Drupal 10 community support ends on 9 December 2026.

Drupal 7 support already closed in January 2025. Drupal 6 closed nearly a decade ago. If a site is still running on either of those versions, it has had no official security coverage for years. Not a slow decline. A flat stop, on a fixed date, that already happened or is about to.

What This Actually Means

Once community support ends, only paid extended support remains available, and only for a limited period. It is not guaranteed to cover every module a site depends on. A site running past its support window is not broken yet. It still loads. It still works. That is exactly what makes it dangerous. It is simply unprotected, waiting for the first serious vulnerability to find it before anyone on the team does.

Most teams already know this. Most still wait anyway. The usual reasons are cost, fear of breaking something that currently works, and the simple instinct to leave a live platform alone if nothing looks wrong yet. None of those reasons are unreasonable on their own. A live system that currently works is a genuinely frightening thing to open up.

But a legacy system rarely fails loudly. It fails quietly. The day a simple new feature turns out to cost three times what it should, because it has to be bolted onto architecture that was never built to hold it. Or the day a security gap gets discovered by the wrong person before anyone on the inside even knew it existed.

What To Do Next

An upgrade from a genuinely old version is not a patch applied over a weekend. It is closer to a full rebuild, with content and data migration included as part of the same project. Legacy themes rarely carry over cleanly to a modern version. Custom modules often need to be rewritten entirely to work with current architecture, not just tweaked. Treating this like routine maintenance is the single most common reason upgrade timelines fail and budgets run over.

For teams already sitting on a more recent version, the path looks considerably lighter. Moving from Drupal 10 to 11 is mainly about clearing out old deprecated code rather than a full redesign from the ground up. There is one requirement that catches a lot of teams out without warning. A site needs to already be running Drupal 10.3.0 or later before attempting that move, since every core update before that specific version has been removed entirely in Drupal 11.

Either way, the same three checks apply before any work begins. Confirm exactly which modules the current site depends on and whether each one is actually compatible with the target version. Confirm the hosting environment supports the newer PHP and database requirements the new version expects. And build in real testing time, especially for anything involving e-commerce, payment flows, or complex custom functionality that cannot afford to break on launch day.

The Benefit Beyond Just Staying Current

A rebuild is also the one real moment a team gets proper budget approval to fix everything that never quite worked the way it should have. The clunky content structure nobody ever liked but learned to live with. The design has quietly aged badly over several years. The one workaround everyone on the team tolerated because fixing it properly always felt like a separate project for another day.

Teams that go through this properly do not just end up current. They come out the other side with a faster platform, a genuinely more secure one, and a content structure that finally matches how the business actually runs today rather than how it happened to run when the site was first built years ago.

If This Sounds Familiar

If a Drupal site is currently running on a version that is unsupported, or one that is approaching its support deadline soon, the right time to plan this is now, on your own schedule. Not later, on whatever timeline a security incident decides to hand you instead. We have taken clients through Drupal upgrades across several versions, planning each stage carefully so nothing breaks along the way and nothing gets rushed under pressure. If your team is currently weighing this decision, we are happy to take an honest look at where things stand and tell you plainly what the right next step actually is. Take a look at how our Enterprise Solutions team approaches projects like this, or get in touch directly.