# Drupal 10 End of Life: Upgrade, Drupal CMS, or Leave?

> Drupal 10 loses security coverage on 9 December 2026, the same week Drupal 12 is due to ship. Every Drupal 10 site has to choose a path, and the upgrade is not the only one.

Buyer Guide by DXP Scorecard Analyst Team · Published 2026-11-09 · Reviewed 2026-11-09 · Ratings updated 2026-11-09
Source: https://www.dxpscorecard.com/editorials/drupal-10-end-of-life-migration-guide

## The short answer

Drupal 10 reaches end of life on 9 December 2026 with no extended support announced. The lowest-risk path is the upgrade: Drupal 11.4 now, Drupal 12 once it ships, or Drupal CMS if marketers should own the site. If you are ready to leave, Storyblok and Contentful rate highest for teams that want to stop running servers, Craft CMS keeps your PHP skills, and Acquia is Drupal with a vendor behind it.

## Key takeaways

- After 9 December 2026 the Drupal Security Team stops covering Drupal 10, core and contributed modules alike. The site keeps running, but every new vulnerability stays open. As of early November 2026 no vendor has announced a paid extended-support program for Drupal 10, unlike Drupal 7.
- There is no direct road from Drupal 10 to Drupal 12. Drupal 12 only accepts databases that have already been through Drupal 11.3 or later, so the real path is Drupal 10.6, then Drupal 11.4 or 11.5, then Drupal 12. Drupal 11 is supported until Drupal 13, expected in 2028, so most sites can stop at 11 for now.
- The upgrade is mostly a contributed-module exercise. Agencies quote three to six weeks for a well-maintained site with 40 to 60 modules, and eight to sixteen weeks for a neglected one. Custom modules, an outdated theme and a hosting stack still on PHP 8.2 are what turn weeks into months.
- Drupal 12 itself is a cleanup release. It is designed to be nearly identical to Drupal 11.5 with deprecated code removed: PHP 8.5 becomes the minimum, Symfony 8 arrives underneath, and a set of core modules and the Claro and Olivero themes move to contributed projects. Nothing in it is a reason to rebuild.
- The deadline is also a chance to change who runs the site. If the real pain is patching, hosting and the upgrade calendar rather than Drupal itself, a managed platform removes that work entirely, and a Drupal 10 rebuild is the moment when switching costs the least extra.

## Our picks at a glance

- **Lowest-risk upgrade:** Drupal. Same site, Drupal 11 now, Drupal 12 later.
- **Best for marketer self-service:** Drupal CMS. Canvas, templates and SEO preinstalled.
- **Best when procurement needs a vendor:** Acquia. FedRAMP, SOC 2 and managed Drupal.
- **Best to stop running servers:** Storyblok. Visual editing, nothing to patch.
- **Best for PHP teams leaving Drupal:** Craft CMS. Precise modeling, published prices.
- **Best for public-sector publishers:** WordPress VIP. FedRAMP Moderate, managed WordPress.

## Our analysts' take

Drupal 10 shipped in December 2022 and was the version most of the web's universities, agencies, governments and nonprofits settled on after the long Drupal 7 and 8 migrations. It had a good run: six minor releases, a modern admin theme, automatic updates for core and the first versions of the Canvas page builder. On 9 December 2026 that run ends. Drupal's policy is that a major version is supported until two newer majors exist, so Drupal 12's scheduled release that week closes the book on Drupal 10 regardless of whether 12.0.0 slips. The date was fixed in June 2025 and it will not move.

What makes this deadline awkward is the timing of the path forward. Drupal 11 has been available since August 2024, and Drupal 11.4 is the current line, so the upgrade is well trodden. But Drupal 12 reaches release candidate the week of 9 November and stable the week of 7 December, so a team that waited for 12 before moving now faces both deadlines in the same month, and Drupal 12 will refuse a database that has not already been through Drupal 11.3. Teams that have put off the 11 upgrade for two years are the ones with the least time.

The Drupal 7 precedent is worth remembering. Nearly two years after its end of life, roughly 170,000 sites still reported Drupal 7 to drupal.org in October 2026, each one relying on a paid third-party support vendor or on luck. Drupal 10 has no such vendor yet. This guide compares the three ways through: upgrade in place, restart on Drupal CMS or Acquia, or use the rebuild budget to leave Drupal for a platform that removes the upgrade calendar for good.

## What to look for

1. **How much has to be rebuilt.** Count your contributed modules, your custom modules and the age of your theme. Upgrading within Drupal moves all of them with tooling; moving to Drupal CMS keeps the content but replaces the editing layer; leaving Drupal means rebuilding templates and integrations from scratch. The honest size of that list decides which paths are realistic before 9 December.
2. **Who patches it next year.** Drupal 10 ends, but Drupal 11 and 12 bring the same weekly security advisories across core and modules, and Drupal 12 sets PHP 8.5 as the floor. Name the person or contract that applies releases within a day and runs the next major upgrade, or choose a platform where the vendor does it.
3. **Price over three years, not the license.** Drupal is free, so the budget is hosting, an agency or developers, and the upgrade projects that arrive on the project's calendar. Managed platforms trade that for a subscription. Compare the three-year total, including the rebuild you are about to pay for, rather than the license line.
4. **Whether marketers can work alone.** Most Drupal 10 sites were built before Canvas existed, so editors still file tickets for new page layouts. If the end-of-life project is going to touch the editing experience anyway, decide now whether marketers should be able to build pages without a developer on the other side.
5. **Compliance paperwork and data residency.** Drupal carries no certifications of its own; a SOC 2 report, a HIPAA agreement or a FedRAMP authorization comes from the host or the vendor. Public-sector and healthcare teams should list the documents procurement will ask for and check which path produces them without a second contract.

## The ratings at a glance

Fit score out of 10, weighted for this topic. Ratings run Limited, Fair, Good, Strong, Excellent.

| Rank | Platform | Fit | Low IT upkeep | Budget predictability | Speed to launch | Marketer self-service | Security & compliance | Global & multi-brand |
|---|---|---|---|---|---|---|---|---|
| 1 | [Storyblok](https://www.dxpscorecard.com/platform/storyblok) | 6.9 | Fair | Good | Strong | Strong | Good | Good |
| 2 | [Contentful](https://www.dxpscorecard.com/platform/contentful) | 6.5 | Fair | Fair | Good | Good | Strong | Fair |
| 3 | [Craft CMS](https://www.dxpscorecard.com/platform/craft-cms) | 6.3 | Fair | Good | Good | Fair | Fair | Fair |
| 4 | [Payload CMS](https://www.dxpscorecard.com/platform/payload-cms) | 6.2 | Fair | Strong | Strong | Fair | Fair | Fair |
| 5 | [WordPress VIP](https://www.dxpscorecard.com/platform/wordpress-vip) | 5.9 | Fair | Fair | Good | Fair | Good | Fair |
| 6 | [Drupal CMS](https://www.dxpscorecard.com/platform/drupal-cms) | 5.9 | Fair | Good | Fair | Good | Limited | Fair |
| 7 | [Drupal](https://www.dxpscorecard.com/platform/drupal) | 5.7 | Limited | Strong | Fair | Fair | Fair | Good |
| 8 | [Acquia](https://www.dxpscorecard.com/platform/acquia) | 5.3 | Fair | Limited | Limited | Good | Good | Good |

## The shortlist, reviewed

### 1. Storyblok (Fit 6.9/10)

The managed platform that Drupal editors adapt to fastest: marketers assemble pages visually on the live site while developers build the front end in React, Vue or Next.js. There are no servers, no security advisories to apply and no major-version upgrades, and structured content with field-level translation covers most Drupal content models.

- **Best for:** Marketing-led organizations ready to rebuild the front end with an agency and never run a patch cycle again.
- **Watch out for:** Your PHP team becomes a JavaScript team, personalization and forms come from other tools, and the governance features public-sector buyers expect sit on the quote-only Premium and Elite plans.
- **What it costs:** Free starter plan, Growth at $99 per month, Growth Plus at $349 per month; Premium and Elite quote-only.
- **Full scorecard:** https://www.dxpscorecard.com/platform/storyblok (Markdown: https://www.dxpscorecard.com/platform/storyblok.md)

### 2. Contentful (Fit 6.5/10)

The enterprise headless choice for teams that chose Drupal for structured, multilingual content delivered to many channels. Field-level localization, a full audit trail, SOC 2 and ISO 27001 certification and a hosted MCP server for AI agents come as managed software, and since September 2026 it is part of Salesforce.

- **Best for:** Developer-led enterprises and global brands that deliver Drupal content to web, apps and other channels and want certifications held by the vendor.
- **Watch out for:** Visual page building and personalization are paid add-ons, the price jumps from the $300 a month Lite plan straight to quote-only enterprise contracts, and renewal terms under Salesforce are still settling.
- **What it costs:** Free plan for learning, Lite at $300 per month; Premium and Enterprise quote-only.
- **Full scorecard:** https://www.dxpscorecard.com/platform/contentful (Markdown: https://www.dxpscorecard.com/platform/contentful.md)

### 3. Craft CMS (Fit 6.3/10)

A PHP CMS with content modeling precise enough to receive a Drupal content model, a built-in GraphQL API, one installation running any number of sites and a Plugin Store of about 1,300 extensions. A Drupal team learns it in weeks, and Craft Cloud removes the hosting work if you want it to.

- **Best for:** Agencies and in-house PHP teams running a small portfolio of bespoke marketing sites that have outgrown the Drupal upgrade cycle.
- **Watch out for:** No approval workflow, audit log, personalization or analytics, no SOC 2 or ISO certification, healthcare data is barred by contract, and self-managed installs have had a run of critical security releases.
- **What it costs:** Published. Solo free, Team $279 and Pro $399 per project with $99 yearly renewals; Craft Cloud from $130 per month.
- **Full scorecard:** https://www.dxpscorecard.com/platform/craft-cms (Markdown: https://www.dxpscorecard.com/platform/craft-cms.md)

### 4. Payload CMS (Fit 6.2/10)

For engineering teams that would rather own a TypeScript codebase than a PHP one. Content modeling is typed code, the admin panel runs inside your Next.js application, and there is no license, no feature gating and no vendor lock-in. Ownership by Figma since 2025 has kept releases steady.

- **Best for:** Product and engineering teams already on Next.js that want Drupal's control without Drupal's module ecosystem.
- **Watch out for:** Every deployment is self-hosted because Payload Cloud is closed to new customers, there are no certifications of any kind, and approval workflows and the visual editor sit behind an Enterprise contract.
- **What it costs:** Free MIT-licensed software with no paid feature tiers. Budget for Vercel or a container host and a managed database, from free tiers to a few hundred dollars a month.
- **Full scorecard:** https://www.dxpscorecard.com/platform/payload-cms (Markdown: https://www.dxpscorecard.com/platform/payload-cms.md)

### 5. WordPress VIP (Fit 5.9/10)

The managed route that keeps a PHP team. Automattic runs patching, scaling and the edge cache, bundles Parse.ly content analytics, and holds FedRAMP Moderate authorization, which no other WordPress platform does. For public-sector and publishing teams leaving Drupal, it is the shortest talent-pool argument in the market.

- **Best for:** High-traffic publishers and US public-sector teams that want WordPress skills and a vendor that holds the compliance paperwork.
- **Watch out for:** Annual contracts reported from about $25,000 with no trial, personalization and automation live outside the CMS, and the platform mandates regular upgrades where plugin compatibility stays your problem.
- **What it costs:** Quote-only on monthly unique visitors, reported from around $25,000 a year; annual contracts, no overage charges for traffic spikes.
- **Full scorecard:** https://www.dxpscorecard.com/platform/wordpress-vip (Markdown: https://www.dxpscorecard.com/platform/wordpress-vip.md)

### 6. Drupal CMS (Fit 5.9/10)

The same Drupal 11 engine with the Drupal Association's marketer setup done: Canvas as the default editor, site templates by sector, SEO, forms and multilingual recipes preinstalled since the 2.2 release in September 2026. For a Drupal 10 site whose editing layer predates Canvas, restarting here is often cheaper than retrofitting it.

- **Best for:** Marketing, higher education, government and nonprofit teams whose main complaint about Drupal 10 is that editors cannot build pages themselves.
- **Watch out for:** It is still Drupal to run: you host it, patch Canvas and the bundled modules, and will follow the same Drupal 12 calendar once the distribution moves to it. Personalization and testing are not included.
- **What it costs:** Free open-source software. Budget for a managed Drupal host and an agency or freelancer for setup and updates; premium site templates are priced in the installer.
- **Full scorecard:** https://www.dxpscorecard.com/platform/drupal-cms (Markdown: https://www.dxpscorecard.com/platform/drupal-cms.md)

### 7. Drupal (Fit 5.7/10)

The upgrade in place. Drupal 11.4 is current, Drupal 12 is scheduled for the week of 7 December, and the Upgrade Status module tells you which modules block the move. Agencies quote three to six weeks for a maintained site. You keep the content model, the permissions and the multilingual stack that chose Drupal in the first place.

- **Best for:** Organizations with a Drupal agency or in-house PHP team whose site is working and simply needs to stay supported.
- **Watch out for:** Drupal 12 requires PHP 8.5 and will not update a database that has not been through Drupal 11.3, so there is no shortcut from 10. The weekly advisories, the hosting bill and the next major upgrade stay your job.
- **What it costs:** Free open-source software. Budget for managed hosting, a Drupal partner and the upgrade calendar.
- **Full scorecard:** https://www.dxpscorecard.com/platform/drupal (Markdown: https://www.dxpscorecard.com/platform/drupal.md)

### 8. Acquia (Fit 5.3/10)

Managed Drupal with the compliance file procurement asks for: FedRAMP Moderate, SOC 2 Type 2 and a HIPAA offering, plus Site Factory for fleets of sites and a digital asset manager. Acquia ends its own Drupal 10 support on 9 December 2026, so its customers face the same upgrade, with the platform work handled.

- **Best for:** Government agencies, universities and regulated enterprises that want to stay on Drupal and need one vendor to hold the paperwork and run hundreds of sites.
- **Watch out for:** Quote-only pricing with a separate license for most marketing capabilities, a Drupal specialist still required to build, and no long-term support tier that keeps Drupal 10 alive past December.
- **What it costs:** Quote-only for the enterprise platform; tier names are public, dollar figures are not. Budget for a Drupal agency on retainer alongside the subscription.
- **Full scorecard:** https://www.dxpscorecard.com/platform/acquia (Markdown: https://www.dxpscorecard.com/platform/acquia.md)

## Upgrade in place, restart on Drupal, or leave

Every Drupal 10 site is choosing between three kinds of project, and they cost very different amounts. Decide which kind you are in before comparing platforms.

- **Upgrade: Drupal 10 to 11, then 12.** The right call when the site works and the team is in place. Run the Upgrade Status module, fix or replace the modules it flags, move to Drupal 11.4 on PHP 8.3 or later, and plan the Drupal 12 step as a separate, smaller project in 2027. Drupal 11 is supported until Drupal 13 ships, so there is no rush to be on 12 in December.
- **Restart: Drupal CMS or Acquia.** The right call when the content is fine but the editing experience, the hosting or the compliance paperwork is not. Drupal CMS gives marketers Canvas and sector templates on the same engine; Acquia gives procurement a vendor, FedRAMP and Site Factory. Both are still Drupal, so the content migrates with Drupal's own tools rather than a rebuild.
- **Leave: a managed platform.** The right call when the real complaint is the upgrade calendar itself. A Drupal 10 site that needs a new theme and a module cleanup anyway is already paying most of the price of a rebuild, and that is the cheapest moment to switch to a platform where the vendor runs patching and major versions. Expect to rebuild the front end and every integration.

## What to verify before 9 December

- **Your exact starting version.** Drupal 11 only updates databases from Drupal 10.3 or later, and Drupal 12 from Drupal 11.3 or later. A site on 10.2 or older needs an interim minor update first. Check the version before the agency quotes.
- **The PHP version your host offers.** Drupal 11 needs PHP 8.3, Drupal 12 needs PHP 8.5, and several managed hosts retired PHP 8.2 in October 2026. If your host cannot offer 8.5 by the time you need Drupal 12, the hosting decision comes before the upgrade decision.
- **Modules with no Drupal 12 release.** Drupal 12 removes a set of core modules and themes, including Claro, Olivero, Search, Shortcut and Toolbar, which move to contributed projects, and it drops Migrate Drupal entirely. Read the 12.0.0 release notes against your module list rather than trusting a count.
- **A written bridge plan if you will miss the date.** Most teams starting now will still be on Drupal 10 in January. Agree the expected go-live date with your security team, restrict the admin interface, add a web application firewall, freeze new development on the old site and apply the final 10.6 security release the day it lands.
- **Who pays for the next one.** Whichever path you choose, write down when the next major upgrade or vendor-mandated change arrives and who pays for it. Drupal publishes its dates two years out; managed vendors set their own. The team that was surprised by 9 December should not be surprised again.

## Frequently asked questions

### When is Drupal 10 end of life?

Drupal 10 reaches end of life on 9 December 2026, the week Drupal 12.0.0 is scheduled to ship. After that date the Drupal Security Team no longer covers Drupal 10 core or its contributed modules and no further Drupal 10 releases are made. Sites keep running but receive no fixes.

### Can I upgrade directly from Drupal 10 to Drupal 12?

No. Drupal 12 only updates databases that are already on Drupal 11.3 or later, so a Drupal 10 site must first move to Drupal 11, which in turn requires Drupal 10.3 or later as the starting point. The practical path is Drupal 10.6, then Drupal 11.4 or 11.5, then Drupal 12 when you are ready.

### Is there extended support for Drupal 10?

As of early November 2026, no. Acquia states there is no long-term support tier for Drupal 10 past December 2026, and the vendors that sell extended support for Drupal 7, such as HeroDevs and Tag1, have not announced a Drupal 10 program. Plan on upgrading or on a documented interim security plan.

### How long does a Drupal 10 to Drupal 11 upgrade take?

Agencies quote three to six calendar weeks for a maintained site with 40 to 60 contributed modules and eight to sixteen weeks for a complex or neglected one, with enterprise estimates running from the mid tens of thousands of dollars upward. Custom modules, an old theme and a PHP version below 8.3 are the usual causes of delay.

### Should I move to Drupal CMS instead of upgrading Drupal 10?

Consider it when your editors cannot build pages without a developer. Drupal CMS is Drupal 11 with the Canvas page builder, site templates and SEO, forms and multilingual tooling preinstalled, so content migrates with Drupal's own tools. It remains self-hosted software with the same security advisories and the same Drupal 12 calendar ahead.

### What are the best alternatives to Drupal in 2026?

For teams leaving Drupal, Storyblok and Contentful rate highest for marketing-led and enterprise content teams that want a managed platform with no servers to run. Craft CMS keeps a PHP team productive, WordPress VIP offers managed WordPress with FedRAMP authorization, and Payload suits engineering teams on TypeScript. Acquia is the choice for staying on Drupal with a vendor behind it.

## How we rated these platforms

Each rating combines the relevant criteria from the DXP Scorecard's independent scorecards into a five-point scale. The Fit score blends these ratings, weighted for this topic, into one number out of 10, and is recalculated whenever a scorecard is updated:

- Low IT upkeep (33%): After launch, how much effort does it take just to keep it running?
- Budget predictability (22%): Will the price be clear up front, and will it stay reasonable as we grow?
- Speed to launch (17%): How fast can we go live, and how big a team does it take?
- Marketer self-service (17%): Can my team build and change pages without filing a ticket?
- Security & compliance (11%): Will legal, security and procurement sign off?

Scorecards and platform inclusion are unsponsored: no vendor pays to appear in this guide or to change a rating. Methodology: https://www.dxpscorecard.com/scoring-framework