Last updated September 8, 2015. Created on March 22, 2012.
Edited by David_Rothstein, hansfn, Steve -cc, NewSites. Log in to edit this page.

These instructions are for updating - not upgrading. Documentation for upgrading an existing Drupal site (for example, changing from Drupal 6 to Drupal 7) is at

These instructions show how to update Drupal core to a new minor version within the same major release series (for example, Drupal 7.1 to 7.2). These instructions are a simplified version of the corresponding information in the Administration & Security Guide. If you are not intimidated by the more complex instructions there, you may find it to be a better source of information for this procedure. In addition there are alternative procedures for people that use a shell:

Follow these instructions:

  1. Make a backup of your Drupal instance (database). (For ex: with MySQL)
  2. Download the latest release of your current Drupal version.
  3. Extract the [tar ball or zip] Drupal package.
  4. Set your site on maintenance mode (For ex: How on D7)
  5. Delete all the files & folders inside your original Drupal instance except for /sites and its sub-folders. This assumes that all of your custom work - including themes - is in the recommended spot - the /sites folder tree. If you have made custom changes elsewhere you will need to either preserve them or plan to replace them later.
  6. Copy all the folders and files except /sites from inside the extracted Drupal package [tar ball or zip package] into your original Drupal instance location.
  7. Some updates do not include changes to setting.php and some do. See There is a way - Comment below for more on this. If the update release includes changes to settings.php you will need to replace your old settings.php in .../sites/default/ with the new one, and then edit the site-specific entries (eg database name, user, and password) in the setting file.
  8. If you have modified files such as .htaccess or robots.txt re-apply those changes to the new files.
  9. If you have a favicon.ico file that was deleted replace it too
  10. Login to your site as administrator or as user no 1
  11. Run update.php by navigating to http://...yourdrupalsitename/update.php and follow the process to update your Drupal instance
  12. Disable maintenance mode


  • If you experience problems during your site upgrade, see the Troubleshooting FAQ.
  • Instead of commenting here, please read the module project page and, if necessary, post an issue or post a message in the forums.

Looking for support? Visit the forums, or join #drupal-support in IRC.


peterohman’s picture

I suggest you modify the step 5 to: create a new directory in the root with the name drupal-old, and move all the files & folders inside your original Drupal instance except for /sites folder and any custom files you added elsewhere into it. Then add a step 13: When you have checked that the updated version works as expected, you can delete the directory drupal-old. Otherwise you can probably find the files you should have kept in this directory, and move them into the updated core...

augustofagioli’s picture

I don't like the idea of deleting my websites (even part of).

Once backup, download are ready, what I usually do is :

tar -zxvf drupal_LATEST.tar.gz
mv my_drupal_webiste_root   my_drupal_webiste_root_PREV
mv mv drupal_LATEST  my_drupal_webiste_root
cp -Rfv my_drupal_webiste_root_PREV/sites my_drupal_webiste_root/

Following this approach, I can quickly recover to PREV with an easy

mv my_drupal_webiste_root   my_drupal_webiste_root_BROKEN
mv my_drupal_webiste_root_PREV  my_drupal_webiste_root
JakeRogers’s picture

Here's a line from a typical upgrade.txt file for a minor update... "4. Download the latest Drupal 7.x release from to a directory outside of your web root. Extract the archive and copy the files into your Drupal directory."

Note that it does NOT "except the Sites" folder (as so stated in above instructions), which means your existing Sites folder will be overwritten...another major Drupal SNAFU.


VM’s picture

Based on the following of all of step #3 in the core upgrade.txt file, overwriting the old sites folder with a new sites folder isn't an issue.

Changes in the 'new' settings.php generated in step three would overwrite the old.

The point to not removing the old sites folder is to avoid losing or copying back and forth important files/folders specific to the install e.g., the files folder.

JakeRogers’s picture

"overwriting Sites is not an issue" ??? It's an issue if it's overwritten with the generic one contained in the minor update. That's my whole point...IF one follows instructions contained within upgrade.txt, rather than those above, then they're site is screwed.


VM’s picture

I understood your point the first time and its reiteration continues to be incorrect. Overwriting the /sites/ folder in a D7 minor update is NOT an issue and no site is "screwed" by following either method.

I will try and explain once more: In an update /sites/ is empty except for a default.settings.php file located in the /sites/default folder. It's the only file that can be 'overwritten' which isn't an issue as the file is not utilized by core except during an installation. All other files/folders contained within the previous /sites/ folder are left in place. This includes the settings.php file, all modules, themes and all other assets contained default files folder. This holds true whether those modules/themes/assets are placed in sites/all or sites/default. Thus, no harm, no foul and therefore, no issue.

JakeRogers’s picture

Thanks for that explanation...I was under the impression that Sites would be overwritten, in its entirety, if included in the copy over. I guess the exclusion of Sites in 5 and 6 above are simply an extra precaution. Thanks...


VM’s picture

step 5 ensures that any files that may have been removed in an update are not left on the server (which rarely/if ever occurs in a drupal core update.

MarkGoldfain’s picture

This guide is pretty clear and straightforward.
Except I find step 7 to be vague:
" If the update release includes changes to settings.php replace old
settings.php in .../sites/default/ with the new one, and edit site-specific
entries (eg database name, user, and password) "
It would be nice to have a description of precisely how to determine if the
update release includes changes to settings.php.

Chasen’s picture

If you view the release notes for the new Drupal version as they are released there is a statement about whether the .htaccess, robots.txt, settings.php, etc. files have been changed.

For example, see here: for the statement "No changes have been made to the .htaccess, web.config, robots.txt or default settings.php files in this release, so upgrading custom versions of those files is not necessary."

EDIT: For anyone wondering, you can view the release notes from the download page of any module/etc (eg by clicking the Notes link to the right of the download links. It's good practice to do this for all major (and potentially minor) updates as developers often put messages there about upgrade paths, major changes, potential issues, etc.

drupalnewie @berfi’s picture

Here is a small difference:

doomed’s picture

Besides reading the notes as someone else pointed, a simple file comparison is what i usually do. You can use BeyondCompare or similar software.

From my experience, the differences had been always minimal. Changes to comments and stuff like that. Sometimes they add stuff, but its all new optional stuff. Even if you miss it, i doubt your website will break.

STLStrategies’s picture

I actually stumbled upon an easier way to perform a minor update on drupal core by using my Host's Cpanel. I use Webhostinghub and they have update messages for drupal. It is really simple, on Cpanel, the update message takes you to a page with all of your drupal installations that require an update. For each one you just click the "update" button that looks like a refresh icon and it takes you to an update page. Just check the backup and start the process. After it updates, log in as an admin on your drupal site and go to configurations. At the top a message will say there is a problem with the drupal installation. Just select the status report and update the database. You should be completely done with the update procedure and clear out your security warning messages. I've only tried this on my Host's Cpanel, but Im sure the Cpanel is similar across other Hosts.

VM’s picture

CPanel updates tend to lag behind the releases of drupal core. As such, in situations involving a security update, waiting for cpanel to update their hosted updates can prove fatal. Also of note make sure to follow best practices and backup the database and file system to insure that a 3rd party update doesn't bork your installation or remove features your site is dependent on. There are many negative stories that can found via google regarding updating via hosted scripts.