Federal Website Owners: What to Do Before Drupal 10 Support Ends
Drupal 10 reaches end of life on December 9, 2026. After that date, Drupal will no longer provide security updates, bug fixes, or new releases for Drupal 10.
For a federal website, this is not simply a routine technology update. Continuing to operate an unsupported content management system can create security, compliance, and operational risks—especially when the site is part of an authorized system or supports a public-facing mission.
The practical question is: Do you know whether your website is still receiving Drupal security updates, and do you have a funded plan to address it before support ends?
Why this matters to federal programs
When software is actively supported, security vulnerabilities can be addressed through vendor-issued updates. Once that support ends, new vulnerabilities may be identified without an official fix available.
That can affect:
- Your security posture and vulnerability-management process
- ATO documentation and ongoing security reviews
- POA&M remediation planning
- Section 508 testing after changes are made
- Integrations with login, search, forms, analytics, and other agency services
- Your ability to respond quickly during an audit or security incident
For program managers and product owners, the main risk is not that the website suddenly stops working on December 9. The risk is that the site becomes harder—and potentially more expensive—to operate, secure, and defend after that date.
The first step: confirm what version your site uses
Not every Drupal 10 site has the same level of support today.
Drupal has released several Drupal 10 versions over time. Earlier versions are already out of security support. Drupal 10.6.x is the final supported Drupal 10 version, and that support ends December 9, 2026.
Ask your technical team or website contractor to provide a short written assessment answering:
- What exact Drupal version is the site running?
- Is that version currently receiving security updates?
- What extensions, custom features, and integrations must be updated?
- What accessibility, security, hosting, and testing work will be required?
- What is the recommended path, cost range, schedule, and risk level?
This assessment should give you a clear decision document—not a technical report you need a developer to interpret.
Plan for an upgrade, not an emergency repair
For most federal organizations, the right near-term destination is Drupal 11.
Drupal 12 is expected in December 2026, but many websites will need time for their extensions, integrations, and custom features to become compatible with it. Moving first to Drupal 11 is generally the practical way to get onto a supported platform while preparing for the next lifecycle transition.
An experienced Drupal partner should help you decide between two approaches:
- Upgrade the existing site when the site is stable, its features remain appropriate, and the work is primarily about bringing the platform current.
- Modernize or rebuild key portions of the site when it has accumulated years of difficult-to-maintain custom work, outdated features, accessibility problems, or business needs the current site no longer meets.
The right answer depends on the condition of the website—not simply its age. A low-cost upgrade that preserves fragile components can create another expensive problem later.
Include security and procurement stakeholders early
A Drupal upgrade is more than a development task. It may require coordination among the program office, product owner, ISSO or security team, accessibility staff, hosting provider, and contracting office.
Start those discussions now, especially if you need:
- A task order, BPA call, modification, or new procurement action
- Budget approval in the next fiscal cycle
- Security or ATO documentation updates
- Testing for accessibility, performance, and integrations
- A hosting-environment update
Federal procurement and security review timelines often take longer than the technical work itself. Waiting until late 2026 could leave your team with few options and less leverage to plan the work carefully.
A practical next-step checklist
Over the next few weeks, federal website owners should:
- Confirm the Drupal version and current support status.
- Obtain an upgrade-readiness assessment and preliminary schedule.
- Identify security, accessibility, hosting, and integration impacts.
- Decide whether the site should be upgraded or more substantially modernized.
- Determine the contracting path and secure funding before the deadline.
- Build a plan that moves the site to Drupal 11 while keeping Drupal 12 readiness in view.
How Agileana can help
Agileana helps federal agencies assess, modernize, and maintain Drupal websites with security, accessibility, mission needs, and procurement realities in mind. We can provide a current-state assessment, identify the work required to reach a supported version, and develop a realistic migration plan for your program and contracting timeline.
If your site is running Drupal 10, the time to begin planning is now—not after support ends on December 9, 2026.