Drupal 10 End of Life: What to Do Before 9 December 2026

Key Takeaways

• Drupal 10 reaches end of life on 9 December 2026. After that, core gets no new releases and no security advisories.
• Check your minor version today. Drupal 10.6 is the last release, and earlier minor versions have already lost security coverage.
• The move from 10 to 11 is an in-place upgrade, not a rebuild. The work is in PHP and hosting, custom code, removed modules, and testing.
• The slow parts are rarely core. Plan for infrastructure sign-off, contributed module gaps, and regression testing.
• If you will miss the date, write down a plan. A dated exception beats a silent drift.

Drupal 10 stops receiving security fixes on 9 December 2026. Your site will not break that day, and that is the problem.

Nothing visible happens. Pages load, forms submit, and editors keep publishing. What changes is that the next serious flaw found in Drupal core will have no patch coming for your version. Sites that go quiet in December tend to resurface in an audit or an incident months later.

This guide covers what the end of life really means and how to find your starting point in ten minutes. It also explains what the upgrade to Drupal 11 involves, and what to do if the date is too close for comfort. We are a Drupal agency, so we have an interest in this work. We will say where the upgrade is small and where it is not.

What Actually Happens on 9 December

The Drupal core schedule is clear. Drupal 10 reaches end of life on 9 December 2026, and no new Drupal 10 releases follow. As The Drop Times reports from that schedule, 10.6 is the final minor release of Drupal 10, and Drupal 12 is planned for the same December window.

Two details often get missed. First, each minor version has its own, shorter security window. Security support for 10.5.x ended in June 2026, so a site on 10.5 or earlier is already outside the window. Second, you cannot jump past Drupal 11. Drupal 12 is reached through 11, which makes 11 the right target now.

After the date, the risk is practical, not dramatic. New core vulnerabilities go unpatched. Standards that expect supported software, such as PCI DSS, HIPAA, and SOC 2, become harder to defend in an audit. A web application firewall helps, but it does not replace a patch. Pantheon’s end of life explainer covers the same ground, with a hosting vendor’s view.

Find Your Starting Point in Ten Minutes

Open your site’s Status report in the admin area, or run Drush status. Note the exact core version, the PHP version, and the database. Then match yourself to below information.

Either way, the first move is the same. Get an accurate inventory before you promise anyone a date.

The Upgrade From Drupal 10 to 11

The official upgrade guide sets the prerequisites. You need Drupal 10.3 or later, PHP 8.3 or later, and hosting that meets Drupal 11 requirements. You also need Composer and Drush access. Here is the order we follow:

1. Get to the last Drupal 10 release. Update core and modules to 10.6, and fix anything that breaks there.
2. Check the environment. Confirm PHP 8.3 or later and the database version with your host early, because sign-off can take weeks.
3. Run Upgrade Status. It scans your contributed and custom code and shows what needs updating or replacing. 
4. Replace removed modules. Actions UI, Activity Tracker, Book, Forum, Statistics, and Tour are gone from core in Drupal 11. Stop using them, or switch to the contributed versions.
5. Fix deprecated code. Code deprecated in Drupal 10 is removed in 11. Tools such as Drupal Rector automate much of the cleanup.
6. Upgrade in a test environment. Update core with Composer, run database updates, and test content, forms, search, and integrations before touching production.

This is why it is not a rebuild. Your content, configuration, and structure stay in place. The work is cleaning code and verifying behavior. Th

Where the Time Really Goes

Core is usually the easy part. When upgrades run late, the cause is almost always one of four things:

• Hosting and infrastructure. PHP and database upgrades need approval from teams that have their own queue.
• Contributed module gaps. Most have Drupal 11 versions, but a few do not, and some are abandoned.
• Custom code. Years of small modules and theme overrides add up, and nobody remembers how some of them work.
• Testing. Without automated tests, you repeat manual checks on every important page and form.

A clean site can finish in a few weeks. A heavily customized one can take months. With about seven weeks left from today, a site in the second group may not make the date, and that is fine if you plan for it. 

If You Will Miss the Date

Some sites will not make it, and that is a business decision, not a failure. Make it on purpose:

1. Move to 10.6 now. Do not sit on a minor version that has already lost coverage.
2. Write a dated plan. State the target date for Drupal 11, who owns it, and what blocks it.
3. Reduce exposure. Remove unused modules, tighten admin access, and keep monitoring and backups current.
4. Ask about extended support. Some vendors may offer it. Ask what it covers and what it costs. Treat it as a bridge and not a destination.
5. Tell the people who sign off on risk. Security, legal, and compliance teams would rather hear in October than in March.

Is This the Moment to Leave Drupal?

For most sites, no. The upgrade is far smaller than a rebuild, and Drupal remains a strong choice for content-heavy, multilingual, or integration-heavy sites. But the deadline is a fair prompt to ask an honest question. If your site is a small brochure that nobody on your team can maintain, a simpler platform might serve you better.

Ask that question after the audit, not before. The inventory in the steps above gives you the facts. Our Drupal migration and upgrade team does this kind of review, and we will tell you if staying is not the right call.

Conclusion: If This Were Our Site

If this were our own site, we would do three things this week and one next. We would check the exact core version. We would ask the host about PHP 8.3 and the database. We would run Upgrade Status and read the full report.

Then we would decide, with real numbers, whether we can reach Drupal 11 by 9 December or need a dated exception. Either answer is acceptable. The only poor answer is not knowing.

Seven weeks is enough for a clean site and tight for a complicated one. The advantage goes to whoever starts with the inventory today.

Send us your status report. Share your site’s Status report page and the list of custom modules. We will tell you which group you are in, how long we think the move to Drupal 11 would take, and what could stop it. Talk to a Drupal Expert →

Frequently Asked Questions

When does Drupal 10 reach end of life?

Drupal 10 reaches end of life on 9 December 2026. After that date there will be no new Drupal 10 releases and no security advisories for it. Drupal 10.6 is the final minor release, and earlier minor versions have already lost security coverage.

What happens to my site after Drupal 10 ends?

Your site keeps running, but new security flaws in Drupal core will go unpatched. That raises your risk and can cause trouble in audits for standards that expect supported, patched software. Plan to be on Drupal 11 before the date, or document a short, dated exception.

Can I skip Drupal 11 and go straight to Drupal 12?

No. Upgrades move through major versions in order, so Drupal 12 is reached from Drupal 11. Moving to Drupal 11 now also gets you ready for Drupal 12, which is scheduled to arrive in the same December window.

How long does a Drupal 10 to 11 upgrade take?

A clean site on current modules and hosting can take a few weeks. Sites with a lot of custom code, outdated contributed modules, or hosting that needs a PHP and database upgrade can take months. An Upgrade Status scan on day one tells you which group you are in.

What do I need before upgrading to Drupal 11?

You need to be on Drupal 10.3 or later. We suggest 10.6 as the starting point, because it is the last release that still has security coverage. You also need PHP 8.3 or later, hosting that meets Drupal 11 requirements, Composer and Drush access, and compatible versions of your contributed and custom code.

Is upgrading from Drupal 10 to 11 a full rebuild?

No. It is an in-place upgrade of core and code, not a migration to a new site. Your content, configuration, and structure stay. The work is in removing deprecated code, replacing removed modules, and testing. A migration is only needed from Drupal 7 or other platforms.

The Author

Hem Kant

Content Strategy and Integrity Lead (Social+ Services)

Curious by nature, Hem Kant is a strategist and writer who grounds his work in quiet reflection. He draws inspiration from the stillness of winter, clean cityscapes, good books, and honest talk (Networking). He writes with a commitment to integrity and a sharp focus on essential detail, delivering work defined by substance and insight.