Drupal with an administrator account.
3. Open Extend.
4. If available, choose Install new module or Add new module.
5. Paste the URL or upload the archive.
6. Install the module and then enable it under Extend.

Configure modules and review permissions

Enabling a module does not always mean it is fully configured. Many modules add their own configuration pages, which may appear under Configuration, Structure, Content, Reports or in the module description under Extend.

Always review permissions after enabling a module. New modules often add new permissions under People > Permissions. Apply the least-privilege principle: editors, shop managers and external providers should only receive access to the functions they actually need.

Updating modules

Keeping modules up to date is essential for Drupal security. Outdated extensions can create vulnerabilities, compatibility problems or functional errors. Check available updates regularly under Reports > Available updates.

For Composer-based installations, update a single module for example with:

composer update drupal/pathauto --with-dependencies

After updates, check whether database updates are required and clear the cache:

drush updb -y
drush cr

Uninstalling and removing modules properly

Do not simply delete a module from the file system. Drupal stores configuration and database information for enabled modules. Remove modules in a clean sequence:

1. Check whether the module is still used.
2. Go to Extend > Uninstall.
3. Select the module and confirm the uninstall process.
4. Then remove the package with Composer:

composer remove drupal/pathauto

Depending on the module, uninstalling may remove configuration or data. Create a backup first, especially for modules related to fields, forms, SEO metadata, redirects or media handling.

Best practices for a stable Drupal website

Storage, performance and hosting

Complex Drupal websites can grow quickly due to modules, media files, caches, Composer dependencies and backups. Make sure your hosting package provides enough resources. Regularly check disk space usage, PHP version, cron execution, database size and cache settings.

With suitable CURIAWEB hosting in Switzerland, Drupal websites benefit from a solid technical foundation, short loading times for Swiss visitors and an environment that is well suited for professional CMS projects.

FAQ: Drupal modules

Can I install Drupal modules without Composer?

Yes, in some cases. Manual or backend installation can work for simple modules. For modern Drupal projects, Composer is usually more reliable because it manages dependencies cleanly.

Why does an installed module not appear?

Common reasons include a wrong directory, an uncleared cache, an incompatible Drupal version or missing dependencies. Check the status report and clear the cache.

How many modules should a Drupal website use?

There is no fixed number. What matters is that every module has a clear purpose, is maintained and does not add unnecessary load. A lean installation is usually easier to secure and maintain.

Are all modules on drupal.org safe?

No. Many are excellent, but you should always check maintenance status, version compatibility and security coverage before using a module in production.

What should I do if a module breaks my website?

Enable maintenance mode if possible, check error messages, clear caches and restore a backup if necessary. In serious cases, a module may need to be disabled or uninstalled via Drush or database-level recovery. Proceed carefully or request technical support.