Updated October 2026
Quick answer: apply security patches straight away, apply minor updates regularly (at least monthly), and plan major version upgrades once the new version is stable and the plugins or modules you rely on support it. Never let your website software reach end of life without a plan, because it stops receiving security fixes.
Every website runs on software that keeps changing: a content management system such as WordPress or Drupal, a framework such as Laravel, plugins or modules, and the server software underneath. Knowing when to update each of them is one of the most important decisions a website owner makes. Update too slowly and you’re exposed to attacks. Upgrade too early and you risk breaking things.
This guide explains how software versions work, when to update, and how to plan bigger upgrades, using Drupal and WordPress as examples.
Patch now, upgrade deliberately
The simplest rule of thumb is to treat updates differently depending on their size.
| Type of update | Example | What it contains | When to apply |
|---|---|---|---|
| Security patch | Drupal 10.3.1 to 10.3.2 | Fixes for security holes and bugs | As soon as possible, within days |
| Minor version | Drupal 10.2 to 10.3 | New features, generally backwards-compatible | Regularly, after testing |
| Major version | Drupal 10 to 11 | Significant changes that can break compatibility | Planned as a project, once stable and supported |
Most software uses this “X.Y.Z” numbering: X is the major version, Y the minor version and Z the patch.
Why security patches can’t wait
When a security hole is fixed, the fix is published, which also tells attackers exactly what to look for. Automated bots then scan the internet for sites that haven’t applied the patch, often within days, and sometimes within hours for serious Drupal and WordPress vulnerabilities.
That’s why security patches should be applied promptly, on a schedule, by someone who’s watching for them. It’s also why “we’ll update it when we redesign” is a risky plan.
Why it’s often smarter to wait for major upgrades
Software goes through several stages before it’s ready for business use: alpha, beta, release candidate and finally stable. Even after a major version is officially stable, it can take months before the popular plugins and modules you depend on catch up.
For example, when a new major version of Drupal is released, many website owners wait six to twelve months so the modules they rely on are compatible. For most business websites it’s cheaper and safer to upgrade a little late than a little early, as long as the old version is still receiving security updates.
Early adopters vs late adopters
- Early adopters get new features first, but take on more risk of bugs and incompatibilities. This suits organisations with strong technical support who can handle problems quickly.
- Late adopters wait until a version has been proven in the real world. This suits most organisations, especially those with business-critical websites or limited in-house IT.
End of life: the deadline you can’t ignore
When software reaches end of life (EOL), it stops receiving updates, including security fixes. Your website won’t stop working that day, but every new vulnerability discovered after that date stays open forever. Over time, hosting providers also stop supporting the old software, and integrations stop working with it.
Recent examples include Drupal 7, which reached end of life in January 2025, and older versions of PHP, which lose security support on a published schedule. If your website is running software that’s at or near end of life, plan the upgrade now. See your options if you’re still on Drupal 7 and upgrading PHP.
Five reasons to keep website software up to date
- Security. Out-of-date software is the most common way websites are hacked.
- Compatibility. Servers, browsers and third-party services keep moving. Old software eventually stops working with them.
- Performance. Updates often make sites faster and more efficient.
- Lower long-term cost. Small, regular updates are cheaper than a big, urgent rebuild after years of neglect.
- Compliance and trust. Many organisations, especially in government, have to show that their systems are supported and patched.
SaaS platforms vs software you control
With a hosted platform (software as a service), such as Shopify or Squarespace, the provider handles updates for you. You get less control, but less responsibility. With open-source software like WordPress, Drupal and Laravel, you have far more flexibility and ownership, but someone has to plan, test and apply the updates. See hosted platforms vs custom CMS solutions.
Who should manage your upgrades?
For routine patches and minor updates, what matters most is that someone is responsible, has a schedule, and tests changes before they go live.
For major upgrades, consider:
- Your internal team knows your systems and business well, but may lack experience with the new version, or time alongside their usual work.
- A specialist partner brings experience from many similar upgrades and can often spot problems early. The best results usually come from combining the two: your team’s knowledge of the business with a partner’s technical depth.
Frequently asked questions
How quickly should security patches be applied?
As soon as practical, ideally within days of release. Critical vulnerabilities in popular platforms should be patched as a priority.
Should I turn on automatic updates?
Automatic updates for small security releases are useful. For larger updates, it’s safer to test on a staging copy first, because an update can occasionally break a plugin, theme or custom feature.
What happens if I keep using software after end of life?
It keeps running, but new security holes are never fixed, and over time it becomes harder and more expensive to host, integrate and eventually upgrade.
Let us handle your updates
Itomic’s website security contracts include proactive security patching for WordPress, Drupal and Laravel websites. We also plan and deliver major upgrades. Talk to us about your website.
