Do I need to upgrade from Craft 4?
Yes. Craft CMS 4 reached end of life on 30 April 2026, and it no longer gets security fixes.
Your site won't stop working because of that date. Nothing switches off. What changes is that the next vulnerability found in Craft 4 stays open, and this year has had a lot of high-severity Craft security fixes (we've written about why). Every month a Craft 4 site stays put, the gap between it and a patched site gets wider.
What end of life means in practice
Pixel & Tonic stopped adding fixes and features to Craft 4 on 30 April 2025, and stopped security fixes a year later. Plugin developers are following suit. Most now only release fixes for their Craft 5 versions, so a bug in a plugin on a Craft 4 site may never be fixed.
There's a server side to it too. A lot of Craft 4 sites still run on PHP 8.0 or 8.1, and both are past the end of their own security support. Craft 5 needs PHP 8.2 or later, so the upgrade usually moves the server forward as well.
Why Craft 5, rather than waiting for Craft 6
Craft 6 isn't out yet. The beta is due in 2026 and there's no date for the full release (here's what we know about it). Craft 5 gets bug fixes until the end of 2030 and security fixes until 31 December 2031.
So Craft 5 gives you a supported home for the next five years, and you can move to Craft 6 once it's had a few point releases. Going from 4 to 5 now and 5 to 6 later is also easier than trying to jump straight from 4 to 6.
What the upgrade involves
The good news is that Craft 4 to 5 is one of the gentler major upgrades Craft has had. Your content, sections and fields come across, and most templates carry over as they are. The work usually sits in three places:
- Plugins. Each one needs a Craft 5 version. Most active plugins have had one for a long time. Anything abandoned needs replacing, and that's usually where the real decisions are.
- Templates. Craft 5 moves to Twig 3, so a handful of older template patterns need small changes.
- Custom code. Modules written for your site need checking against Craft 5's changes.
Then it's testing on staging, the upgrade on the live site, and a check that everything behaves. For a typical marketing site it's a contained piece of developer work rather than a project.
What you get for it
Your editors get something out of it too. Craft 5 brought a redesigned control panel and built-in two-factor authentication, and the releases since have added content blocks, bulk actions and spreadsheet exports, and safer deletes. None of that reaches a Craft 4 site.
Need a hand?
If you'd like us to upgrade your site, and then keep it updated every month so it doesn't fall behind again, that's what our Craft CMS support is for. Drop us a line at hello@mutual.agency and we'll get it booked in.
Sources
- Craft CMS — Supported versions — active and security support dates for each major version
- Craft CMS — Upgrading from Craft 4 — the official upgrade guide
- PHP — Supported versions
Andrew is Technical Director at Mutual, a Craft CMS Partner agency. He has been building with Craft CMS since its public beta in 2012 — working through every major version from Craft 1 to Craft 5 — and has delivered over 100 sites for clients including Apple, Transparency International, and Arts University Bournemouth.
He writes about Craft CMS on the Mutual blog and has contributed to net Magazine. At Mutual, he leads development of Mutual One, a marketing platform built on Craft CMS as its foundation.
He has spoken about Craft CMS to undergraduate students at the University of Brighton and Canterbury Christ Church University, and appeared on the Devmode.fm podcast. He has also trained other developers on working with the platform.
More from the blog
The Best Craft CMS Learning Resources in 2026
Where we'd send a developer learning Craft CMS in 2026: the official docs and tutorial, CraftQuest, the Discord, the newsletter and the conference talks.
How design and brand agencies can use Craft CMS to say "yes" to more briefs
We work with design and brand agencies as their development partner, helping them say "yes" to more briefs.
Common Accessibility Problems to Avoid in 2026
The accessibility problems we still see most often, what WCAG 2.2 and the European Accessibility Act changed, and how to catch what automated tools miss.