Drupal 10 ends on December 9: a site-by-site triage for agencies

Drupal 10 gets no more security fixes after December 9, 2026. If your agency still has a handful of client sites on it, that date is five weeks away.

Most agencies I talk to are in the same place. They moved to WordPress, headless or marketing years ago. They kept a few Drupal clients because those clients stay: a federation, a public body, a non-profit that has had the same site since 2017. Nobody in the agency touches Drupal any more, or one person does, in the evenings.

You do not need to move every site before December 9. You need to know which ones have to move first, and which ones can wait a few weeks without putting your client at risk.

What waiting costs

Nothing breaks on December 10. The sites stay up. That is why waiting feels safe.

What changes is quieter:

The next security advisory for core comes with a fix for Drupal 11 and nothing for Drupal 10.
Contributed modules start dropping Drupal 10 from their new releases. A fix you need lands on a version you cannot install.
Your contract with the client probably says you keep the site secure. After December 9 you cannot, and the client will not read the release notes to find out why.

Then there is the commercial cost. In October an agency told me its client’s move to Drupal 11 was planned and waiting for the client’s budget. I hear that answer more than any other, and it usually ends one of two ways. The move happens in the spring, in a hurry, after an advisory, at a higher price. Or another provider offers the client the migration, and then the maintenance, and then the next site.

So the useful question is which sites you can afford to wait on.

Three piles

Sort every Drupal 10 site you hold into one of three piles.

Pile 1: move before December 9

Two kinds of site go here.

The easy ones. A site where every contributed module already has a release for Drupal 11, no text format still runs on CKEditor 4, the host already runs PHP 8.3, and the custom code is small. On a site like that, the move is close to mechanical: one day of work, plus testing. There is no reason to carry it into January.

The exposed ones. A site that takes personal data through forms, has user logins, takes payments, or belongs to a public body or a health organisation. If a core advisory lands in December, that site is the one your client will hear about. It moves first, even if it is harder.

Pile 2: move in January, under watch

Sites with a real blocker that cannot be cleared in five weeks. A module with no Drupal 11 release, a host stuck on PHP 8.1, a custom module that leans on removed APIs.

Waiting on these is fine as long as you decide it:

Put them on the latest Drupal 10 release before December 9.
Check the security advisories every Wednesday, when Drupal publishes them, and know in advance what you do if a critical one lands.
Tell the client in writing that the site moves in January, and why. A client who was told keeps trusting you. A client who finds out does not.
Give each site a date. “January” without a date becomes March.

Pile 3: retire or rebuild

Every portfolio has a few. The campaign site from 2019 that nobody updates. The microsite the client forgot it pays for. The site that has grown so far from its build that a rebuild costs less than a migration.

For these, the next step is a conversation with the client. Archive it as static pages, fold it into the main site, or rebuild it in whatever your agency sells today. That last one is new revenue for the agency.

How to sort ten sites in an afternoon

You do not need a developer to make the first cut. For each site, write down six things.

Six checks per site
Check	Where to find it	What it tells you
Exact Drupal version	Status report, in the admin	How far the site is from the latest Drupal 10 release
PHP version on the host	Status report, or the host’s panel	Below 8.3 means the host has to move first
Modules without a Drupal 11 release	Upgrade Status module report	The single biggest price driver
Custom modules and themes	The codebase, or the Upgrade Status report	Small and clean, or a week of work
Forms, logins, payments	Clicking through the site	How exposed it is after December 9
What the contract promises	Your contract with the client	Whether waiting is your risk or theirs

Exposed and easy goes in pile 1. Exposed and hard also goes in pile 1, with a firm date. Quiet and hard goes in pile 2. Unused goes in pile 3.

The version number alone tells you nothing about the price. Two sites on the same Drupal 10 release can be a day apart or two weeks apart. The difference is always in the modules, the custom code and the host.

What a Drupal 9 to 11 jump actually costs, and the four conditions that set the price

How I work on this

I keep agencies’ Drupal sites running under their name, when they no longer have a Drupal developer. Their client only ever talks to them.

Since 2018 I have kept one agency’s portfolio: 17 Drupal sites for Belgian non-profit, health and social housing organisations, run on a single procedure. 10 are already on Drupal 11. Since 2021 I have logged 573 interventions on that portfolio, 292 of them security updates, with no major incident. Requests come in on Tuesday and are handled on Thursday morning. Thursday and Friday stay free for anything that blocks.

For an agency facing December 9, the work comes in this order:

Portfolio audit: 450 EUR for up to 10 sites, then 35 EUR per site. Version, blockers, a fixed price per site and the order to move them in. Delivered in three working days.
Drupal 10 to 11 upgrade: from 1,100 EUR per standard site. The firm price comes out of the audit. Work on staging, live only after your sign-off.
White-label maintenance: 140 EUR per site per month, from five sites. Security and minor updates, monitoring, two hours of small requests, and a monthly report you send your client under your name.

You resell each of these at your own price. You know what you pay before you quote.