Why upgrade to Drupal 11: security, compliance & EOL risk
Drupal 10 reaches end of life on 9 December 2026. Drupal 10.6 is its final minor release, and Drupal 12 ships the same week, on 7 December 2026. Drupal 9 (EOL November 2023), Drupal 8 (November 2021), and Drupal 7 (January 2025) are already past end of life, and every unpatched release cycle adds exploitable CVEs to sites still running them. Drupal 11 is expected to be supported into December 2028, the only major version with a long runway and the sustainable path forward.
Corporate compliance risk
For a regulated organization, an unsupported CMS is a direct compliance liability. Under GDPR Article 32, unpatched software can fall short of the "appropriate technical measures" expected of data protection. NIS2 requires essential and important entities to keep all software actively patched and vendor-supported. The ENS (Esquema Nacional de Seguridad) effectively expects regulated suppliers to run hardened, vendor-supported CMS versions. Metadrop is ENS-certified and delivers WCAG 2.1 AA as the legal accessibility baseline.
Drupal 11 is a platform leap forward
Drupal 11 ships with Symfony 7, PHP 8.3, and CKEditor 5, alongside Single Directory Components (SDC), Recipes, Workspaces, and Project Browser. It modernizes editorial workflows, simplifies theme architecture, and opens the door to the AI-assisted content tooling emerging across the Drupal ecosystem. The performance gains are measurable: a lighter front end, BigPipe on by default, and PHP 8.3 typically improve TTFB and Core Web Vitals. The compatibility window is also closing, because contributed modules are dropping Drupal 9 and early Drupal 10 support, so staying put means inheriting orphaned modules within months.
The risk of delaying your Drupal upgrade
Once a site falls off supported releases, every new CVE in core or contrib stays exploitable indefinitely, with no security patches on the way. That exposure now surfaces in audits: DPO reviews, NIS2 reporting, ENS recertification, and procurement questionnaires increasingly treat an unsupported CMS version as a blocking finding.
The technical ground shifts underneath you at the same time. Maintainers are cutting Drupal 9 and early Drupal 10 support, so a CRM, SSO, search, or commerce integration can break on the next contrib release. Hosting follows the same curve: PHP 7.x and MySQL 5.7 are end of life, and Acquia, Pantheon, Platform.sh, and Upsun are deprecating the PHP versions older cores depend on.
Waiting also gets more expensive. Each missed minor release adds deprecated APIs and schema changes, so the Drupal 8-to-11 gap widens every month. The hardest cost to quantify is reputational: a breach on a public, end-of-life platform is difficult to defend to a board, to customers, or to a regulator.
A free assessment maps your current version, modules, and integrations against the December 2026 deadline.
The Drupal upgrade path: no rebuild, content preserved
Your site is upgraded in place. There is no re-platforming, no re-keying of content, and no loss of historic URLs, user accounts, or media library entries. Configuration carries over with it: content types, fields, views, blocks, taxonomies, menus, roles, permissions, and language settings, without manual recreation.
SEO equity is safeguarded. URLs, metatags, redirects, canonical settings, hreflang, and XML sitemaps are audited before and after, and 301 maps are validated, to minimize the risk of losing organic rankings. Integrations stay connected in the same way: SSO (SAML, OAuth, OpenID), Salesforce, HubSpot, SAP and ERP middleware, payment gateways, Solr and Elasticsearch, and analytics tags are all tested end-to-end on pre-production before release.
The analysis phase establishes the scope before any code is written. The further back your starting point, the more deprecated APIs and module replacements are needed, and the analysis quantifies exactly that.
Drupal version paths: 8, 9 or 10 to Drupal 11
Drupal 8 to Drupal 11
A two-step path: Drupal 8 to 9, rebuilding Composer dependencies and replacing deprecated APIs through Drupal Rector, then 9 to 11. Database, files, users, and configuration migrate in place. Typical timeline: 8-16 weeks.
Drupal 9 to Drupal 11
The most common 2026 starting point, run as Drupal 9 to 10 to 11: CKEditor 4-to-5 migration, Symfony 4 to 7, removing jQuery UI, and major version bumps for modules like Address, Webform, and Paragraphs. Typical timeline: 4-10 weeks.
Drupal 10 to Drupal 11
The smoothest starting point. Most contributed modules are already Drupal 11 compatible. Key checks: PHP 8.3, MySQL 8.0/MariaDB 10.6, Drush 13, Composer 2.7. Typical timeline: 2-5 weeks.
Our Drupal 11 upgrade roadmap
Analysis
Full site audit covering content architecture, custom code, contributed modules, core deprecations, vendor dependencies, and frontend libraries. Nothing is changed at this stage; we only measure. Closes with a written upgrade plan: effort estimate, risk register, rollback strategy, and timeline.
Implementation
Core managed through Composer, custom modules and themes adapted, contrib patched or forked where needed. Database work runs schema updates and config migration. Server moves to PHP 8.3, Drush 13, Composer 2.7. Content moves from CKEditor 4 to 5.
Testing
Automated testing with Behat, BackstopJS, Postman, and PHPUnit. Manual testing covers content workflows, multilingual routing, SSO login, payments, forms, WCAG 2.1 AA, and a full SEO check. A performance baseline is taken before and after with Lighthouse and WebPageTest.
Release
Pre-production dry run with a full production data sync. Production deploy inside a maintenance window, typically under 30 minutes, with zero-downtime cutover where supported. Backed by a 7-day hypercare window and a final compliance, security, and SEO report.
Send your current version, module list, and integrations, and you get a written upgrade plan and effort estimate with no commitment.
Why Metadrop for your Drupal upgrade
Metadrop brings 15+ years of Drupal-specific delivery as a Drupal Silver Certified Partner, with 100+ contributed modules and 500+ open-source contributions on drupal.org. Our EU-based team holds ENS certification and a track record across GDPR, NIS2, and WCAG 2.1 AA, with upgrades shipped in 30+ languages and 50+ countries. The analysis phase is fixed-fee, so the written upgrade plan is yours to keep whatever you decide next, and the implementation quote is firm with no hidden change orders. One dedicated Drupal-specialist team owns the upgrade from analysis through hypercare, with independent technical governance throughout.
Our upgrade work spans sectors and scales. We carried a global industrial-materials manufacturer with operations in 70+ countries through consecutive Drupal 7 to 9 to 10 to 11 upgrades, completing the Drupal 11 transition without disruption after an earlier migration that refactored 5,700 content items. For a multinational home-appliances and HVAC manufacturer, we handled the Drupal 10 to 11 upgrade while turning a single site into a multisite platform and moving from on-premises hosting to Upsun cloud, with a Jenkins CI/CD pipeline and a zero-downtime target. A 35-country gluten-free food manufacturer running 22 languages moved from Drupal 9 to 10 to 11 (to 11.3) on PHP 8.4, including the CKEditor 4-to-5 migration and ongoing WCAG 2.1 remediation.
We also delivered consecutive Drupal 7 to 9 to 10 to 11 upgrades for a global B2B wind-energy e-commerce marketplace, training the in-house team for operational autonomy along the way. We upgraded an energy-transition engineering group's seven-site Drupal estate to Drupal 10 and then Drupal 11. And we migrated a public-sector ombudsman institution from Drupal 9 to Drupal 10 across three languages, preserving eight content types, taxonomies, roles, media, and files alongside Solr search and WCAG AA.
Metadrop engineers have also published practitioner guidance on updating Drupal to PHP 8, migrating databases from MySQL 5.7 to 8, adopting Composer 2, upgrading Solr 9 on Acquia, and deciding when to update core and modules, which is the exact deprecation, dependency, and stack work an upgrade turns on.
They've Trusted Metadrop
From manufacturing and energy to public institutions and international NGOs, organizations across 50+ countries have relied on Metadrop to keep their Drupal platforms current, secure, and supported.
Drupal upgrade vs. migration, and the upgrade + revamp option
Upgrade vs. migration
A Drupal upgrade moves a site between Drupal major versions, for example 9 to 11, with content, users, config, and integrations preserved in place. A Drupal migration is a different job: it moves content from a non-Drupal CMS such as WordPress, Sitecore, AEM, or Joomla, or from Drupal 6 or 7, into a fresh Drupal instance using the Migrate API, covered on our migration to Drupal service. Drupal 7 to 11 is technically a migration rather than an upgrade, so it runs through our Drupal 7 support & migration service. Upgrades are usually faster, lower risk, and lower cost, because data and configuration carry over without re-mapping.
Upgrade + revamp option
A standard upgrade keeps your design, information architecture, and editorial model intact, which is the right choice when the version is the only thing that needs to change. An upgrade + revamp pairs the version move with a design refresh, an accessibility uplift, an SEO restructure, or new feature work, delivered as a single project plan so you avoid two separate change windows. The common triggers for a revamp are an outdated visual identity, WCAG 2.1 AA accessibility gaps, a legacy information architecture, or the chance to adopt SDC and Recipes for faster future iteration.
Drupal upgrade: frequently asked questions
How long does a Drupal upgrade take?
Timelines depend on your starting version: Drupal 10 to 11 takes 2-5 weeks, Drupal 9 to 11 takes 4-10 weeks, and Drupal 8 to 11 takes 8-16 weeks. The main drivers are the number of custom modules, integration complexity, and multilingual or multi-site scope.
How much does a Drupal upgrade cost?
Cost depends on your starting version, the amount of custom code, the contrib modules and integrations in play, and whether you choose an upgrade only or an upgrade + revamp. The fixed-fee analysis phase comes first; once you sign it off, the implementation quote is firm and does not move afterwards.
Will my content, users, and SEO be preserved?
Content, users, configuration, URL aliases, metatags, redirects, hreflang, sitemaps, and structured data all carry over. A full SEO audit runs before and after release to minimize the risk of ranking loss, though no one can guarantee rankings, which Google alone controls.
Will my contributed modules and custom code work on Drupal 11?
We scan your site with Upgrade Status and Drupal Rector to find deprecated APIs and incompatibilities. Where a module is not Drupal 11 ready, we patch it, replace it with a supported alternative, or fold its function into a custom module.
When does Drupal 10 reach end of life, and how long is Drupal 11 supported?
Drupal 10 support ends on 9 December 2026 (10.6 is the final minor release). Drupal 11 is expected to be supported into December 2028 (its end of life follows the Drupal 13 release), which makes it the sustainable target today.
Will my site experience downtime during the upgrade?
Most upgrades land inside a maintenance window under 30 minutes with a tested pipeline. High-availability sites can cut over with zero downtime using blue/green or rolling deployment.
What is the difference between a Drupal upgrade and a migration?
An upgrade moves you between Drupal major versions (8, 9, or 10 to 11) and preserves the existing site. A migration moves content from a different CMS, or from Drupal 7, into a fresh Drupal instance through the Migrate API.
Do you offer post-upgrade support and maintenance?
Yes. A 7-day hypercare window is included with every upgrade. Ongoing proactive monitoring, security patching, and evolutive work are covered by our Drupal maintenance & support service.
Get a free Drupal 11 upgrade assessment
Tell us your current Drupal version, your hosting, and your key integrations, and you receive a written upgrade plan, effort estimate, and risk register within 5 business days. Our EU-based team responds within one business day, and there is no commitment: you keep the plan even if you decide not to proceed.