Statamic 5 Site Still Works? Here's Why to Plan an Upgrade

Statamic 5 is the easiest version to leave alone. Sites on it are recent, they work, and they're still getting security fixes. So "if it ain't broke, don't fix it" sounds reasonable.

But Statamic 5's security support has an end date, December 2026, set out in Statamic's support policy. After that, new flaws found in it won't be fixed.

An out-of-date website can be flagged as unsafe by Google, pass malware on to your customers or be taken offline by your host. Here's what it can cost a business.

Why a working Statamic 5 site still needs a plan

A Statamic site depends on three main layers of software. There's Statamic, the content management system (CMS) you edit pages in, and Laravel, the framework it's built on. Then there's PHP, the programming language that runs both on your server.

Each layer gets security fixes for a set time, then stops. The site keeps working after that, but once a fix is published, the details are public. A site that never gets the fix becomes an easier target over time.

Being out of date isn't the same as being hacked. Attacks are automated, though, and they try every site they can reach, looking for one that's missing a fix.

Which PHP version does a Statamic 5 site run on?

Statamic 5 runs on PHP 8.2 to 8.4. A site built in 2024 or 2025 most likely runs PHP 8.2 or 8.3. According to php.net:

PHP 8.2's security support ends on 31 December 2026, the same month as Statamic 5's.
PHP 8.3's runs to 31 December 2027.
PHP 8.4's runs to 31 December 2028.

A site on PHP 8.2 loses support for both at once. Moving PHP up a version helps, but it doesn't change Statamic 5's end date.

Is your site up to date within Statamic 5?

Being on version 5 isn't the same as being on the latest Statamic 5 release. Recent releases need Laravel 12. A site that hasn't been updated since launch may still be on Laravel 10 or 11, which lost their security fixes in February 2025 and March 2026.

To check, install Sentinel. It's my free Statamic addon that checks Statamic and the packages it relies on against public security advisories, flags what is out of date and emails you a report.

Why I still want to see the code repository

Sentinel tells you what's out of date. To price the upgrade, I also ask for read access to your site's code repository. That's where its code is stored and tracked, usually on GitHub, GitLab or Bitbucket. Nothing on the live site changes while I look.

The repository shows me:

The exact versions of Statamic, Laravel and PHP, and every addon.
Which addons are ready for the current version of Statamic, and which need replacing.
Custom code the upgrade will touch.
Whether it uses Statamic Pro, whose licence needs to be current before the site can be updated.
Which tool builds the site's styles and scripts.

That last one is worth checking too. A build tool turns the styles and scripts a developer writes into the files a browser downloads. Laravel switched its default from Laravel Mix to Vite, a newer and faster build tool, in 2022, so a Statamic 5 site probably uses Vite already. If yours started on an older version and still uses Mix, moving it to Vite may be part of the upgrade.

That's how I confirm a price before you commit. If there's no repository, or you're not sure who has it, I'll take a copy from the server.

Why upgrading from Statamic 5 now makes sense

A Statamic 5 site is one major version behind, which makes it the smallest job on my Statamic upgrade page. The easiest time to upgrade is while you're still covered, so there's no gap in security fixes.

It still has changes to work through. Statamic's upgrade guide lists the ones that can break a site. For example:

The Control Panel was rebuilt on a new version of the software it's made with, so any custom Control Panel features need rewriting.
Dates are handled differently, which can affect sites with events or dated posts.
Global settings, the content shared across every page, are stored differently.
Laravel and PHP may need to move up a version.

Your visitors won't notice any of it, but each change is work to do and test.

The easiest time to upgrade is while you're still covered.

For more on the dates, read my Statamic 5 security countdown.

What to do next

Update to the latest Statamic 5 release. It stays within version 5, so it's a smaller job than an upgrade.
Check the site with Sentinel. It shows what else is out of date.
Plan the upgrade. Send me read access to the repository and I'll confirm the price.
Keep it updated afterwards. My Statamic maintenance plan updates it every month, with a report showing what changed.

Once your site is on a maintenance plan, keeping track of the next end date is my job, not yours.

Plan your Statamic 5 upgrade while it's still supported