How to Install Drupal

Drupal 10 (and 11) should always be installed via Composer, not by downloading a tarball and unzipping it — Composer is how dependencies, contributed modules, and security updates are managed going forward, and skipping it just means retrofitting it later.

Requirements

• PHP 8.1 or higher (Drupal 11 requires 8.3+; check the version you're installing against)
• Composer 2.x
• A database: MySQL 5.7.8+/MariaDB 10.3.7+, PostgreSQL 12+, or SQLite 3.45+
• A web server: Apache (with mod_rewrite) or Nginx
• PHP extensions: gd (image handling), pdo, mbstring, xml, opcache (strongly recommended for performance), and curl

For local development, consider DDEV instead of configuring PHP/a web server/a database by hand — it wraps all of this in Docker containers with a single ddev config + ddev start, and it's what a lot of Drupal shops (including this one) now default to for local environments.

Create the Project with Composer

Drupal's recommended-project template sets up the correct directory structure, a web/ docroot, and dependency management from the start:

composer create-project drupal/recommended-project my-site
cd my-site

This is different from the older drupal/legacy-project template (docroot at the repo root instead of web/) — use recommended-project unless you have a specific reason not to; it's the actively maintained default.

Install Drush

Drush lets you install and manage Drupal from the command line instead of the browser wizard — essential once you're scripting deployments or content seeding:

composer require drush/drush
vendor/bin/drush site-install standard \
  --db-url=mysql://db_user:db_password@localhost/db_name \
  --account-name=admin \
  --account-pass=changeme \
  -y

The --db-url format is driver://user:password@host/database-name; for SQLite it's simpler — --db-url=sqlite://sites/default/files/.ht.sqlite. The standard profile gives you a typical content-editing setup (article/page content types, a default theme, basic blocks); swap in minimal for a bare-bones install with nothing preconfigured, which is often the better starting point for a headless/API-only Drupal backend since you won't be using its default theme anyway.

Installing via the Browser Instead

If you'd rather use the UI, point your web server at the web/ directory and visit the site in a browser — Drupal's install wizard walks you through the same choices (profile, database credentials, admin account) interactively. Functionally equivalent to the Drush command above; Drush is just faster once you're doing this more than once.

Post-Install: Settings Worth Changing Immediately

• Trusted host patterns — Drupal refuses requests with an unrecognized Host header by default (a security measure). Add your domain(s) to $settings['trusted_host_patterns'] in sites/default/settings.php, or every request will throw an exception once you're not on localhost anymore.
• File permissions — sites/default/files needs to be writable by the web server user; Drupal's installer usually sets this automatically, but shared hosting environments sometimes need a manual chmod.
• Cron — Drupal relies on cron for cache maintenance, search indexing, and scheduled module tasks. Set up a real system cron job hitting drush cron rather than relying on the built-in "run cron on page load if overdue" fallback, which only fires on actual traffic.

Adding Modules and Themes

Contributed modules and themes are added via Composer, not manually downloaded and extracted into modules/contrib/:

composer require drupal/admin_toolbar
vendor/bin/drush en admin_toolbar -y

composer require downloads the code and resolves version compatibility against Drupal core; drush en (short for drush pm:enable) actually turns the module on. Both steps are necessary — a Composer-installed module sits inactive until enabled.

Common Issues

• "Database connection failed" — double-check host, credentials, and that the database itself already exists (Drupal doesn't create the database, only the tables inside it).
• White screen after install, no visible error — check your PHP error log, not the browser; usually a missing PHP extension (gd and opcache are the most commonly forgotten) or a fatal error suppressed by production error settings.
• "The provided host name is not valid" — the trusted host patterns issue above; add your domain to settings.php.
• Permission errors on sites/default/files — ensure it's writable by the web server's user, not just your own shell user.
• "drush: command not found" — you're running the global drush if one exists on your PATH rather than the project's own vendor/bin/drush, which is version-matched to your Drupal core; always prefer the local one.
• Composer runs out of memory on constrained hosts — prefix the command with COMPOSER_MEMORY_LIMIT=-1 to remove Composer's self-imposed memory cap.

Need a Drupal site built, migrated, or maintained? Get in touch — I work as a freelance Drupal developer.