If you manage a Drupal website, you are probably aware that “End of Life” or “EOL” for all current versions is scheduled for November 2021. Official community support will cease to exist.  These versions will no longer be supported by core maintainers with fixes, security releases, or enhancements. As a result, starting in November 2021 website data and infrastructure for Drupal 7 and Drupal 8 sites will be significantly more vulnerable to hacking. While this can sound terrifying at first, the reality is a lot more manageable than it might at first appear. In this article I will clarify some of the uncertainties and go over how you can plan for a seamless migration over the coming year.

When Drupal 9 is available starting June 2020, there are a few different upgrade or replacement paths available, which we will cover in this article. The Drupal community leaders believe that 18 months is a sufficient window of time for all Drupal website owners to upgrade their site to Drupal 9. From our perspective the Drupal customer base would have benefitted from a staggered EOL schedule, essentially spacing out the Drupal 7 EOL and Drupal 8 EOL by 12 months. But the schedule has been set, so let’s go over the implications.

What happens if I don’t upgrade my Drupal site?

Drupal 7 was first released in 2011 and Drupal 8 was first released in 2015. In internet years, that qualifies these CMS platforms as approaching ancient. It makes sense that the underlying software foundations of Drupal need to be updated to be performant, maintainable, and secure. Drupal 9 will address all these issues, but that also means that all current Drupal 7 and 8 sites will need to be upgraded to Drupal 9 or replaced prior to November of 2021.

After End of Life for both Drupal 7 and Drupal 8, the developer community will no longer focus their efforts on improving or patching those versions. Existing modules will likely not receive any further updates through the community, as developers pivot to focus on Drupal 9 modules. This won’t be felt immediately, as it takes time for new security exploits to be discovered in the Drupal core and modules. But within 60 days of the last security update to your Drupal installation, you should assume your site has serious vulnerabilities that put it at risk of being hacked.

If you keep your Drupal 7 or 8 website running without upgrading it to Drupal 9, you will be faced with one of the following options:

• Accept that your site will become less secure over time, as new security exploits are discovered and not patched through the core Drupal maintenance channels. 
• Purchase extended commercial support for your website. Instead of relying on the Drupal community to address exploits and release patches, you are paying a private company to do that for you.

How much work is it to upgrade from Drupal 7 to Drupal 9?

Going from Drupal 7 to Drupal 9 can be a significant effort, comparable to rebuilding the site from the ground up on Drupal 9. Some of the factors that determine the effort are:

• How many customized content types and templates are in use? The more customized content types that are in place, the more they may require more manual migration.
• Are the modules in use “contributed” or heavily-used? Popular modules will likely have better community support and might already have been updated to work with Drupal 9.
• There is a long list of known issues when upgrading from Drupal 7. Could any of these apply to your site?

How much work is it to upgrade from Drupal 8 to Drupal 9?

If you’ve kept your Drupal 8 site up-to-date, this upgrade could be relatively smooth. The Drupal core team is confident that upgrading from the latest version of Drupal 8 to Drupal 9 is comparative in effort to a regular Drupal 8 update (such as updating from 8.8 to 8.9). The idea is that the latest versions of Drupal 8 and modules will already have been updated to stop relying on modules and APIs that will be removed in Drupal 9.

That being said, the more customized your Drupal 8 installation is, the lower the probability for a smooth upgrade. Once again, relying on popular, heavily-used modules will make it more likely that your site will seamlessly survive the update to Drupal 9.

Using a Drupal specific hosting service, such as Pantheon, can assist in keeping Drupal up-to-date and ultimately help future proof your site for Drupal 9. 

Source: https://dri.es/plan-for-drupal-9

Should I upgrade my existing site to Drupal 9 or rebuild it on Drupal 9?

There are many factors that figure into the decision if you should leverage the codebase you already have or start from scratch with Drupal 9. Depending on the specifics of your site, the level of effort required to upgrade your existing site to Drupal 9 could be very similar to the level of effort required to rebuild it from the ground up on the new version of Drupal 9. Below are some of the benefits of either approach.

Rebuilding a site from the ground up on Drupal 9 could have the following benefits:

• It opens the opportunity to review the existing site design and work on improving UX and UI, while utilizing new tools available in Drupal 9.
• Doing a visual “refresh” of the site as part of a site rebuild, might allow the opportunity to do a full review of content types, template needs, asset requirements, etc. that come out of the user experience (UX) and user interface (UI) design process.
• Improved user experience for administrators of the site due to the ability to leverage new Drupal 9 core features and its simplified content management scheme. If upgrading from an older version of Drupal, content types, templates, and modules will likely carry over from the existing site, negating some of the new benefits of Drupal 9.
• Improved maintainability for developers due to closer alignment with current Drupal community best practices, as well as usage of current libraries and modules.
• Ability to utilize new Drupal features such as publishing workflow and new media library, which may not be as easily accessible to take advantage of when doing a migration.

Upgrading a site to Drupal 9 could have the following benefits:

• If the site is on a recent version of Drupal 8 (such as 8.7 or 8.8) with up-to-date modules, then the upgrade to Drupal 9 should be relatively smooth and a significantly lower effort than rebuilding your site from scratch.
• If popular, heavily-used modules are installed on the site, these will likely already support Drupal 9 by the time it is released.
• Retaining the existing content types, templates, and modules will result in less training time for administrators of the site.

When should I start the process of moving to Drupal 9?

Every Drupal site owner should have their move to Drupal 9 completed by the beginning of Q4/2021. Depending on your site and the path that you take, getting there may be a 3-month or a 12-month project. 

Also, take into consideration that Drupal development teams will be in high demand as the EOL deadline approaches in 2021. Waiting until the last minute to begin the process may leave you without help to complete the move to Drupal 9 in time. We are underway with this process for several of our clients, putting us on track to complete the first Drupal 9 migrations in late 2020.

Mapping a path forward

Now is the time to begin planning around what this timing means for your site. The good news: you have time to devise your plan and finalize your path forward. The bad news: this process is inevitable as old versions of Drupal will soon no longer be supported. Get started now so you don’t find yourself with a vulnerable site that becomes a target for hackers.