Drupal Essential Contributed Modules — Admin Toolbar, Devel, CTools, Token and More

In this tutorial, you'll learn about the essential contributed modules every Drupal site needs — from Admin Toolbar and Devel for development to Token, Pathauto, Metatag, and security modules that form the foundation of a professional Drupal site.

What You'll Learn

• Which modules are considered essential for every Drupal site
• How Admin Toolbar improves administrative navigation
• Using Devel module for debugging and development
• Leveraging Token for dynamic placeholder replacement
• Security modules: Honeypot, CAPTCHA, and Security Kit

Why It Matters

Drupal core is powerful, but it is intentionally minimal. The contributed module ecosystem is where Drupal gains its superpowers. Knowing which modules to install on every project saves you weeks of development time. These modules are battle-tested by millions of sites, have active maintainers, and solve problems that almost every Drupal site encounters. Installing the right foundation of contributed modules at the start of a project prevents architectural problems later.

Real-World Use

A developer starts every Drupal project with a standard set of modules: Admin Toolbar for navigation, Devel for debugging during development, Token and Pathauto for URL management, Metatag for SEO, and Honeypot for spam protection. This foundation handles 80% of common site needs. When the client requests a contact form, the developer adds Webform. When they need a photo gallery, they add a media-related module. Each module is added intentionally, not by default.

Learning Path

flowchart LR
  A[Module Management] --> B[Essential Modules]
  B --> C[Caching]
  C --> D[SEO]
  D --> E[Multilingual]
  E --> F[User Roles]
  F --> G[User Management]

Admin Toolbar

Admin Toolbar replaces Drupal's default admin navigation with a drop-down menu system that shows the full admin hierarchy.

composer require drupal/admin_toolbar
drush en admin_toolbar

Features:

The toolbar shows nested menu items in a drop-down. You can hover or click to reveal submenus without navigating to a new page. The toolbar trail highlights your current location in the admin hierarchy. It adds a "Rebuild cache" shortcut to clear caches quickly.

Admin Toolbar Extra

A sub-module that adds additional links to the toolbar:

drush en admin_toolbar_tools

This adds links to commonly accessed pages like "Add content," "Find content," and "Add user" directly in the toolbar.

Devel

Devel is the essential development module. It provides debugging tools for developers.

composer require drupal/devel
drush en devel

Key Features

Kint integration — the kint() function outputs structured variable dumps with expand/collapse:

<?php
// In any PHP code:
kint($node);
kint($variables);

// In Twig:
{{ kint(node) }}

DPM function — outputs messages to Drupal's message area:

<?php
dpm($node);
dpm($node->title->value);

Web profiler — adds a debug toolbar at the bottom of pages showing:

• Execution time and memory usage
• Database queries executed
• Twig template rendering information
• PHP version and extensions
• Route and controller information

Generate content — creates sample content for testing. Useful for populating a development site:

# Generate 50 nodes of type article:
drush devel-generate-content 50 --types=article

CTools (Chaos Tools)

CTools provides a collection of APIs and tools used by many other contributed modules.

composer require drupal/ctools
drush en ctools

CTools provides:

• Plugin system enhancements — tools for managing plugins, exportables, and form wizards
• Modal dialog API — AJAX modal forms without writing custom JavaScript
• Context system — defining and passing context objects between plugins
• Form wizard API — multi-step form creation

Most developers do not interact with CTools directly. Instead, they install modules that depend on CTools, such as Page Manager, Panels, and various Layout Builder plugins.

Token

Token provides a placeholder system for dynamic content replacement.

composer require drupal/token
drush en token

Tokens are used everywhere in Drupal: Pathauto patterns, Metatag configuration, email handlers, and custom modules.

# Token examples:
[node:title]                    → "Hello World"
[node:author]                   → "admin"
[node:created:short]            → "06/27/2026"
[site:name]                     → "My Drupal Site"
[site:url]                      → "https://example.com"
[user:display-name]             → "John Doe"
[term:name]                     → "Technology"
[webform_submission:values:email] → "user@example.com"

The Token module provides a token browser UI:

1. Go to Structure > Token browser
2. Browse available tokens by entity type
3. Click a token to copy it

{# Using tokens in Twig via twig_tweak: #}
{{ drupal_token('site:name') }}
{{ drupal_token('node:title', {'node': node}) }}

Pathauto

Pathauto automatically generates URL aliases based on token patterns. It is covered in detail in the URL Aliases tutorial but is essential enough to list here.

composer require drupal/pathauto
drush en pathauto

Metatag

Metatag adds meta tag management for SEO.

composer require drupal/metatag
drush en metatag

Features:

• Global default meta tags (title, description, abstract)
• Per-content type meta tag templates
• Per-entity meta tag overrides
• Open Graph tags for Facebook sharing
• Twitter Cards for Twitter sharing
• Schema.org metatag integration

# Example metatag configuration:
title: '[node:title] | [site:name]'
description: '[node:summary]'
og_title: '[node:title]'
og_description: '[node:summary]'
og_image: '[node:field_image:entity:url]'
twitter_cards_type: summary_large_image
twitter_cards_title: '[node:title]'

XML Sitemap

Generates XML sitemaps for search engines.

composer require drupal/xmlsitemap
drush en xmlsitemap

Configuration:

1. Go to Configuration > Search and metadata > XML Sitemap
2. Set default inclusion per content type
3. Configure priority and changefreq
4. Link types included (node, taxonomy, users)

# Regenerate sitemap:
drush xmlsitemap:regenerate

Redirect

Manages URL redirects. Essential companion to Pathauto.

composer require drupal/redirect
drush en redirect

Features:

• Manual redirect creation
• Automatic redirect on alias change (when used with Pathauto)
• Import/export redirects as CSV
• 301/302 status code selection
• Redirect frequency tracking

Security Modules

Honeypot

Adds anti-spam protection without user interaction.

composer require drupal/honeypot
drush en honeypot

Honeypot adds a hidden form field that bots fill in but humans do not. If the field has a value, the submission is silently discarded.

Configuration:

1. Go to Configuration > Content authoring > Honeypot
2. Select which forms to protect
3. Configure time limit (forms submitted too quickly are rejected)

CAPTCHA and reCAPTCHA

Adds challenge-response tests.

composer require drupal/captcha drupal/recaptcha
drush en captcha recaptcha

Configuration:

1. Go to Configuration > People > CAPTCHA
2. Select which forms use CAPTCHA
3. Configure reCAPTCHA site key and secret key from Google

Google Analytics

Adds Google Analytics tracking.

composer require drupal/google_analytics
drush en google_analytics

Configuration:

1. Go to Configuration > Web Services > Google Analytics
2. Enter your UA number or GA4 measurement ID
3. Configure tracking scope (all users, authenticated only)
4. Exclude specific roles or paths

Module Weight

Controls the execution order of modules.

composer require drupal/module_weight
drush en module_weight

Useful when two modules conflict and you need to control which one runs first.

Coffee

Quick admin navigation tool inspired by the Mac Spotlight.

composer require drupal/coffee
drush en coffee

Press Ctrl+K or Cmd+K to open a search box. Start typing the name of a page, content type, or configuration page, and navigate directly without clicking through menus.

Module Filter

Improves the Extend page with a filter input.

composer require drupal/module_filter
drush en module_filter

Adds a text filter to the module list page. As you type, modules are filtered in real time. Saves time when managing dozens of modules.

Common Mistakes

1. Installing every module in this list on every site: Not every site needs all modules. Install only what your project actually requires. Every module adds maintenance overhead.

2. Not checking module dependencies before installing: Some modules depend on specific PHP extensions or Drupal versions. Always check requirements on the project page.

3. Ignoring security advisories for contributed modules: Subscribe to the Drupal security newsletter. When a security advisory is published for a module you use, update immediately.

4. Using Devel on production: The Devel module exposes debugging information and should never be enabled on production sites. Remove it or disable it before going live.

5. Not testing module combinations: Some modules conflict with each other. Always test new modules on a staging environment, especially when adding modules that alter forms or content rendering.

Practice Questions

1. What are five contributed modules you would install on every Drupal project, and what problem does each solve?

2. Why should the Devel module never be enabled on a production site?

3. How does the Token module work with other modules like Pathauto and Metatag?

4. Challenge: Create a module selection Strategy for a new Drupal project — a community job board. List the essential modules you would install, the modules specific to the job board functionality, and the security modules needed. Explain your reasoning for each module and describe how you would test that they work together without conflicts.

FAQ

Mini Project

Goal: Install and configure the essential module stack.

1. Install via Composer: Admin Toolbar, Devel, Token, Pathauto, Metatag, Honeypot
2. Enable all modules via Drush
3. Configure Admin Toolbar and verify the improved navigation
4. Use kint() in a preprocess function and observe the debug output
5. Browse the Token browser to see available tokens
6. Configure a Pathauto pattern using tokens
7. Set up global Metatag defaults with token-based titles
8. Enable Honeypot on the contact form
9. Disable Devel (simulating production readiness) with drush pmu devel

What's Next

Now that you know the essential modules, proceed to Drupal caching to learn how to optimize site performance. After that, explore Drupal SEO to rank your site in search engines.