For your file
Twelve questions
for whoever runs your Drupal site.
Every question below can be answered with a document. If your agency cannot produce one, that is the finding. Print this page, send it, and file the answers next to the proposal.
Which supported branch are we on, and when does its security coverage end?
If the answer is "10.x" or "11.x" without a minor version, you do not have an answer. Drupal 10 ends December 2026; 11.3 ends December 2026; 11.4 ends April 2027.
How many contributed modules are installed, and how many are covered by the security advisory policy?
The gap between those two numbers is your unpatched surface area. Coverage is opt-in.
Which of those modules are unsupported or abandoned?
Drupal's only advice for an unsupported module is to uninstall it. Ask for the list and the removal plan, dated.
What is our mean time from a critical advisory to a production patch?
Ask for the last four criticals, with dates. A number above 48 hours is a decision you should make consciously.
Who is on call in the week of 9 December 2026?
Drupal 10, 10.6.x, 11.3.x and PHP 8.2 all reach the end of support in that window. Name, phone number, escalation path.
Are we on Steward, and what does it not cover?
Steward protects against Drupal application vulnerabilities. Drupal itself says it cannot protect against engine-level PHP flaws.
How many of our dependencies are end-of-life upstream, not just in Drupal?
PHP 8.2 support ends 31 December 2026. So does the Drupal branch half the web is still on.
What is our exposure if the next critical has no fix for our branch?
This happens. In October, 28.5% of reporting sites were in that position at publication.
Which of our modules were patched in the last 90 days, and did we apply them?
Drupal published 256 advisories in five months. Ask for the ticketing evidence, not the assurance.
What is the rebuild plan and cost for the next major version?
Minor versions now get eight months of security support. Major versions get four years. Your rebuild is a scheduled cost, not a surprise.
Does our contract require the agency to fund any of the maintenance it depends on?
Core release management is funded at eight hours a week. Ask whether any of your invoice goes to the thing that keeps you patchable.
If we migrated, what would the migration itself cost in downtime and retraining?
Not on this site's behalf. But a risk decision without a costed alternative is not a decision. Get the number.
The point
You do not need to believe this website. You need the answers to twelve questions, in writing, dated. The rest follows.