CMS Care Lab
Unsupported since 24 February 2016

Drupal 6 end of life — your upgrade path

Drupal 6 lost official support in February 2016. A live D6 site today is far past community security coverage. The fix is a migration to Drupal 10 or 11 — not another patch on a PHP 5-era stack.

Get a free assessmentSee the path

Why this still matters

Why Drupal 6 still shows up in search — and in production

Some intranet, association, municipal, and long-tail public sites never left Drupal 6. Hosting may still limp along on frozen VMs; attack surface and compliance risk do not. If you found this page, chances are a D6 site is still serving traffic or internal staff still depend on it.

Drupal 6 reached community end of life on 24 February 2016 — three months after Drupal 8’s release, per the project’s extended policy at the time. That is years longer than Drupal 7’s more recent EOL, which already sits behind us. A decade without official security advisories is not a theoretical risk; it is a standing invitation for automated scanners and a problem for any audit that asks “is software vendor-supported?”

Typical reasons sites remain on Drupal 6: the original agency disappeared, the only developer who understood the theme left, leadership underestimates public exposure of an “internal” site that somehow acquired a public DNS name, or budget repeatedly favoured new projects over platform hygiene. None of those reasons make the stack safer.

Path forward

Migrate to modern Drupal — same model as D7

New Drupal 10 or 11 site

There is no in-place upgrade button. Stand up supported core and move content in with the Migrate API.

Content & users migrate

Nodes, users, taxonomy, and files can be carried across. Themes and custom modules are rebuilt.

Prefer Drupal 11 in 2026

New projects should land on Drupal 11 to avoid a near-term follow-on upgrade from Drupal 10.

  • Inventory what content is worth keeping vs archive
  • Confirm backups and whether a restore was ever tested
  • Decide public replatform vs controlled takedown + redirects
  • Fixed-price plan after a short assessment

Technical reality

What a Drupal 6 → modern Drupal project looks like

Modern Drupal still documents migration paths from Drupal 6. In practice you connect the Migrate system to the D6 database (and files directory), generate or customise migration plugins, and import into a fresh Drupal 10/11 install. Themes, PHPTemplate, and most custom modules do not carry forward; they are rebuilt or retired.

Expect archaeology. Drupal 6 sites often have undocumented CCK fields, Views exports nobody can re-create, file paths on forgotten NFS mounts, and admin passwords written in sticky notes. The assessment digs into those realities so the fixed price covers them instead of pretending they do not exist.

Sometimes the honest answer is not a full editorial Drupal rebuild. If the site is brochure content that rarely changes, a static archive (or a simpler CMS) plus 301s to a successor property can be safer and cheaper. I will say that when it is true — migration for migration’s sake is not the goal.

First week

Practical first steps this week

Confirm you have a recent, restore-tested backup of database and files stored somewhere other than the production server. Export or screenshot the list of content types and enabled modules. Identify who still has admin access and whether the site must stay editable day-to-day.

Next, decide the outcome you want: (A) fully editable Drupal 10/11 successor, (B) read-only public archive with redirects from old URLs, or (C) takedown of obsolete content with careful 404/410 handling for junk and 301s for anything that still earns traffic. Then request an assessment so scope is not a guess.

If you are on Drupal 7 instead, use the Drupal 7 end of life guide — newer EOL date, same need to leave unsupported core.

Risk framing

Security, compliance, and “but it’s only intranet”

Intranet branding does not equal isolation. Many Drupal 6 installs are reachable from the public internet, use single-factor shared passwords, and store personal data in profile fields or webforms. Unsupported PHP stacks also mean the OS image may lag, because nobody wanted to touch the box.

If your organisation answers vendor or insurance questionnaires, unsupported CMS software is a yes/no question with the wrong answer. Migrating — or deliberately decommissioning with evidence — is often cheaper than explaining an incident on a platform that lost support in 2016.

Questions

Drupal 6 EOL — FAQ

When did Drupal 6 reach end of life?

24 February 2016. No official community security updates since then.

Can Drupal 6 go to Drupal 11?

Yes. Build a new Drupal 10/11 site and migrate content with the Migrate API. Themes and custom code are rebuilt.

Should we just shut the site down?

Sometimes. If there is no editorial need, an archive plus redirects can be safer and cheaper than a full rebuild — we will say so honestly after the assessment.

Is Drupal 6 harder than Drupal 7 to migrate?

Often yes — older PHP, scarcer hosting knowledge, and deeper abandonment of custom code. The process shape is the same; the archaeology is heavier.

Related

Where to go next

Still running Drupal 6?

Get a free assessment — migrate, archive, or redirect with a clear fixed-price plan.

Request your free assessment