Drupal Module Management — Installing, Updating and Uninstalling Modules

In this tutorial, you'll learn how to manage Drupal modules — from finding and installing contributed modules via Composer to updating, maintaining, and cleanly uninstalling them for a secure and performant site.

What You'll Learn

• The difference between core, contributed, and custom modules
• Finding and evaluating modules on Drupal.org
• Installing modules via the admin interface and Composer
• Managing module dependencies and updates
• Uninstalling modules cleanly without leaving database artifacts

Why It Matters

Modules extend Drupal's capabilities, but each module you add introduces dependencies, database tables, configuration, and potential security risks. Managing modules well means knowing what to install, how to keep it updated, and how to remove it cleanly when you no longer need it. Poor module management leads to orphaned database tables, security vulnerabilities from outdated modules, and conflicts between incompatible versions. This is one of the most important operational skills for any Drupal site owner.

Real-World Use

A Drupal agency manages 50 client sites. They maintain a policy of auditing contributed modules quarterly. When a security advisory is released for the Webform module, they update across all sites using Composer, run database updates, and test the fix in staging before deploying. If a module becomes unmaintained, they research alternatives, plan migration, and uninstall the old module completely — removing its database tables and configuration to avoid Technical Debt.

Learning Path

flowchart LR
  A[Asset Libraries] --> B[Module Management]
  B --> C[Essential Modules]
  C --> D[Caching]
  D --> E[SEO]
  E --> F[Multilingual]
  F --> G[User Roles & Permissions]

What Are Modules?

A module is a collection of PHP files, configuration, and template files that extend Drupal's functionality. Modules can add content types, modify behavior through hooks, provide API endpoints, integrate third-party services, and much more.

Core Modules

Drupal core ships with about 50 modules. Some are enabled by default (Node, User, System, Field), while others are available but optional (Contact, PHP filter, Update Manager, BigPipe).

Contributed Modules

Contributed modules are developed by the community and distributed on Drupal.org. There are over 50,000 contributed modules. Popular ones include Webform, Pathauto, Token, and Admin Toolbar.

Custom Modules

Custom modules are built for specific project needs. They live in modules/custom/ and are not distributed on Drupal.org.

Finding Modules

Drupal.org has a comprehensive module directory with search filters, usage statistics, and maintainer information.

Evaluating a Module

Before installing a module, evaluate these factors:

Usage stats — modules with 100,000+ installations are battle-tested. Modules with fewer than 1,000 installations may be risky.

Maintenance status — check the "Maintenance status" on the project page. "Actively maintained" is ideal. "Seeking new maintainer" means the module may become unsupported.

Release recency — modules with releases within the past 6 months are actively developed. Modules with no releases in 2+ years may be abandoned.

Security coverage — check if the project has a "Security advisory" section. Modules covered by the Drupal Security Team receive security advisories.

Drupal version — ensure the module supports your Drupal version (10 or 11).

Dependencies — check what other modules this module requires. Complex dependency chains increase maintenance burden.

Popular Module Categories

• Administration — Admin Toolbar, Module Filter, Coffee, Adminimal
• Development — Devel, Devel PHP, Twig Tweak, Drush
• Content — Paragraphs, Entity Reference Revisions, Inline Entity Form
• SEO — Metatag, XML Sitemap, Redirect, Pathauto
• Security — Honeypot, CAPTCHA, reCAPTCHA, Security Kit
• Performance — Advanced CSS/JS Aggregation, Internal Dynamic Cache
• Integration — Google Analytics, Mail System, SMTP

Installing via Admin Interface

The admin install method is suitable for beginners and development sites:

1. Go to Extend > Install new module
2. Enter the Drupal.org project URL or upload a .tar.gz file
3. Click "Install"

# Limitations of admin install:
# - Requires the Update Manager module
# - Does not handle dependencies automatically
# - Not recommended for production sites

Installing via Composer

Composer is the recommended method for production sites.

# Search for a module:
composer search drupal/devel

# Install a module:
composer require drupal/devel

# Install a specific version:
composer require drupal/devel:^5.0

# Install multiple modules at once:
composer require \
  drupal/devel \
  drupal/admin_toolbar \
  drupal/webform \
  drupal/pathauto

# Install a module with a specific version constraint:
composer require drupal/webform:"^6.0 || ^7.0"

How Composer Handles Dependencies

When you install a module via Composer, it automatically resolves and installs dependencies:

# Installing Pathauto also installs its dependency Token:
composer require drupal/pathauto
# Output:
# - Installing drupal/token (1.x)
# - Installing drupal/pathauto (1.x)

Enabling Modules

After installation, you must enable the module.

# Enable via Drush:
drush en devel
drush en admin_toolbar pathauto token
drush en webform webform_ui

# Enable a module and its dependencies:
drush en webform --resolve-dependencies

Admin Interface

1. Go to Extend
2. Check the box next to each module
3. Click "Install" at the bottom
4. Drupal automatically enables required dependencies

Module Types in Drupal

Modules can be installed in three locations:

• core/modules/ — core modules (do not modify)
• modules/contrib/ — contributed modules (managed by Composer)
• modules/custom/ — custom modules (version-controlled by you)

# Check module locations:
ls core/modules/
ls modules/contrib/
ls modules/custom/

Updating Modules

Regular updates are critical for security and compatibility.

Via Composer

# Check for outdated modules:
composer outdated drupal/*
composer outdated | grep drupal

# Update a specific module:
composer update drupal/webform --with-dependencies

# Update all modules:
composer update drupal/*

Run Database Updates

After updating module code, run database updates:

drush updatedb
# or
# Browse to /update.php

Via Admin UI

1. Go to Reports > Available updates
2. Review available updates
3. Click "Update" for each module
4. Run database updates after

Module Dependencies

Modules declare their dependencies in the .info.yml file:

# module.info.yml
name: 'My Module'
type: module
core_version_requirement: ^10 || ^11
dependencies:
  - drupal:node
  - drupal:user
  - drupal:views
  - token:token
  - pathauto:pathauto

Drupal enforces these dependencies when enabling:

• If module A depends on module B, enabling A automatically enables B
• If you try to disable B while A is enabled, Drupal blocks the operation
• If you uninstall A, modules that depend on A must be uninstalled first

Uninstalling Modules

Uninstalling removes database tables, configuration, and permissions that the module created.

Via Admin

1. Go to Extend > Uninstall tab
2. Check the modules to uninstall
3. Click "Uninstall"

Via Drush

# Uninstall a module:
drush pmu devel

# List modules that can be uninstalled:
drush pm-list --type=module --status=not-installed

# Uninstall multiple:
drush pmu webform webform_ui pathauto

Clean Uninstall Process

A clean uninstall involves several steps:

1. Disable the module with drush pmu
2. Remove configuration that depended on the module:

   drush config:delete webform.settings
   

3. Remove orphaned database tables if any remain
4. Remove the module files via Composer:

   composer remove drupal/devel
   

5. Clear caches:

   drush cr
   

Common Mistakes

1. Installing modules via admin on production: The admin install method does not handle dependencies and can break Composer-based workflows. Always use Composer on production.

2. Not running database updates after module updates: Module code updates often require database schema changes. Running drush updatedb after every module update is essential.

3. Uninstalling without removing files: Using drush pmu removes the module from the database but leaves files in place. Use composer remove to clean up files.

4. Installing too many modules: Each module adds maintenance burden, security surface area, and potential performance impact. Audit your module list regularly and remove unused modules.

5. Ignoring security advisories: The Drupal Security Team publishes advisories for contributed modules. Subscribe to security announcements and update affected modules promptly.

Practice Questions

1. What is the difference between installing a module via the admin interface versus via Composer, and why is Composer preferred for production?

2. What steps must you take after updating a module via Composer to ensure the site continues working correctly?

3. How do you cleanly uninstall a module so that no database artifacts remain?

4. Challenge: Create a module management policy for a production Drupal site. Define the process for evaluating a new module, the steps for installing it safely on production, the cadence for checking updates, the procedure for applying security updates, and the criteria for removing an unused module. Include what to document at each stage.

FAQ

Mini Project

Goal: Install, configure, and uninstall a module workflow.

1. Install three modules via Composer: Admin Toolbar, Pathauto, and Token
2. Enable all three modules via Drush
3. Check the Extend page to confirm they are active
4. Use the Admin Toolbar to navigate to Pathauto settings
5. Configure a simple URL pattern
6. Update the Token module to the latest version via Composer
7. Run database updates with drush updatedb
8. Uninstall Pathauto using drush pmu pathauto
9. Remove Pathauto files using composer remove drupal/pathauto
10. Verify the Extend page no longer shows Pathauto

What's Next

Now that you understand module management, proceed to essential contributed modules every Drupal site should have. After that, explore Drupal caching for performance optimization.