Short answer: a current Drupal 11 site that is built entirely from code. Every change is deployed as a tested container image, and the site sits behind Cloudflare's network, so the server itself opens no web ports. It is bilingual from the first commit, consent-aware, and documented so that any Drupal engineer can run it without us. We build and run it with AI coding agents under rules that block, and a person reviews every change. What follows is each layer, what it is, and why it matters to you. The examples come from our own sites, which run this exact stack.
What is the site actually built on?
Drupal 11 core (11.4.11 on this site, as of 27 October 2026) plus a small set of well-known contributed modules from drupal.org:
- Metatag and Simple XML Sitemap for search;
- Pathauto and Redirect for clean, permanent addresses;
- COOKiES for consent;
- Honeypot, Antibot and ALTCHA against spam;
- two-factor authentication for staff;
- Symfony Mailer Lite, so contact forms really deliver.
Drupal Commerce appears only where a site sells something. Ours sells a paid consultation hour.
Why it matters to you: where a maintained module exists, we use it instead of writing our own. Fewer bespoke parts means less that only one person understands. Drupal 10 reaches end of life on 9 December 2026 and Drupal 12 is due the same week, so a site started today should start on 11.
How is it built, and why should I care?
Every site begins from our public starter, drupal-skeleton, and keeps merging it afterwards, the way a fork follows its upstream:
- Everything is in git. The site's code, its configuration (content types, fields, views, settings) and its own pages live in a git repository as files.
- Every push is tested. It runs the tests on a fresh install, audits the dependencies for known security advisories, and builds a container image.
- Deploying is one command. It pulls that image, applies the configuration, and checks that the home page really answers before calling it done.
- Rolling back is the previous image.
- Every week, a pull request brings in what the starter has fixed for all sites, already tested, and a security scan runs against the site.
Why it matters to you: the site does not live on someone's laptop or in one person's memory. A new environment can be stood up from the repository. A fix made once for every site reaches yours as a change you can read. A security release becomes a reviewed commit, not a weekend: on 26 October 2026 a PHP security hotfix went out this way.
Where does it run?
Our own sites run as two containers, Drupal and its MariaDB database, behind a router on one virtual private server. All the state lives in one data directory. The database and files are backed up every night, a copy is kept off the server, and restores are drilled. The first full drill, on 18 September 2026, loaded every dump into a clean database and matched the counts. We test restores because a test once caught a problem. On 20 August 2026, restoring a backup showed that the earlier dumps could not be restored. The page came back empty, with no error. We fixed the backup that day.
Why it matters to you: the image runs wherever Docker runs, so the hosting decision stays open. And a backup only counts if someone has restored it.
What does Cloudflare do in front of it?
Every site we run sits behind Cloudflare. All thirteen of our domains have been on it since 6 October 2026. In practice:
- DNS and certificates are managed there, HTTPS is enforced, and old TLS versions are refused.
- The server opens no web ports. A small connector on the server dials out to Cloudflare (Cloudflare Tunnel), so since 7 October 2026 nothing on the internet can reach our server's web stack directly. Only the administrators' SSH port stays open.
- Pages are served from Cloudflare's cache to anonymous visitors. Signed-in sessions, the admin pages, the cart and checkout always go to Drupal.
- When an editor saves a page, it leaves the cache within about a minute. A deploy clears only the pages whose HTML actually changed, then re-warms them.
- Your logs still show real visitors' addresses, not Cloudflare's.
Why it matters to you: a traffic spike hits the cache, not your server. The server is not exposed to the internet's scanning. And editors see their changes go live without anyone "clearing the cache".
Will people find it, in English and in Spanish?
Bilingual is the default, not an add-on. English is at / and Spanish at /es/, with each page translated, not mixed. The search plumbing is part of the build:
- titles and descriptions per page and per language;
- canonical addresses;
- link previews (Open Graph) in both locales;
- a sitemap that lists both languages and is named in robots.txt;
hreflanglinks that tell search engines which version is which.
We also let AI answer engines read the site. Today no AI crawler is blocked at the server or at Cloudflare.
Why it matters to you: none of this can be bolted on after launch without someone finding out it was missing. Usually that someone is Google.
What about privacy and cookie consent?
Analytics load only after a visitor accepts them. The cookie banner offers "deny all", and Google Tag Manager stays blocked until consent. Anonymous visitors get no session cookie at all, which is also what lets their pages be cached. The privacy policy sets out the rights a visitor has under Colombia's Ley 1581 de 2012 and how to complain to the Superintendencia de Industria y Comercio. Spam protection works without image puzzles. Staff sign in with two-factor authentication once its key is set on the server.
Why it matters to you: consent that is enforced in the code, not just shown in a banner, is the part a regulator would check.
Where does AI come in?
In two places. Neither is a gimmick.
How we build and run the site. We use Claude Code, Anthropic's coding agent, every day. It works under written project rules and under hooks that stop an unsafe command before it runs. One example: since 23 September 2026 a hook has refused a class of shell commands that had silently corrupted files. The written rule alone had not been enough. The agent's code goes through the same tests, audits and health checks as anyone's. A person reviews every change and decides every production deploy. Between 1 September and 27 October 2026, 128 of the 165 commits on this site's repository were co-written with Claude, and each says so. Our founder holds Anthropic's Claude Code certification.
What the site can carry. The concierge on our home page is an AI voice agent running inside Drupal. It uses elevenlabs_agent, a module our founder created and maintains on drupal.org. Its sessions are minted on the server, so no API key ever reaches a visitor's browser. Callbacks are signed and verified, and each call's cost is monitored. The module is in its 1.0 alpha series: published and actively maintained. An AI feature is optional, and nothing else in the stack depends on one.
Why it matters to you: you get an AI-built site with the controls of a carefully built one. The AI does the volume, and a person answers for the result.
What do I own at the end?
- The code and configuration, in a git repository.
- The content and files, in your database and your file directory.
- The container image.
- The documentation that says where each setting lives and how to deploy, in the repository next to the code.
Drupal is GPL software. Nothing we add locks the site to us. The accounts it depends on (the domain, Cloudflare, the code repository, the server) are opened in your name, and we work in them as invited members.
Why it matters to you: if you stop working with us, the site keeps working, and the next engineer starts from documents, not from a phone call.
What don't we promise?
Today the engineer is our founder, so support runs in business hours on Colombian time (UTC-5), with no 24/7 on-call. Migration and build prices come after an audit, because a quote that hasn't read your code is a guess. The one fixed price is an hour of the founder's time: USD 75.
To find out what your current site already has and what it lacks, write to us or ask the concierge on the home page.