Still on Craft CMS 4? Your site stopped getting security fixes in April
Craft CMS 4 reached end of life on 30 April 2026. What that means for your site, why Craft 5 is the safe place to land, and what the upgrade actually involves.
On 30 April 2026, Craft CMS 4 reached the end of its security support. If your website still runs on it, any vulnerability found in Craft 4 from now on may never be fixed.
That isn’t a reason to panic. Your site didn’t stop working on 1 May, and it won’t stop working next week. But the risk grows quietly every month, and so does the cost of putting it off. This post covers what end of life actually means, why Craft 5 is the right place to land, and what an upgrade involves.
What “end of life” means, and what it doesn’t
Pixel & Tonic, the company behind Craft, gives each major version at least two years of active support, then a further year of critical security fixes. For Craft 4, the timeline ran:
| Version | Active support ended | Security support ended |
|---|---|---|
| Craft 3 | 30 April 2023 | 30 April 2024 |
| Craft 4 | 30 April 2025 | 30 April 2026 |
| Craft 5 | 31 December 2030 | 31 December 2031 |
Source: Craft CMS supported versions.
In practice, end of life means three things for a Craft 4 site:
- No guaranteed security patches. Pixel & Tonic may still ship the occasional Craft 4 release, but they’re under no obligation to, and you can’t plan around it. When the next vulnerability is disclosed, the fix will target Craft 5.
- Plugins move on too. Most Craft sites lean on a handful of third-party plugins for forms, SEO, redirects and social media feeds. Their developers have moved their effort to Craft 5, and Craft 4 versions are getting fewer fixes, or none.
- Hosting gets harder. Craft 4 runs on PHP 8.0.2 and above, and many Craft 4 sites still sit on PHP 8.0 or 8.1. Both of those PHP versions are themselves out of support, and PHP 8.2 follows on 31 December 2026. An old CMS on an old PHP version is the combination that attackers scan for.
None of this means your site has been compromised. It means the safety net has gone, and the longer a site sits on an unsupported stack, the bigger the jump back to a supported one becomes.
Why Craft 5 is the safe place to land
You might reasonably ask whether to skip Craft 5 and wait for Craft 6. We’ve written about Craft 6 and its move to Laravel and we’re excited about it, but it’s still in alpha, and the route to it runs through Craft 5 anyway.
Craft 5, on the other hand, is about as safe a destination as a CMS gets. Pixel & Tonic have made it a long-term support release, maintained for five years after Craft 6 is fully released, with security support currently listed until the end of 2031. Upgrade once now and your site has years of breathing room, with Craft 6 as an option rather than an obligation.
What changes in Craft 5
For most of the people who use a Craft site day to day, Craft 5 feels familiar, just tidier. The biggest changes are under the bonnet:
- Matrix blocks become entries. Matrix is the field most Craft sites use to build flexible page layouts. In Craft 5, each block is now a full entry in its own right, so it can have its own title, status and even nested content, and editors can view them as cards rather than one long stack. The upgrade converts existing Matrix content automatically.
- Categories, tags and globals can become entries too. This is optional, but bringing everything into one consistent model makes sites simpler to manage and to extend later.
- Fields can be reused. A single field can appear more than once in the same layout with a different name and instructions, which means fewer near-duplicate fields cluttering the settings.
- Content storage is leaner. Craft 5 stores content in a single JSON column rather than one giant database table, which is faster and removes the old limits on how many fields a site could have.
What the upgrade actually involves
A Craft 4 to 5 upgrade is a well-trodden path, and Pixel & Tonic’s upgrade guide is thorough. The work tends to fall into four stages.
1. Audit the plugins. This is where most of the variation in effort lives. For every plugin, we check whether a Craft 5 version exists, whether it’s still actively maintained, and whether there’s a better first-party or community alternative. An abandoned plugin needs replacing, and occasionally rebuilding, before anything else happens.
2. Get the Craft 4 site in order. Craft 5 expects the site to be on the latest Craft 4 release, with up-to-date plugins and no deprecation warnings. Clearing those warnings often surfaces template code that has been quietly relying on old behaviour for years.
3. Upgrade the server. Craft 5 needs PHP 8.2 or later, and MySQL 8.0.17+, MariaDB 10.4.6+ or PostgreSQL 13+. Given that PHP 8.2 goes out of support at the end of this year, we’d aim straight for PHP 8.3 or 8.4. These can usually be upgraded ahead of Craft itself, since Craft 4 runs happily on them.
4. Upgrade, test and deploy. The upgrade runs on a copy of the live site first, so templates, forms, integrations and editor workflows can be tested properly before anything goes live. Deployment then follows the same process as any other release, with a fresh backup beforehand.
For a straightforward site with well-maintained plugins, this is a modest piece of work. Sites with lots of plugins, custom modules or bespoke integrations take longer, and the only honest way to size it is to look at the code.
Still on Craft 3, or older?
Craft 3 lost security support in April 2024, so the case for moving is stronger still. You can’t jump straight from Craft 3 to Craft 5, so the upgrade happens one major version at a time. For a site that old, it’s also worth asking whether the design and content model still serve you, because sometimes a rebuild on Craft 5 is better value than two back-to-back upgrades.
Where to start
If you’re not sure which version of Craft your site runs, your developer or agency can tell you in a minute. It’s also shown in the control panel, at the bottom of the main content area.
If you don’t have a developer to ask, or yours has gone quiet, that’s the most common reason people get in touch with us. Our Craft CMS support and maintenance service starts with a fixed-price audit: a full day reviewing your codebase, hosting, Craft version and every plugin, followed by a written report in plain English and a prioritised plan. Upgrades can then be done ad hoc, or as part of a monthly support retainer.
We’ve been building with Craft since its launch in 2013, and we’ve moved plenty of Craft sites to a new home along the way, Boisdale among them. If your site is on Craft 4 or earlier, get in touch and we’ll help you get it back on a supported version.
