Unsupported CMS: what to do when support ends

Key takeaways

An unsupported CMS, theme or framework no longer receives security fixes, so every new vulnerability stays open for good. That is one of the clearest rebuild signals there is. Plan the move within months, not years: secure backups now, map every URL, and migrate to a supported platform with redirects in place.

• No security updates means every new vulnerability stays open.
• Check core, theme, plugins and server software separately.
• Take full backups today, before anything else.
• Plan migration with a full URL map and 301 redirects.

What does an unsupported CMS mean?

An unsupported CMS is a content management system, theme or framework whose developer no longer releases updates or security fixes. The site keeps working, but newly discovered vulnerabilities are never patched, and compatibility with modern browsers, servers and plugins gradually breaks.

• Signs your business needs a new website

How do you check whether your platform is supported?

Check each layer separately, because any one of them can be the weak point.

• CMS core: is your version still receiving security releases?
• Theme: when was it last updated, and is the developer still active?
• Plugins or extensions: any abandoned or removed from the directory?
• Server software: is the PHP or runtime version still supported?
• Proprietary builders: is the supplier still trading and updating it?

• Outdated PHP version: what it means for your website
• Outdated WordPress plugins: when they mean a rebuild

What are the risks of staying on it?

Security is the main one. The NCSC's Small Business Guide lists keeping software updated as a basic control, because attackers routinely scan for known vulnerabilities in old software. A compromised site can serve malware, trigger browser warnings, leak form data and require an expensive clean-up.

There is a compliance angle too: UK GDPR requires appropriate security for personal data, which includes enquiry form submissions stored on the site.

• Website security for small businesses

Can an unsupported site be patched instead?

Sometimes, for a short time. A developer can harden the server, add a web application firewall and remove unused features. That buys months, not years, and costs money that does not go into the replacement. Treat it as a bridge while the rebuild is planned.

How do you move safely?

Follow a site migration process. Google's guidance on site moves stresses mapping old URLs to new ones and using 301 redirects. Keep content that ranks, rebuild the templates on a supported platform, and test forms and tracking before switching.

• Take and test full backups of files and database.
• Crawl the site and export every URL.
• Pull 12 months of Search Console data to see which pages matter.
• Rebuild on a supported platform, keeping URLs where possible.
• Redirect every changed URL and monitor after launch.

• Website migration SEO checklist
• Website redesign versus rebuild

What does moving typically cost?

A rebuild on a new platform typically costs £5,000 to £20,000 or more in the UK market for a small business site, depending on size, content and integrations. A small brochure site can cost less. Plan maintenance afterwards so the new platform does not become unsupported in turn.

• how much a business website costs in the UK
• Website maintenance costs in the UK

What should you ask a supplier before migrating?

Ask how they will protect what already works. A good supplier will talk about the URL map, redirects, content migration, tracking and testing before they talk about design. If the first conversation is only about how the new site will look, the migration risk has not been considered.

Ask as well how the new platform will be kept supported: who applies updates, how often, what it costs, and what happens when the next version of the software is released. The aim is to avoid being back in the same position in five years.

• How will you map and redirect every URL?
• How will content and images be migrated?
• How will tracking and forms be tested?
• Who keeps the new platform updated, and at what cost?

• Questions to ask a web design agency before signing

What does this look like in practice?

A pattern in UK SMEs: a site built on a theme that was abandoned several years ago, with the owner unable to update WordPress because the theme breaks. The site is effectively frozen. Rebuilding on a supported theme with the same URLs and content restores updates without losing search visibility.

• See client work
• Website Design & Development for UK businesses

Unsupported platform checklist

Act on these this month.

• Record CMS, theme, plugin and PHP versions.
• Check each against its support status.
• Take and test a full backup.
• Add temporary hardening if a rebuild is months away.
• Crawl and export every URL.
• Plan and budget the migration.

Next step

If your platform is out of support, we will check each layer with you in 30 minutes and outline a safe migration plan.