Drupal 10 reaches its official end of life on December 9, 2026. From that point, the Drupal security team stops issuing patches for the 10.x branch, and any vulnerability discovered after that date will have no official fix until the site has migrated to Drupal 11.

What does that mean for your site in practice? And how should you approach the decision given your specific situation?

In brief

  • Drupal 10 loses security support on December 9, 2026 (Drupal.org, official release cycle)
  • After that date, discovered vulnerabilities will not receive official patches
  • Drupal 11 has been available since August 2024 and the contributed module ecosystem is now mature
  • The migration is considerably less complex than the Drupal 7 to 9 jump, provided the codebase is reasonably clean
  • Starting the planning process now gives you control over your timeline and your choice of partner

What Drupal 10 end of life means in practice

Drupal 10 end of life is the point at which the Drupal project officially stops providing security support for the 10.x branch. Your site does not stop working. What stops is the flow of security patches from the Drupal security team. Any vulnerability discovered in Drupal 10 after December 2026 will not receive an official fix. The site remains exposed from that point until it is running Drupal 11.

The consequences extend beyond the patches themselves. Contributed module maintainers track supported core versions: once end of life passes, new module releases will no longer target Drupal 10 and security updates will progressively stop. Drupal 11 requires PHP 8.3 as a minimum, the current stable release of PHP, and hosting providers are updating their infrastructure accordingly. Running Drupal 10 on modern hosting will become increasingly difficult over time.

For organizations operating under GDPR, running an unsupported CMS introduces a compliance dimension. The regulation does not prohibit using end-of-life software outright, but it does require demonstrating appropriate technical measures to protect personal data. An unpatched platform, with known unaddressed vulnerabilities, makes that demonstration significantly harder in the event of an audit or an incident.

Some organizations consider commercial extended security support as a way to buy time. Third-party vendors do offer patches beyond the official end-of-life date, and that can serve as a short-term bridge in specific circumstances. It does not solve the broader problem: module maintainers still stop targeting Drupal 10, the ecosystem moves on regardless, and technical debt compounds. Extended support delays the migration; it does not replace it.

What Drupal 11 actually changes

Drupal 11, released in August 2024, is not an architectural overhaul. It is a progressive evolution that removes compatibility layers accumulated since Drupal 9 and takes advantage of advances in PHP.

What changes:

  • PHP 8.3 is required as a minimum (Drupal 10 required PHP 8.1; PHP 8.4 is recommended for Drupal 11)
  • Deprecated APIs, meaning older code patterns kept for backward compatibility since Drupal 9, have been removed
  • Some poorly maintained contributed modules are no longer compatible

What does not change:

  • The core architecture remains the same
  • Major contributed modules have been ported to Drupal 11
  • Editorial workflows, content management, and the JSON:API remain stable
  • The upgrade process uses the same tooling: Upgrade Status, Drush, and the standard Composer-based update procedure

For organizations running headless or decoupled Drupal architectures, where a separate Next.js or other frontend consumes content through the JSON:API, the migration scope is narrower still. The presentation layer is independent of the CMS version, so the frontend is untouched. Only the Drupal backend requires updating, which reduces both the risk and the timeline.

For a site that migrated to Drupal 10 in reasonable shape and has not accumulated significant custom code debt, the move to Drupal 11 is a manageable technical operation. It does not carry the weight of a Drupal 7 to 9 migration.

How complex is a Drupal 10 to 11 migration?

The honest answer depends on the state of the codebase.

Migration is more straightforward if:

  • You migrated to Drupal 10 recently and the code is in good shape
  • You rely primarily on actively maintained contributed modules
  • Your theme is based on a well-documented, supported starting point
  • Configuration is exported and version-controlled

In this scenario, a Drupal upgrade to version 11 typically takes two to six weeks of developer time, covering audit, remediation, testing, and deployment.

Migration is more involved if:

  • The site has a long history, with custom code dating back to Drupal 7 or 8
  • You depend on contributed modules that are poorly maintained or on internal forks
  • There is no clean development environment or deployment pipeline

In this case, six to twelve weeks is a more realistic baseline, depending on the depth of the custom code and the technical debt that has built up.

In either case, the right first step is to run the Upgrade Status module on your current environment. It produces a report of every deprecation and incompatibility that would block a Drupal 11 migration, with a severity rating for each item. In our experience, this report is often the first point at which the real scope of work becomes concrete, not because the issues are a surprise, but because the cumulative picture had not been assembled before.

If you would like an independent read on your site's current state before committing to a migration plan, our consulting and advisory service covers exactly this step.

Should you migrate now?

Most decision-makers are not asking whether to migrate. They are asking when to start.

If your site is in production and strategically important to your organization: the planning process should begin now. December 2026 may seem distant, but a well-managed migration runs several months across scoping, development, testing, and deployment. Starting early means keeping control of the timeline and the choice of partner.

The broader Drupal release cycle is also relevant here. With the two-year major version cadence introduced with Drupal 11, Drupal 12 is planned for 2026. Completing a Drupal 11 migration now positions the organization on the current supported version, without the pressure of handling two transitions at once.

If a redesign is already planned: the Drupal 11 migration can be incorporated rather than handled as a separate workstream. This is often the most practical moment to address accumulated technical debt alongside functional changes. If you are at the stage of scoping a project for an agency, our guide on how to prepare a web project covers how to structure that scope effectively.

If your internal team plans to lead the migration but needs additional Drupal expertise: this is a situation where staff augmentation often fits better than a full outsourcing arrangement. An embedded senior Drupal developer can work within your existing processes and tools while covering the technical depth the migration requires.

If the site is low-traffic or approaching the end of its functional life: it may be worth evaluating whether Drupal remains the right platform before investing in a version migration. Our guide to choosing a CMS can help frame that decision.

One scenario worth addressing separately: organizations that genuinely cannot complete a migration before December 2026, for budget or capacity reasons. In that situation, the conversation shifts to risk management. Which parts of the site handle personal data or process sensitive transactions? Those are the areas where compensating controls matter most while a longer migration window is planned.

Waiting until the final quarter of 2026 creates pressure that is entirely avoidable. If a complication arises mid-project at that stage, there is no margin left to absorb it.

Frequently asked questions

Will Drupal 10 still work after December 2026?

A Drupal 10 site will continue to run after December 2026. What stops is official security support from the Drupal project. Any vulnerability discovered after that date will not receive an official patch, meaning the site's exposure grows over time until it is migrated to a supported version.

Is a Drupal 10 to 11 migration as complex as Drupal 7 to 9?

No. The Drupal 7 to 9 migration required near-complete rewrites of custom modules because the underlying architecture had changed fundamentally. Drupal 9, 10, and 11 share the same architectural foundations: modules written for Drupal 10 typically require only compatibility updates to run on Drupal 11, not rewrites.

Will my contributed modules work on Drupal 11?

The large majority of actively maintained contributed modules are already compatible with Drupal 11. To assess your specific module set, install and run the Upgrade Status module on your current Drupal 10 site. It produces a compatibility report for every module and custom code component, with a severity rating for each item.

What is the difference between Drupal 10 and Drupal 11?

Drupal 11 is an evolutionary update, not a rewrite. The content architecture, editorial interface, and JSON:API are unchanged. The principal differences are a higher PHP minimum (8.3, with 8.4 recommended), the removal of deprecated APIs that were preserved for backward compatibility since Drupal 9, and the Starterkit theme becoming the recommended starting point for custom theme development. For most sites, the upgrade is a compatibility update rather than a structural migration.

When should I start planning the migration?

For sites that are live and business-critical, planning should begin now. A properly managed Drupal 10 to 11 migration runs two to twelve weeks depending on codebase complexity, but scoping, partner selection, and budget approval add lead time before development starts. Organizations that begin in the first half of 2026 retain full control over their schedule. Those who wait until autumn 2026 will be competing for agency capacity at peak demand.

A deadline you can plan around

The end of life for Drupal 10 has one quality that distinguishes it from most technical deadlines: the date is fixed, published years in advance, and will not move. It is one of the few infrastructure decisions that can be planned for with full information, provided the planning starts early enough.

Organizations that begin now choose their approach and their partner. Those who wait until late 2026 will find themselves in a market where agencies are stretched, timelines are harder to hold, and the December deadline is no longer a planning horizon but an immediate constraint.

If you want an independent view of your Drupal 10 site and what a migration to Drupal 11 would involve, our consulting and advisory service can provide that assessment. If you have already scoped the work and are ready to start, our Drupal development service handles Drupal 10 to 11 migrations end-to-end. The December 2026 deadline is fixed. The question is how much runway you give yourself. Get in touch.