Drupal Cheat Sheet

A single-page, colour-coded summary of the Drupal sub-section. The platform block gives the request lifecycle in one line, the entity, bundle and field model, the difference between configuration, content and state, the version and support dates (Drupal 11.4, the scheduled Drupal 12.0.0 and the Drupal 10 end of life) and the requirements and project tree for each major version. The install block lists the composer create-project, DDEV and drush site:install commands and the Drupal CMS templates. Site building covers the content type, fields, displays and Views path, the core field types, text formats, Layout Builder versus Canvas, roles and permissions, moderation states, the multilingual modules and the modules that move to contributed projects in Drupal 12. Administration collects the settings.php keys (trusted_host_patterns, hash_salt, config_sync_directory, file_private_path and the reverse proxy settings) with safe values, the drush deploy steps, the Composer update routine, the security release days, the recipe skeleton, the cache layers, cron and a hardening checklist. Theming holds the *.info.yml and *.libraries.yml skeletons, the Twig filters and functions, template suggestion naming, the Starterkit command, the Single Directory Component skeleton with its include and embed calls, breakpoints and Twig debug. Module development holds the *.info.yml, *.routing.yml and *.services.yml skeletons, a controller, an object-oriented hook class, an event subscriber, a ConfigFormBase form, a block plugin with attributes, an entity query with accessCheck(), #cache keys, AccessResult one-liners, a queue worker and the difference between hook_update_N and post-update functions. The remaining blocks cover the JSON:API URL patterns, a REST, JSON:API and GraphQL comparison and the OAuth grants, the 20 most useful Drush commands, the test types and base classes, the PHPCS, PHPStan, Upgrade Status and Rector commands, the Drupal 10 to 11 to 12 upgrade checklist with minimum versions, the AI module and MCP Server one-liners, and a strip of what changed since older tutorials (attributes instead of annotations, OOP hooks, Single Directory Components, recipes, Drupal CMS, Canvas, Drush 13, PHPUnit attributes, the removal of UI installs and updates, Navigation and Default Admin, argon2id and the removal of IIS support).

It reflects Drupal as checked on 2026-10-30 with Drupal 11.4.x, Drush 13 and 14 and PHP 8.3 or later, and is available as a downloadable PDF.

For the full explanation, every option and additional examples, see the dedicated pages:

Getting Started — Introduction and Architecture, "Drupal Versions, Release Cycle and Support", Requirements and Hosting, Project Layout and Local Development, Installation with Composer and DDEV, Drupal CMS and Site Templates, and Drupal.

Site Building — Blocks and Block Layout, Canvas Visual Page Building, "Content Moderation, Workflows and Revisions", Content Types and Fields, Display Modes and Image Styles, Field Types and Entity References, Forms for Visitors: Contact and Webform, Layout Builder, Media and the Media Library, Menus and Path Aliases, "Drupal Multilingual Sites: Languages, Negotiation and Translation", Search and Search API, Taxonomy, Text Formats and CKEditor 5, "Users, Roles and Permissions", Views, and Workspaces.

Administration — "Admin UI, Navigation and Admin Themes", Automatic Updates and Project Browser, Backups and Disaster Recovery, Configuration Management, "Cron, Queues and Maintenance", File System and Private Files, "Logging, the Status Report and Troubleshooting", Drupal Multisite, Performance and Caching, Drupal Recipes, Drupal Security Hardening, "settings.php, services.yml and Environments", and "Updates, Composer and Security Advisories".

Theming — Accessibility and Performance in Themes, Breakpoints and Responsive Images, Email and Error Pages Theming in Drupal, Front-End Tooling for Themes, Libraries and Assets, Single Directory Components, Starterkit and Subthemes, Drupal Template Suggestions and Preprocess Hooks, Theme Info Files and Regions, Theme Settings and Configurable Themes, Theming Overview and the Render Pipeline, Twig Extensions in Modules for Drupal Themes, and Twig Templates and Debugging in Drupal.

Module Development — Access Control and Permissions in Code, AJAX and HTMX, "Block, Field Type, Widget and Formatter Plugins", Configuration API and Schema, Custom Entity Types, Database API and Entity Queries, "Entity API: Loading, Saving, Translating, Validating and Securing Entities", Events and Subscribers, Form API, Hooks and OOP Hooks in Drupal Modules, The Migrate API, Module Anatomy and the info.yml File, Plugin API and PHP Attributes, "Queue, Batch and Cron APIs", Render API and Cache Metadata, Routing and Controllers, Services and Dependency Injection, "Translating Strings in Drupal Code: t(), TranslatableMarkup, Plurals, Twig and JavaScript", and "Update API, Post-Updates and Deploy Hooks in Drupal Modules".

APIs & Headless — Authentication and OAuth in Drupal, Decoupled Drupal with Next.js, GraphQL, JSON:API in Drupal Core, and REST and Serialization in Drupal.

Tooling & Delivery — Automated Testing, Coding Standards and Static Analysis, Contributing and the Drupal Community, Deployment and CI/CD, Docker and Containers, and Drush.

Upgrades — Migrating from Drupal 7, Preparing for Drupal 12, Removed Core Modules and Replacements, and Upgrading from Drupal 10 to Drupal 11.

AI — The AI Module and Providers, and MCP Server and AI Agents in Drupal.

Reference — Where Older Books and Tutorials Are Outdated, Comparison and Decision Guide, and Cheat Sheet (PDF).