How do I perform a critical update if my Craft site relies on older plugins?

Question

I recently came across a website in this situation and am curious to here how others approach this problem. Here's the scenario:

A client had a website built on Craft 2.4 with a lot of integration work. The site has 10 custom plugins, integrating with several different systems and services. The relationship with the original development firm did not work out and a new development firm is picking up where the old one left off. This means, the new team initially has limited knowledge of the 10 custom plugins on the site.

The new development firm inherits this project just as Craft discovers and releases a critical update with a fix for a security vulnerability (Craft 2.6.2791). It's in the website owners interest to upgrade to the latest version of Craft.

However, as mentioned, the site has 10 custom plugins that have not yet been updated to Craft 2.5. And, for fun, let's just say Craft 3.0 is also on the horizon.

If you are the development firm that inherits this project:

1. What options do you present to the new client for them to move forward?
2. How do you explain the costs (and the value) of why 10 plugins will need to be updated to Craft 2.5 and to Craft 3?
3. How do you respond if the client expresses concern that this work doesn't relate to value toward their business objectives?

Answer 1

I'd want the client knowingly and enthusiastically on board with a sensible plan that'd support business goals and the nature of evolving software.

1. Either a) do with fewer plugins/integrations, b) invest in privately upgrading the plugins, c) open source the work if possible and ask for improvements with fingers crossed, or d) rethink the site so it's less directly dependent on these plugins and thus safer from a repeat of this scenario should a-c seem unattractive. (Freezing the Craft version and avoiding software updates should be unacceptable as it's risky and invites compounding future problems—might as well pick e) move to a static site.) Re-affirm the importance of the CMS and each plugin, or remove the cruft from the equation.
2. The solid and ongoing work behind Craft, and the support that comes with it, is a steal and having a well-tailored CMS likely empowers employees in various ways—decreasing dependency on (and cost of) web nerds or additional training to update content. If nothing else, staying up to date takes advantage of lots and lots of work that's included in the price of a license while keeping the site as fast and secure as possible.
3. I'd encourage the line of thought and compare other ways of meeting those objectives. For example, I might contrast the (nonexistent) maintenance costs of running a SquareSpace site compared to the freedom and flexibility of hosting a Craft install. The site, as it is, is most likely supporting current business objectives and keeping it up to date will make it possible to quickly and elegantly support future business objectives with great agility. It may not be worth it, but I'd try and help them understand how much versatility they have for the (un-sexy) cost of maintenance and burden of technical diligence. Odds are they chose Craft and their custom plugins for a reason and those reasons are still vitally relevant, as is the ability to stay nimble in the future.

You might also try to get Ben Parizek on the horn and submit the whole site for a Straight Up Craft code review. In my experience, that can be one way to get rid of unnecessary plugins.

Answer 2

Matt's answer covers some good ground, especially this line: "Odds are they chose Craft and their custom plugins for a reason and those reasons are still vitally relevant, as is the ability to stay nimble in the future."

Wanted to expand on some points...

I've walked into these kind of building-on-fire situations before and it's important to figure out the history of the relationship before you start. That will inform how you tailor your approach.

• Why didn't the previous firm work out? (Were they nickel-and-diming the client for example? Or did they not frame after-site expectations properly? etc.)
• What does the client actually value? (Or was it a buddy higher up helping a buddy situation?)
• Has the client set any money aside for on-going maintenance?

This scenario is all-too-common and almost a cliche. There's too many fly-by-night agencies/developers that are onto the the next client as soon as the job is done and do not support what they created.

There's less money in support than creation so I understand this aspect of it. But knowing where the client is coming from is helpful. Designers blame the client but 9/10 the client is not at-fault—that is, if you sell properly.

I have to credit Ben Parizek for this quote on the Control-Click Podcast but he's right on the money when he says "we're not just building the client one website, we're building them two websites." In other words, the backend of the site is just as important as the front-end.

And that means on-going updates, maintenance and hosting. Clients (and some designers) are still treating websites like printed pieces where you build it once and it's done. It's more like a living, breathing entity. The web thrives on change. If your business objectives ultimately don't involve changing over time, there's not a whole lot you can say to convince the client otherwise.

Clients also generally don't care what technology you use, they want solutions. If they feel your solution doesn't provide them with any more value than a SquareSpace or Weebly site, than you've not framed your value to the client properly.

What did those plugins actually do in the first place? You don't get custom business logic for free. It's like building a luxury jet; you may have paid for the custom GPS system, leather, stone tile, and jacuzzi, but you still need to fill it up with fuel to fly it, mechanics to work on it, etc.

Lately, I've been building in some sort of maintenance agreement with all of our site builds for a period of time (including support, hosting, and CMS updates, etc.) That helps solidify trust with the client that you're not going to leave them out in the desert and helps makes sure their business objectives have been met. Ultimately after that maintenance period is up, it's an easy renewal contract to keep them in, assuming you've set that initial expectation already. It can often lead to bigger projects, too...