What actually happens on 9 December
Your site will keep running. Nothing switches off. What stops is the thing that keeps it safe.
The Drupal Security Team stops reviewing and patching Drupal 10 core. Contributed module maintainers drop Drupal 10 support as they move on. Hosting providers, including Acquia and Pantheon, end their Drupal 10 support on the same date. When the next critical vulnerability is published, and in Drupal's history one arrives every year or two, there will be no fix for your version.
For a government department, a university or a regulated organisation, that is not a technical footnote. It is an unsupported system holding public-facing content, often with personal data behind it, and the Essential Eight and most internal security policies say the same thing about unsupported software: it has to go.
Drupal 7 sites are already past this point. Drupal 7 lost official support in January 2025, and the gap between a D7 site and a current one is now a full rebuild, not an upgrade.
How to check which version you are on
If you have admin access, go to Reports → Status report; the version is the first line. If you don't, look for a CHANGELOG.txt or core/ folder on the site, or ask whoever last invoiced you for maintenance. If nobody can tell you, that is the answer: send us the URL and we will tell you.
Your three paths
Upgrade to Drupal 11. For a well-maintained Drupal 10 site this is the normal route: an incremental upgrade on the same architecture, measured in weeks, not months. The work is mostly in contributed modules, custom code and the hosting stack (PHP, database and Composer versions), not in content.
Wait for Drupal 12. Drupal 12 ships the same week Drupal 10 ends. Landing on it directly is possible but means being an early adopter of a brand-new major release during the holiday period, with less contributed-module coverage. We recommend it only for sites with a reason to skip 11.
Rebuild. Drupal 7 sites, and Drupal 10 sites whose original agency is gone and whose custom code nobody understands, usually cost less to rebuild on a maintained distribution than to drag forward. For Australian government this often means GovCMS, where the upgrade burden sits with the platform rather than with you.
Which path is right depends on four things: the version, how much custom code there is, the state of the hosting, and whether anyone still knows how the site was built. That is what the Risk Check looks at.
The free Upgrade Risk Check
Send us your site's URL. Within two business days you get a one-page report covering:
- Your current Drupal and PHP version, and the date support ends for each
- Contributed modules we can see that have no Drupal 11 release
- Hosting and platform signals that will block an upgrade
- Our recommendation: upgrade, rebuild or hold, with an effort band
There is no cost and no obligation. If the report says you are fine, we will say so. If it says you have a problem, you will have it in writing before 9 December.
