Pricing
Every feature for every site. The number of sites is the only thing that changes your bill, and from 25 sites every site costs less. Try it free for 14 days, no card needed.
On-demand scans for up to 2 sites. No ongoing monitoring.
Full monitoring plus confirmed accuracy from the connector module.
Volume pricing
Like tax brackets: each band's price applies to the sites in that band, so every extra site costs less and adding a site never makes the whole bill jump.
| Sites in your account | Monthly plan per site | Yearly plan per site, per month |
|---|---|---|
| Sites 1–24 | $8 | $6.67 |
| Sites 25–99 | $6 | $5 |
| Sites 100+ | $4 | $3.33 |
Example: 30 sites cost 24 × $8 + 6 × $6 = $228 a month. 100 sites cost $646 a month. The yearly plan is billed once a year, with two months free compared with monthly.
Savings calculator
Checking every site for new Drupal advisories, working out which modules are affected and writing it up for clients takes time. Here's what that time is worth.
Estimate only: manual cost = sites × minutes per week × 52 ÷ 12 × hourly rate. Drubix cost uses the graduated price for your site count and the billing period selected above. Real savings also include the incidents you avoid, which this doesn't count.
They get a 30-day trial instead of 14, and you get a free month when they subscribe. Find your link in Account settings.
FAQ
A small Drupal module you optionally install on a monitored site. It reports your exact module versions, PHP version, and config drift on a schedule. That turns a "possible exposure" finding into a confirmed one, and enabling white-label reports and benchmarking.
No. The free plan works from a passive external scan alone, with no credentials and no module install. Findings become "confirmed" either with the connector module or by connecting the site's GitHub repository, which lets Drubix read exact versions from composer.lock with nothing to install. The connector adds config drift, PHP version and the permissions and hardening audit.
Email, Slack, Microsoft Teams, Discord and any HTTPS webhook, each with its own severity threshold. Every alert includes one-click Acknowledge and Snooze links, and there's a daily digest plus escalation when a critical issue stays unpatched.
Yes. Set a client's email addresses and a send day, and each month they receive a short email and a PDF in your branding, with replies coming to you. You can also give each client a live, read-only health page.
Yes. Monitored sites are checked every 5 minutes, and daily checks warn you before an SSL certificate or domain registration expires. Alerts go to the same channels as security findings.
Drupal 10 reaches end of life on 9 December 2026. The upgrade planner shows, per site, whether core and PHP are still supported and which contrib modules are ready for Drupal 11, with the version to move to.
Drupal 9, 10, and 11. The connector module targets Drupal 10/11 APIs; passive scanning works on any publicly reachable Drupal site regardless of version.
Yes, if you turn on Autopilot for a site. It opens the fix pull request, updates composer.lock, waits for your CI to pass and merges it. It only does this for patch-level updates (like 10.3.5 to 10.3.6), can ask your client to approve first, and stops and alerts you if anything looks wrong. It never deploys: your normal release process puts the update live.
We store what's needed to detect and track findings: module and library versions, PHP version and scan history, plus file paths for code, secrets and file integrity findings, and screenshots of a few public pages if you use the visual check. A secret found in a repository is stored only as its location and first few characters. We don't access site content, user data, or databases.
Yes. Start a 14-day trial of Monitored + Connector from your dashboard with one click, no card needed. If you don't subscribe, the account simply moves to the Free plan and keeps your sites and history. Agencies who sign up through a referral link get 30 days.
It works like tax brackets. Your first 24 sites cost $8 each per month, sites 25 to 99 cost $6 each and every site from 100 costs $4, so adding a site never makes your bill go up by more than $8. For example, 30 sites cost 24 × $8 + 6 × $6 = $228 a month. If you add a site mid-month, only the new site is charged, pro rata. Removing a site doesn't refund the rest of the period, but its slot stays yours until renewal, so you can add another site in its place for free.
Yes. Yearly billing costs ten months' worth, so you get two months free at every volume tier. You can switch an existing monthly subscription to yearly in Account settings.
Share your link from Account settings. The agency you refer gets a 30-day free trial. When they pay their first bill, your next renewal moves back a month, which is a free month. You can earn up to 12 free months a year; referrals within your own company don't count.
Yes. Cancel from Account settings whenever you like; you keep every paid feature until the end of the period you've paid for, and you won't be charged again. There's no lock-in contract.
Volume pricing applies automatically from 25 sites. If you want white-label billing for your own clients, get in touch and we'll talk through a reseller arrangement.
No card, no commitment. Or run a free one-off check on any Drupal site first.