Drupal 8 is Production-Ready!

Okay. So, that’s old news. At the time of this writing, Drupal 8 (D8) has been Production-ready for just over two years. So, the question is no longer, “Is Drupal 8 ready for my Production site?” Instead, the question is, “When should I move to Drupal 8?” The ideal answer is - before you do any more major work to your existing site. (Of course, if you are readying to build a site from scratch then you should start with D8.)

I say “ideal answer” because there is one significant caveat. This article assumes you have access to the services of a professional Drupal development company. Drupal 8 is a monumental change from previous versions of Drupal - in a good way. Unless you are a developer who has worked with Drupal (and Drupal 8, in particular), the most efficient and most cost-effective upgrade path is via an expert Drupal developer. Don’t misunderstand me. You do not need a developer to upgrade a Drupal site. However, this article assumes your application is mission-critical and you wouldn’t risk data loss or taking your organization off-the-grid in an effort to perform the upgrade yourself.

The previous paragraph withstanding, the following are (arguably) the two most significant cases for upgrading to D8. I will go into detail on each, below. (One quick note: The words “website” (“site”) and “application” (“app”) are used interchangeably in this article. For the purposes of this article, they mean the same thing.)

1. If your site is on Drupal 7, there is no major rush. However, if your timeline and budget can accommodate it then you should upgrade to Drupal 8 before performing any more major work on your current site.
2. If your site is on Drupal 6 or lower, upgrade ASAP.

Upgrade from Drupal 7 to Drupal 8?

If your site/app is currently on D7, there are major advantages to upgrading to D8. They include (but are not limited to) significantly improved performance, a much-improved UI for content creators/site administrators, a new configuration management system, responsive for mobile out-of-the-box, a new theming system… the list goes on. Some estimates put the number of improvements at over 200. Additionally, many (if not most) module developers are now making improvements only to the D8 version of their projects and only maintaining security updates for D7 versions.

These, alone, are compelling reasons for upgrading. However, they are just the tip of the iceberg. The biggest and most important changes will be noticed (and appreciated by) whichever development agency maintains your Drupal application. D8 is worlds apart from D7 in terms of both backend and front-end development. This article is not aimed at developers. So, we won’t go in-depth on the differences but the capabilities, efficiencies and security improvements developers have in the D8 version are well-worth the upgrade (and the accompanying learning curve).

Hesitancy from Developers

Your organization may experience some developer pushback in regards to upgrading (especially if your Drupal app is not managed by an expert, Drupal-only development company) because the learning curve is steep for those who have not kept abreast of the changes. If your developer seems reluctant to perform an upgrade, your first task is to find a new development company. (Shameless plug: Thinkbean was one of the first companies to build a Production app on Drupal 8 - and a beta version, at that!)

Many D6 and D7 sites were built either by development companies which were not Drupal specialists or by hobbyists. Much (if not most) of the pushback was from that side of the development field - and most of the resistance centered around the idea Drupal 8 was “a bridge too far”. The technological differences between Drupal 8 and the previous versions of Drupal were considered by many to be too difficult a learning curve. As we’ve mentioned a couple paragraphs previous to this, the technological differences are considerable but there are enormous benefits to be had.

It has always been the case, the best value for your Drupal development dollar came from qualified Drupal experts. Now, more than ever, you need an expert Drupal development company in order to both get the maximum out of your Drupal 8 app and do so efficiently. Try to find “Drupal-only” development companies. They won't be the cheapest option but they are, undoubtedly, where you will find your best value. Once your app has been migrated to D8, you’ll be amazed at the differences.

The Right Time to Upgrade to D8

Although there is no major rush to upgrade to D8 from a current D7 application, the sooner you can do the upgrade, the better off you’ll be (in many cases). If your site is like most business sites, it is not only important to your business - it is essential. It is (most probably) evolving at a regular pace - work is being performed on it regularly or it is being tweaked every so often. In any case, there is a certain amount of work which accompanies a Drupal 8 migration/upgrade and it is much preferable to do that work now than to wait until some new feature or major change is needed.

Tacking an upgrade to D8 onto the front of other work will, at the very least, require an extended delivery timeline. Depending on the size and complexity of the existing application, it may even be inefficacious to perform the upgrade before the new work is delivered. In such cases, not only would your organization be paying for the upgrade/migration but the just-completed work may have to be re-factored to work properly with D8. In essence, you’d be paying twice for the same work. Most organizations wouldn’t be happy with such expenditures.

Organizations which require ecommerce as part of their applications’ functionality had the only real reason for not making the leap to D8 - Drupal Commerce wasn’t “officially” ready for Production sites. However, (at the time of this writing) Drupal Commerce 2.0 has been Production-ready for several months - and it’s better than ever. If for no other reason, do your organization a favor and upgrade to D8 even if it’s just to get the new features and functionality built into Drupal Commerce 2.0. (Thinkbean has been a significant contributor to the Drupal Commerce 2.0 project.)

The take-away from the above is, an upgrade or a migration to Drupal 8 from either an earlier version of Drupal or from some other (or no other) content management framework is more-than-well-worth the resource allocation. Do it as soon as you are able.

Why You Should Upgrade from Drupal 6 to Drupal 8

If your website is in Drupal 6 or lower, you’re already way behind the 8-ball. Drupal 6 was End-of-Life as of February 24, 2016. What this means for you is (The following list was taken, verbatim, from Drupal.org):

1. Drupal 6 will no longer be supported by the community at large. The community at large will no longer be creating new projects, fixing bugs in existing projects, writing documentation, etc. around Drupal 6.
2. There will be no more core commits on Drupal 6.x to the official tree.
3. The security team will no longer provide support or Security Advisories for Drupal 6.
4. All Drupal 6 releases on project pages will be flagged as not supported.
5. At some point in the future update status may stop working for Drupal 6 sites.

Pay particular attention to #3 in the above list. If your site is in D6, you are likely hacked already. Even if your site is maintained by a professional development agency, the odds are it’s been compromised.

Experienced, expert Drupal development companies can, certainly, help keep a site safe. However, they would need to be vigilant about performing regular checks against the codebase - and know for what they should be looking. That is much easier said than done. Keep in-mind, of course, finding a vulnerability usually means your site is already compromised. The question then becomes, “What’s been exposed and for how long?”

Long term support for D6 sites is available but there are large caveats. For example, you would almost certainly have to pay for the service. Also, there are very limited official providers of D6 LTS (three providers, according to Drupal.org). A huge part of why D7/D8 is such a secure platform is the many thousands of people working on it every day. Such is not the case with D6. So, you have a few watchers for potential D6 issues as opposed to thousands of watchers for D8.

The scope of this article does not include comprehensive coverage of D6 issues due to end-of-life. This is a very brief overview of the D6 security position. We haven’t even touched on many important areas (e.g. time-to-discovery of security vulnerabilities, time-to-resolution of discovered issues, time-to-deployment of resolution, etc.) in this article… and this is just concerning security.

Have a look at #1 on the list. No new Drupal 6 projects are being created. Want some new functionality for your app? If it didn’t exist a couple years ago, prepare to write your first Drupal module! If it did exist a couple years ago, it’s quite possible it is unsafe to use. This is just one more in a long list of reasons to move off of D6 (or earlier). There are numerous, significant reasons to move to a later version of Drupal but we’ll finish this short article in keeping with our security overview.

Security Concerns Alone are a Reason to Upgrade From D6

The mindset preceding just about every case of a significant security breach has been one of complacency and/or denial. Perhaps, you don’t believe your site is on any hacker’s radar. Practically guaranteed is the case, your site is under attack as you read this article. Also, mitigating the effects of a security breach will be far costlier than it ever would be to upgrade. Unless you are a nationally-known brand (with a big PR department and millions to spend on damage control), the damage to your reputation, alone, may be unrecoverable.

It is not the intent of this article to scare you into upgrading your Drupal platform version. However, if you are operating a commerce site or other mission-critical application on D6 or (God forbid) lower, you should be well-concerned - both for yourself and your users. Either resolve to contract with an official provider of long-term support (and resign yourself to allocating significant resources (both time and money) for future needed functionality) or find a reputable, expert Drupal developer and make the move to Drupal 8 ASAP.