Do I Need to Upgrade Craft 2?
Craft 2 reached end of life in January 2018 and no longer receives security updates. Here's why upgrading is essential for your site's security.
If your site is still on Craft 2, the short answer is yes — upgrade soon.
Craft 2 reached end of life in January 2018. That's years without security patches, bug fixes, or any support from Pixel & Tonic. Running it in production today is roughly equivalent to running Windows XP.
Why it matters
When Craft 3 shipped, Pixel & Tonic fixed security issues that had been found in Craft 2. Without updates, your site stays exposed to those known vulnerabilities, plus anything discovered since.
Outdated CMS installs are targeted by automated scanners. Once a vulnerability is public, it's only a matter of time before yours is probed.
The upgrade path
Going from Craft 2 to a current version (Craft 4 or 5) isn't a plugin update — it's a migration. The content structure and templating have moved on, and Craft 2 plugins need updating or replacing.
It's worth doing. Modern Craft is faster, more flexible, has GraphQL, better asset management, and a much-improved control panel. Editors notice the difference as much as developers.
Hosting
PHP 5.6, which Craft 2 runs on, reached end of life in December 2018. Finding good hosting for that stack gets harder and more expensive every year.
Andrew is Technical Director at Mutual, a Craft CMS Partner agency. He has been building with Craft CMS since its public beta in 2012 — working through every major version from Craft 1 to Craft 5 — and has delivered over 100 sites for clients including Apple, Transparency International, and Arts University Bournemouth.
He writes about Craft CMS on the Mutual blog and has contributed to net Magazine. At Mutual, he leads development of Mutual One, a marketing platform built on Craft CMS as its foundation.
He has spoken about Craft CMS to undergraduate students at the University of Brighton and Canterbury Christ Church University, and appeared on the Devmode.fm podcast. He has also trained other developers on working with the platform.
More from The Journal
Should you be worried about the rise in high-severity Craft CMS security updates?
Craft has had a huge increase in security patches this year. But don't be alarmed, it's a sign of the times and that Craft is dealing with things responsibly.
Can AI text help my Craft CMS website's performance?
Can you benefit from having AI create new content for your website? Let's dive in!
Redirects in Craft CMS without a plugin
Craft CMS now has built in redirects abilities, so you may not need a plugin for them in 2026.