Drupal Modules: Too Much Of A Good Thing?

One of Drupal's best features is the ever growing number of contributed modules written for it. These modules do so many clever things, ranging from stock quotes to "talk like a pirate".

This plethora of modules is definitely a blessing, but can also be a curse. Clients often ask us to install a gazillion modules, and we try to explain for them the realities. As for modules, my advice in general is not to go overboard with modules.

Here is why we recommend against new Drupal users installing too many modules.

Quality Concerns

Module quality is variable. Some are real engineering marvels, written by a highly skilled teams, while others are little more than scripts written by hobbyists.

Security Concerns

Some modules have potential security holes which fall into two main categories: SQL injection, and Cross Site Scripting. Both can provide potential points of entry for hackers to your site.

Resource Concerns

Some modules consume too much system resources (CPU, memory, database I/O). Other modules over utilize cron, causing resource starvation spikes. If you are on a shared hosting, then your hosting provider can get upset and ask you to make adjustments.

Conflict Concern

Some modules do not co-exist with other modules. The reason can be as simple as the author of module A never knew of module B, or can be an architectural design. Examples are the various access modules, although that may be something that is being worked on. Another is Paypal Framework and Ecommerce (either one can handle Paypal IPNs, but not both).

Upgrade Concerns

While you can install a module easily and start using it, upgrading when a new Drupal release comes out is another matter. Some modules never get updated because their author lost interest, or the module was superceded by soemthing else. The data in your database that this module created will now be orphaned. An example is the previously popular weblinks module, which is not updated for 4.7.

For these reasons, we advise customers not to go into Drupal.org and install every module that seems interesting.

If you insist on trying out modules, then setup a test site first, and play with the modules you think you will need there. After being satisfied with the module functionality, and doing some homework on future directions of each, you can install the module in the live web site.