It's the gift that keeps on giving the whole year, Clark

I have been counting Drupal sites for a fortnight and I cannot stop thinking about Clark Griswold standing in his driveway, holding an envelope.

You remember the scene. He has done the maths. The Christmas bonus is coming, he has already put a deposit on the swimming pool, he has the brochure. Then he opens the envelope and it is a one year membership to the Jelly of the Month Club. And Cousin Eddie, who has been living in an RV on the drive since November and has an opinion about everything, delivers the only line in the film that anybody can quote from memory: it is the gift that keeps on giving the whole year, Clark.

That is Drupal 10, and the envelope opens on the ninth of December.

What is actually in the envelope

Here are the facts, which are duller than the film and considerably more expensive.

Drupal 10 stops receiving security coverage on 9 December 2026. Not "gets a bit old." Stops. The same week, Drupal 12 ships, which is a lovely bit of scheduling if you enjoy irony. After that date, when somebody finds a hole in Drupal 10, and somebody will, there is no patch coming. What arrives instead is an advisory, then another one, then another one, once a month, all year, like a small jar of preserves you did not order.

So I went and measured how many people are about to open that envelope. We scanned live sites and read the version each one publishes about itself: 2,226 reachable Drupal sites, drawn from the most-visited domains on the internet.

Nearly half of them, 48.5 percent, are on Drupal 10.

Another 17 percent are on something already dead. Drupal 9 stopped getting fixes in November 2023. Drupal 8 in 2021. And 193 sites in our sample are still running Drupal 7, which has been unsupported since January 2025, which means somebody has been receiving jelly for nineteen months and has stopped opening the post.

Add it up and 69.9 percent of the Drupal sites that will tell you their version are either unsupported already or lose support in December. Seven in ten. The margin on that is plus or minus two points, so call it seven in ten and sleep fine.

Just 28 percent are on Drupal 11, current and patched. Those are Todd and Margo next door, with the tasteful single candle in each window.

The part where doing everything right does not save you

Now, the bit I did not expect, and the reason I think this is a story rather than a statistic.

You would assume the worst-run sites are the most exposed. They are not. Look at who is sitting on Drupal 10:

Government and universities are the best in the dataset at not running dead software. Six and eight percent, against seventeen for commercial sites. These are the people who did the upgrades, filed the tickets, sat through the change advisory board, and got themselves onto a supported version like responsible adults.

And that is precisely why they are stacked, sixty percent deep, on the branch that dies in December.

Clark did not lose the pool because he was careless. He lost it because he counted on the bonus, and the bonus was a subscription. Doing it properly is what put him in the driveway holding the envelope. There is no version of this where the diligent public sector team gets rewarded for having upgraded on schedule, because the schedule was never theirs.

The lights are working, which proves nothing

Here is the thing about those 25,000 imported Italian twinkle lights. They did work, eventually. For one glorious moment the whole house lit up and the neighbours had to shield their eyes.

None of that told Clark anything about the wiring.

A site on unsupported Drupal looks completely fine. It serves pages, takes form submissions, ranks where it ranked yesterday. Nothing on the surface changes on 10 December. That is the entire difficulty: the failure mode is invisible right up until it is a headline, and every month it stays invisible makes the case for spending money on it weaker.

Which is where our numbers get uncomfortable, because we score every site we scan on how well it would survive being moved to a different platform. So I crossed the two.

The sites in the worst trouble are the least equipped to get out of it. Ten points of readiness between the dead and the current, and barely half as many of them publish the structured data that lets a search engine or an answer machine understand what a page even is.

That is the trap, stated plainly. The site that most needs to move is the site that will most struggle to move, and every month of delay widens the gap. It is not the jelly that ruins Christmas. It is that by the time you accept there is no bonus coming, you have already dug the hole for the pool.

Before somebody emails me

Two honest caveats, because I would rather say them than have them said to me.

These are the most-visited domains on the internet, not the whole web, which means this is a well-kept neighbourhood and the real picture is probably worse. And a version number is what a site says about itself, not proof of what is running. Some of these teams buy extended support privately, and a few of the 6 percent who publish nothing at all are running something perfectly current. Unsupported is not the same as breached. It means nobody is coming when it breaks.

What I would do about it

If you are on Drupal 10, you have four months, and four months is not enough time to replatform but it is plenty of time to decide. Do that now, in August, while it is a calm conversation about budget rather than a tense one about an advisory. Moving to Drupal 11 is the small answer and for most people it is the right one. Moving off Drupal entirely is the big answer and is only worth it if you were going to anyway.

If you are on Drupal 7, 8 or 9, I am afraid the envelope was opened some time ago and the jars have been piling up in the hall. Start with what you would lose in a move, not with which platform to move to. Nobody has ever regretted knowing their own content inventory.

And if you are one of the government or university teams reading this feeling slightly cheated: you are right, you were. You did the upgrade you were told to do, on time, and it bought you three years and a place in the queue. The lesson is not that diligence does not pay. It is that a supported version is a subscription, not a purchase, and the renewal date belongs to somebody else.

The pool was always going to cost more than the bonus. Clark just found out in December.