Drupal

Drupal 10 reaches end of life

Drupal 10 stops receiving security fixes on 9 December 2026. If your site runs on it, you have weeks left to decide - and the cost depends mostly on which version you are starting from.

4 min read

Drupal ships major versions on a predictable rhythm and cuts off support for old ones just as predictably. For a site owner, one date matters: the day security fixes stop coming. For Drupal 10 that day is 9 December 2026.

What the schedule says

  • Drupal 10 - end of life on 9 December 2026. Version 10.6.0 is the last minor release of that line.
  • Drupal 12 - released in the week of 7 December 2026, essentially at the same moment.
  • Drupal 11 - the supported version that an upgrade from 10 leads to. The 11.4.x branch has security support until 21 April 2027.
  • Drupal 7 - lost support on 5 January 2025.

End of life does not mean the site stops working. It means that when a hole is found in the core or a module, nobody will publish a patch. The site runs exactly as it did yesterday - it is simply no longer being watched.

First establish where you stand

You will find the version in the status report in the admin panel, or from the command line:

drush status --field=drupal-version

That number decides whether you are facing an upgrade or a separate project. The difference in cost is several times over, so it is worth settling before you plan a budget.

From Drupal 10 to 11: an upgrade

This move stays within the same architecture - content structure, modules and theme all carry over. The amount of work equals the amount of neglect:

  1. Check module compatibility. The Upgrade Status module lists the ones with no release for 11 and points out deprecated calls in your own code.
  2. Raise the environment requirements. Every major Drupal version raises the minimum PHP and database versions. On older hosting that is usually the first thing to block an upgrade.
  3. Remove deprecated APIs from your own code. If the site has bespoke modules, most of the work is hidden here.
  4. Update to the latest Drupal 10 first, and only then make the jump to 11.

You do all of this on a copy, not on the live site. With Composer that means a separate branch in the repository and a test environment where somebody can click through the paths that matter.

From Drupal 7: not an upgrade but a migration

Drupal 7 has a different architecture from 8 and later. There is no "click to update" path - content and configuration are moved into a fresh installation using the migration modules, while the theme and custom modules are written again. In practice it is building a new site that takes over the content and the addresses of the old one.

Since that is the scope of work either way, it is a good moment to aim at Drupal 11 rather than a version that is itself approaching end of life.

If you will not make it by December

For Drupal 7 there is an extended support programme run by certified vendors - currently HeroDevs and Tag1 Consulting - who issue patches past the official end of life. It is a paid option and a temporary one by definition: it buys time for a migration, it does not replace one.

If the site has to stay on an unsupported version even for a few weeks, reduce the exposure: strip out everything it does not need to serve, close the admin panel to public access, put an application firewall in front of it, and make sure backups run daily and can actually be restored. The most expensive Drupal break-ins happen exactly in that window - the vulnerability is already described publicly and there is no patch.

Not working out?

If the problem stays, or you would rather not experiment on a live site, write to us and we will look at it. The diagnosis costs nothing.

Maintenance and development

Other guides

Getting started with AI in your company

Most failed AI projects do not fall over on the technology, but on the choice of process. So we start with what is countable and repetitive, not with what looks most impressive.

A slow website

A slow site is never one fault, it is the sum of several. We start by measuring, because without that optimisation is guesswork - and usually speeds up what was already fast.

An expired SSL certificate

Instead of your site, visitors get a red warning and have to click through "proceed anyway". Most of these cases are an expired certificate or a renewal that never finished.

Moving a website to new hosting

A migration goes well or badly depending on the order of the steps. The most expensive mistake is switching DNS before checking that the site works on the new server at all.

WordPress redirecting to spam sites

Visitors land on somebody else's site, and Google shows spam where your offer used to be. That is a break-in, not a fault - and cleaning the files alone will not hold.

The WordPress 500 error

HTTP 500 is the server saying something interrupted the code. On its own it tells you nothing - the whole job is getting to the log.

The WordPress white screen

Instead of your site you get blank white. It is one of the most common symptoms, and in most cases it can be defused in a quarter of an hour.