Docs / Getting started
From sign-up to your first findings in about 10 minutes. No credit card and nothing to install on your sites to begin.
Go to app.drubix.com/signup and enter your agency name, your email and a password of at least 10 characters. Then confirm your email address from the message we send you.
Working with colleagues? Invite them later from Account settings → Team.
On the dashboard, paste a site's address into Add a site to monitor. Drubix checks it within seconds. It looks only at what any visitor can see, so you don't need logins, passwords or a module to begin.
Have a lot of sites? Use Import from CSV, Pantheon or Acquia under the add-site box:
url, label, client name and client emails. Only url is required, and a header row is optional.Hosting credentials are used once to list your sites and are never stored. You see a preview, with duplicates and invalid addresses marked, before anything is added.
A new account is on the Free plan. It covers up to 2 sites, which are checked only when you click Scan now. To watch every site automatically, start the 14-day free trial from the dashboard. It takes one click and needs no card.
During the trial you get everything: daily checks, instant alerts, client reports, uptime and SSL monitoring, and fix PRs. If you don't subscribe, the account moves back to Free and keeps your sites and history. Prices and billing are explained in Plans & billing.
Each problem Drubix spots is a finding. Every finding shows:
composer require drupal/webform:^6.2.12. With GitHub connected, you can click Create fix PR instead.What "info" means: Drubix saw the module but couldn't read its exact version from outside the site, so it can't yet say whether that version is affected. It's a nudge to get exact results (step 5), not a confirmed problem.
A finding closes by itself once a later check shows the site no longer has the problem. That happens after the fix is deployed, not when a pull request is opened or merged. The remediation guide explains how to fix each type of finding.
From the outside, Drubix can read the Drupal core version and which modules are installed, but not the exact version of each module. There are two ways to get it, and you can use both:
| Option | What you do | What you get |
|---|---|---|
| Connect GitHub | Point Drubix at the site's repository. Nothing to install. | Exact module versions from composer.lock, plus one-click fix PRs |
| Connector module | Install a small Drupal module and paste one key. | Exact versions, PHP version, config drift, and a permissions and security-settings audit |
Open Account settings → Alerts & notifications and add where alerts should go. Each destination has its own minimum severity, and Test sends a sample alert.
On the same page you can set a daily digest time, a monthly summary, and escalation, which emails the account owner when a critical issue stays unfixed for a set number of days. Every alert has Acknowledge and Snooze 7 days links. In the dashboard, a finding's Triage menu lets you assign it to a teammate or accept the risk, with a reason.
Add your logo, colour and agency name once in Account settings → Client report branding. Then click Client reports on a site and add the client's email addresses and a send day. Each month they get a short email and a PDF report in your branding, and replies come to you.
The same panel creates a client health page: a live, read-only link you can share. Issue titles stay hidden unless you choose to show them.
On the trial and paid plan, Drubix checks each site is up every 5 minutes and checks SSL certificates and domain renewals daily, so you hear before anything expires. Upgrade plan on a site shows when its Drupal and PHP versions stop getting security fixes, and which modules are ready for the next Drupal version.
composer.json to the version that fixes an advisory, and you review and merge it like any other PR.