Drupal 10 end of life: what to do before 9 December 2026

Drupal 10 reaches end of life on 9 December 2026. Your site won't go offline that day, and nothing visible will change. What stops is security support: when the next vulnerability in Drupal 10 is found, there will be no official fix for it.

If your site runs on Drupal 10, you have a few weeks to plan. The good news is that this is one of the easier upgrades in Drupal's history.

What "end of life" actually means

When a Drupal version is end of life, the Drupal Security Team stops publishing security advisories and patches for it. In practice that means:

• Known holes stay open. When a vulnerability is announced for Drupal 11, attackers check whether the same problem exists in Drupal 10. Often it does, and there will be no patch.
• Contrib modules move on. Module maintainers drop Drupal 10 from new releases over time. Security fixes for the modules you rely on stop reaching you too.
• Compliance gets harder. GDPR expects "appropriate technical measures", and PCI DSS expects supported software. Many insurance and procurement questionnaires ask directly whether your CMS is still supported. After 9 December the honest answer is no.

You may already be out of support

Drupal 10 isn't one version. Each minor release (10.4, 10.5, 10.6) has its own support window, and only the newest one still gets security fixes:

• 10.6 is supported until 9 December 2026.
• 10.5 lost security support in June 2026.
• 10.4 lost it in December 2025.

So if your site is on 10.5 or older and nobody has updated it this year, it is already running without security fixes. Not sure which version you have? The free scanner tells you in a few seconds, without logging in to anything.

How big is the move from 10 to 11?

Much smaller than people expect. Moving from Drupal 7 meant rebuilding the site. Moving from 10 to 11 is closer to a large update: same architecture, same content, same URLs. Drupal 11 mostly removes old code that Drupal 10 already marked as deprecated.

The work usually sits in four places:

1. Contrib modules. Most popular modules already have a Drupal 11 release. Some need a newer version, a patch, or a replacement.
2. Custom code. Custom modules and themes that use deprecated functions need small changes. Tools find most of these automatically.
3. Modules that left core. Book, Forum, Statistics, Tour, Actions UI and Activity Tracker are no longer part of core. If you use one, you install its contrib version instead.
4. Hosting. Drupal 11 needs PHP 8.3, MySQL 8.0 or MariaDB 10.6, and Drush 13. Some older servers need an upgrade first.

For a typical small or medium site, this is days of work, not months.

A plan in six steps

1. Update to the latest Drupal 10 release. You can only upgrade to 11 from a recent 10.x, and it closes any known security holes while you work. My guide on updating Drupal core the right way covers this.
2. Run Upgrade Status. This module scans your site and lists every module and piece of custom code that isn't Drupal 11 ready. See Understanding the Upgrade Status module.
3. Sort your modules. For each problem, decide: update it, patch it, replace it, or remove it. Auditing contrib modules before a major upgrade explains how.
4. Check your hosting. Confirm PHP 8.3 and a supported database are available before upgrade day, not on it.
5. Upgrade a staging copy first. Do the upgrade on a copy of the live site, then test forms, logins, search and anything that takes payments. Fix what breaks there, where nobody sees it.
6. Go live, then keep it updated. Repeat the upgrade on live with a fresh backup. After that, regular minor updates keep you from ending up here again.

"Should I just wait for Drupal 12?"

No. Drupal 12 is scheduled for release on 7 December 2026, just two days before Drupal 10 support ends, but it isn't a shortcut:

• You can't skip a version. Drupal upgrades go one major version at a time, so a Drupal 10 site has to pass through Drupal 11 on the way to 12 anyway.
• Brand-new releases need time. Many contrib modules won't have a Drupal 12 release on day one. Waiting for them means weeks or months on an unsupported Drupal 10.
• Drupal 11 stays supported. Moving to 11 now keeps you safe today, and the step from 11 to 12 later will be the same kind of small move as 10 to 11.

Need a hand?

Start with the free exposure check: it shows your exact version and its support status. If you'd rather not do the upgrade yourself, I do Drupal 10 → 11 upgrades at a fixed price, from £900, always on a staging copy first. Your content and URLs stay the same.

Based in the US? See Drupal 10 upgrades for US organizations, with prices in USD and call times in Eastern Time.