Kentico Xperience 13 end of support: what it forces you to decide
Before January 1, 2027, when Kentico stops all support for Xperience 13 including security fixes, your team must choose between upgrading to Xperience by Kentico and rebuilding the site on another platform. The realistic rebuild options are Umbraco, the MIT-licensed .NET CMS, or Drupal, which is GPL-licensed. The choice turns on rebuild effort, licensing and hosting, not on a feature checklist, because every option means moving the content model, page builder widgets, forms and marketing logic that your site depends on. Start by inventorying those components and deciding which ones must survive the move unchanged.
The rebuild effort depends heavily on your current .NET stack. The current Umbraco documentation requires .NET 10.0 or higher, so a .NET Framework or older .NET site faces a runtime change as well as a CMS change. Umbraco 17 is the LTS release published on November 27, 2025, with end of life on November 27, 2028, so it is the line to evaluate for a new build. Umbraco 13 reaches end of life on December 14, 2026, which leaves little room. For Drupal, Drupal 11 is the current major version, and Drupal 10 reaches end of life on December 9, 2026. Confirm which target version your team and hosting can support before you estimate work.
Licensing and hosting shape the long-term cost. Umbraco CMS itself is free, but Umbraco Forms and Umbraco Engage require licenses on a public domain, so list every marketing and form feature you use and check its license. Ask Kentico in writing what support, if any, is available if your cutover runs past the deadline, and plan a freeze and your own patching process for that gap. Also decide whether you will self-host or use Umbraco Cloud. A written scope from any partner should state which of these decisions it covers.
What the end of support requires from your site
Xperience 13 leaves you with five connected constraints: the vendor stops patching, the runtime and database must move to supported versions, content and media must be exported and verified, marketing and form features need replacements, and any headless consumers must keep working. Each one sets a dependency for the cutover plan.
No vendor security patches
Kentico stops all support for Xperience 13 at the deadline, including security fixes. After that date, a vulnerability in the product has no vendor patch, and your team carries the full exposure for the application, the database and the hosting. Ask Kentico in writing what remains available after the deadline and whether any paid extension exists. Treat the deadline as the date production must stop running unpatched code.
A supported runtime and database
Xperience 13 runs on a .NET stack that you must keep aligned with a supported platform. Current Umbraco CMS documentation requires .NET 10.0 or higher and supports SQLite or SQL Server, so the target version shapes your server, hosting and database choices. Confirm the runtime and database Xperience 13 uses today, then map each component to a version that stays supported through your go-live and maintenance window. Choose the runtime before you choose the CMS version.
Content and media that must move
Pages, content types, media, URLs and user accounts all have to leave Kentico and enter the new platform in a form it can use. No migration tool is confirmed here, so ask Kentico and your target vendor which exports cover content, media libraries, page hierarchy and users, and what they leave out. Inventory content types, workflow states and media folders first, then test a full copy in a non-production environment and compare item counts and URLs before cutover.
Marketing and form features that stay behind
Personalization, email, analytics and form builders in Xperience 13 do not carry over automatically, so each one needs a named replacement and an owner. In Umbraco, Forms runs unrestricted locally but needs a license on a public domain, sold per domain with two development or testing domains included. Umbraco Engage uses a similar per-domain license. Map every marketing feature to a product, license or custom build before you commit to a go-live date.
Headless delivery and access rules
If Xperience 13 feeds a separate front end, the replacement API must match its access model. The Umbraco Content Delivery API is opt-in and must be enabled in configuration. Preview content needs an API key, and protected content is served only when member authentication is enabled. Document each consuming application, its authentication method and the content it reads, then test every one against the new endpoints before retiring the old ones.
Which replacement paths meet the support constraint
This table compares Xperience by Kentico, Umbraco 17, Umbraco 13 and Drupal 11 or Drupal CMS 2.0 on how each keeps security patches flowing, the rebuild each requires, and the licensing or platform trade-offs. Read the support row first, then the rebuild row, since a path that still receives patches but needs a full rebuild may not fit a January 1, 2027 cutover.
| Requirement | Xperience by Kentico (upgrade) | Umbraco 17 (LTS) | Umbraco 13 or Drupal 11 / Drupal CMS 2.0 |
|---|---|---|---|
| Security patches after January 1, 2027 | Supported under Kentico's current product lifecycle, which the Xperience 13 end of support notice does not cover. Confirm the current service terms in writing. | LTS support to November 27, 2028, with extended LTS to November 27, 2030. Confirm the patch cadence with Umbraco. | Umbraco 13 reaches end of life December 14, 2026, so it does not meet the deadline. Drupal 11 receives core security releases on the third Wednesday of each month. |
| Rebuild effort | Upgrade path is a platform change, not an in-place patch. Confirm which Xperience 13 widgets, page builder components and marketing features carry over. | Page types become document types and widgets are rebuilt with Umbraco templates. Page builder and marketing features do not map one to one. | Drupal requires a new site with migration tooling, and themes must be rebuilt because they cannot be migrated. Expect a full front-end rebuild. |
| Marketing features | Included in the Kentico product scope. Confirm which personalization and campaign features remain under the chosen edition. | Umbraco Engage covers personalization, analytics and A/B testing, and needs a license for a public production domain plus up to two test domains. | Drupal has no paid edition, but marketing automation, personalization and A/B tooling come from contributed modules or third-party services that you must select and verify. |
| Licensing trade-off | Commercial license tied to the product edition and hosting model. Ask for the renewal and per-environment terms in the quote. | Umbraco CMS is MIT licensed. Umbraco Forms and Engage each require a per-domain license on public sites. | Drupal and contributed modules are GPL-2.0-or-later with no paid edition. Costs shift to hosting, development and any paid add-on services you choose. |
| Platform requirements | Runs on the .NET stack already used by the Xperience 13 site. Confirm the supported .NET and SQL Server versions for the target release. | Requires .NET 10.0 or higher, with SQLite or SQL Server as the database. Teams on older .NET versions need an upgrade first. | Drupal 11 requires PHP 8.3 or later and Drupal 12 requires PHP 8.5 or later. Migrating a .NET team to PHP is a skills and hiring change. |
| Identity and SSO | Confirm the supported authentication options in the target edition with Kentico. | Member authentication is available for protected content in the Content Delivery API. Confirm SSO integrations with your identity provider. | Contributed SAML Authentication and OpenID Connect modules are available. Confirm each module's version against your Drupal release. |
| Timing risk | Depends on the vendor's upgrade pathway and the team's capacity to migrate before the deadline. Get dates in writing. | A rebuild on Umbraco 17 is the path that keeps a supported LTS line for the longest period after the deadline. | Staying on Umbraco 13 after December 14, 2026 leaves the site unpatched. A bridge plan is required if the cutover slips. |
How the rebuild differs between Umbraco and Drupal
The rebuild effort depends less on the destination CMS than on what you are carrying out of Xperience 13. Umbraco is a .NET application, so the team keeps its C# skills and its existing hosting pattern, but the page types, widgets, forms and marketing logic must be remodeled as Umbraco document types, templates and extensions. Confirm the target Umbraco LTS version and check that your hosting supports the current requirement of .NET 10.0 or higher and either SQLite or SQL Server, as listed in the Umbraco CMS requirements documentation. Decide early whether the site needs headless delivery. The Content Delivery API is opt-in and must be enabled in configuration, so front-end teams should not assume JSON output exists until it is switched on and access rules are set for preview and protected content.
Drupal takes a different route. Drupal 6 and 7 sites cannot be updated in place to Drupal 10 or later. They are migrated into a new site using the core Migrate, Migrate Drupal and Migrate Drupal UI modules or Drush, and themes must be rebuilt because they cannot be migrated. Drupal 10 and later require PHP 8.1 or later, Drupal 11 requires PHP 8.3 or later, and Drupal 12 requires PHP 8.5 or later, so the hosting image is part of the rebuild scope. Authentication for staff and partner portals can be handled with the contributed samlauth module or the OpenID Connect module, and both need to be tested against your identity provider during the build.
Umbraco Cloud is the managed option if you want the Umbraco platform without running servers. It is a fully managed service on Microsoft Azure with automatic backups, a global CDN, HTTPS and Development, Staging and Live environments, with Umbraco Deploy moving content and structure between them. Ask any hosting provider which environments and deployment steps they include, and confirm who owns the Azure subscription. Drupal has no equivalent single managed product from its own project, so hosting and environment tooling would be sourced separately from a host or partner. Either way, the rebuild is a new codebase with its own release pipeline, not a configuration change.
How to plan a cutover that may slip past the deadline
This sequence moves an Xperience 13 site to a supported platform before Kentico's January 1, 2027 end of support, or keeps it defensible if the cutover slips. Each step closes with a check you can show to your security and compliance owners.
Inventory the site, integrations and components
The development lead and a solution architect list every Xperience 13 website, page type, widget, form, custom module, scheduled task and integration with CRM, email, search, identity or analytics. Record the .NET, NuGet package and database versions, because they set the upgrade path. Note which features depend on Kentico licensing, such as marketing functions. Done means a signed inventory in which each item has an owner, a data flow and a decision to replace, rebuild or retire it.
Choose the target and confirm vendor options
Decide between upgrading to Xperience by Kentico and moving to Umbraco or another open-source CMS, and write down the reasons. For Umbraco, the current LTS line is Umbraco 17, released November 27, 2025, with end of life on November 27, 2028. Umbraco 13 reaches end of life on December 14, 2026, before the Kentico deadline, so it is a weak landing point if the cutover slips. Ask Kentico directly, in writing, which extended support options exist for Xperience 13 after January 1, 2027 and what each covers. Done means a decision record and the vendor's written answer on file. Umbraco's end-of-service policy sets out the support phases to compare.
Build the target in a staging environment
The platform team provisions a staging environment in your own cloud account or data center, matched to production's network zones, identity provider and database engine. For Umbraco, confirm the runtime and database requirements first, including .NET 10.0 or higher and a supported SQLite or SQL Server database. Rebuild page types as document types and templates, and enable the Content Delivery API only if a headless consumer needs it, because it is opt-in. Done means the site builds from source control, deploys through a pipeline and runs the same security baseline planned for production.
Migrate content, media and forms into staging
Export content, media files and form definitions from Xperience 13 and load them into the new content model with a scripted migration that can be run repeatedly. Repeat the run until the logs match, so the final load repeats a tested process. Confirm that media keeps its file names and that personalization, email marketing and analytics data are either migrated or listed as items to rebuild. Umbraco Forms and Engage need valid licenses on a public domain, so confirm license scope before go-live. Done means a migration log with record counts that match the source and a list of rebuilt items.
Run URL, form and integration parity checks
Crawl the production Xperience 13 site and the staging site, then compare every URL, redirect, status code, page title and metadata tag. Map each old address to its new one and add permanent redirects wherever a path changes, so search rankings and bookmarks survive. Test each form end to end, covering validation, file upload, confirmation email and the CRM record it creates. Run the same checks on each integration using test accounts in a staging tenant. Done means zero unmapped URLs, a signed parity report, and a defect list where each item either blocks cutover or has an accepted workaround.
Cut over with a rehearsed rollback plan
Schedule the cutover in a window the operations team agrees on, freeze content editing on Xperience 13 for the final sync, and run the last migration delta. Switch DNS or the load balancer, then verify the new site from outside your network while watching error rates, redirects and form submissions. Keep the Xperience 13 environment intact and reachable for an agreed period, and confirm that its database backup can be restored. Done means production traffic runs on the new platform, a rollback has been rehearsed, and the retirement date for the old environment is in the change record.
Hold Xperience 13 safely if cutover slips
If cutover is not complete by January 1, 2027, Kentico will no longer ship security fixes for Xperience 13, so the site needs controls that work without vendor patches. Place the site in a network segment that only the reverse proxy and named administrators can reach, and put a web application firewall in front of it with rules tuned to the site. Restrict the admin interface to management networks with multi-factor authentication. Maintain a tracked list of unpatched components, including the .NET runtime, database, libraries and packages, with each known exposure and its compensating control. Done means a contingency runbook, tested firewall rules, and a risk acceptance signed by the business owner.
Questions buyers ask before choosing a replacement path
What drives the cost of a rebuild compared with an upgrade?
The biggest driver is how much of the Xperience 13 site is custom code and how much content model work has to be redone. An upgrade to Xperience by Kentico keeps the platform and its licensing relationship, so the work centers on code changes and the new platform's features. Moving to Umbraco means paying for a new implementation: page types rebuilt as document types, widgets and forms rebuilt, marketing features replaced, and content and media moved. Recurring costs differ too. Kentico licenses or service plans recur, while Umbraco CMS is MIT licensed and its add-ons, Forms and Engage, carry their own license terms. Ask any partner for a quote that separates one-time migration work from recurring licensing, hosting and maintenance.
How long does a migration from Xperience 13 take?
The supplied facts do not give a migration duration, and any number would depend on your site. The main variables are the number of page types and templates, custom widgets and integrations, the volume of content and media, how many marketing features such as personalization, email or forms you depend on, and how many environments and approval steps your release process needs. A useful first step is an inventory of those items, which lets a partner write a fixed scope and timeline in writing before work starts. Treat any duration given without that inventory as a guess.
What does the work need from our own team?
Expect to supply people who know the business side as well as the code. Content owners need to confirm which pages, forms and campaigns are still live and which can be retired. Developers who know the current Xperience 13 solution need to explain custom code and integrations. Someone must own the target environment, including hosting, backups and access control, and make decisions about URLs and redirects. Editors should review the rebuilt content model before cutover. Ask a prospective partner to list these roles in the written scope so you can check how much internal time you must commit.
Can we migrate Xperience 13 without outside help?
Yes, if your team has .NET delivery experience and the time to run the project alongside daily operations. The Umbraco documentation covers installation, requirements, the Content Delivery API and the add-on licenses, so an internal team can start there. The risks are usually in the less visible parts: rebuilding marketing logic, preserving URLs and search visibility, and validating the cutover. Many teams choose a fixed-scope engagement for those parts only, which keeps the core of the project in-house. DeployOpen plans, implements, customizes, integrates, hardens, backs up and documents self-hosted platforms in your own infrastructure, and it works from a written scope.
How does Umbraco Forms and Engage licensing work per domain?
Both add-ons are licensed per domain rather than per server or per user. Umbraco Forms runs unrestricted locally but needs a valid license on a public domain. Its licenses are sold per domain, also cover subdomains, include two development or testing domains and allow one license per installation. Umbraco Engage, the marketing add-on, requires a valid license covering one production domain and up to two development or testing domains on a public domain. Confirm the current price and terms with Umbraco, since the facts supplied here cover only the license scope. Count every public domain and subdomain you run before you budget.
What does Umbraco 13 end of life on December 14, 2026 mean for a cutover in 2027?
Umbraco 13 reaches end of life on December 14, 2026, and its extended long-term support ends on December 14, 2028. If you move to Umbraco, that date means a 2027 cutover would land on a release already out of standard support. Plan to target a current long-term support release instead. Umbraco 17 is an LTS release published on November 27, 2025, with end of life on November 27, 2028. Confirm the release you choose against the Umbraco end-of-service policy before the project starts, and build your schedule so the cutover does not depend on a release that has already ended standard support.
Does the Umbraco Content Delivery API expose draft or protected content?
Not by default. The Content Delivery API is opt-in and must be enabled in configuration. It returns unpublished content for preview only when an API key is supplied, and it serves protected content only when member authentication is enabled. Engineers should test these settings in a staging environment before launch, including preview access and member-protected routes. Include those checks in the security test plan, since a misconfigured API can expose content that was meant to stay private.
Evidence to keep for the migration and the contingency period
Whichever path you choose, the same records show what you ran, where you are going and what you did in between. Keep them dated and signed from the start, because they support your own decisions and any assessment you later undergo.
Dated component inventory
List every Xperience 13 component in use: the core version, service packs and hotfixes, custom modules, third-party libraries, .NET runtime, database engine, and the hosting and search services around them. Record each item's support status against the vendor's published dates on the date you wrote it. This inventory is the baseline every later decision refers back to, so re-date it whenever something changes.
Target version and support dates
Record the destination you chose, such as Umbraco 17 or Xperience by Kentico, with its release date, end-of-life date and any extended support windows as stated in the vendor's policy. Keep the copy of the policy you relied on. Note the date you confirmed it, because vendors revise these terms and your record should show what was true when you decided.
URL and form test results
Keep a test log showing that each priority URL resolves to the expected content, that redirects return the right status codes, and that every form submits, validates and delivers its data to the intended recipient. Include screenshots or response captures and the tester's name. These results show what worked before cutover, and they are the first evidence you will need if a regression appears after launch.
Access and patch records for the contingency period
If cutover slips past the deadline, record every administrator account, every access grant and removal, every patch or compensating control applied to Xperience 13, and who approved each change. Keep the logs from your web server, database and identity provider. These records show that the unsupported period was managed deliberately and was limited to the time you planned for.
Signed scope and change records
Keep the signed statement of work, the agreed deliverables and the change requests that altered scope or timelines, with approval dates. Each change should name the affected components and the risk accepted by the business owner. Without these, it is hard to explain later why a feature was dropped or why cutover moved, and who decided it.
How DeployOpen plans a Kentico 13 exit under a fixed deadline
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, so an exit from Xperience 13 runs as a defined project with written deliverables. We start by fixing scope and dates against the Kentico support end date, then build, test and hand over the replacement in your environment.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- We inventory page types, content volumes, forms, personalization, integrations and authentication flows in your Xperience 13 site.
- We agree which target path applies, whether Xperience by Kentico, Umbraco or another open-source CMS, and record the reasons in the scope.
How we build
- We map content types and page templates to the target model, then rebuild widgets, forms and marketing features where they are in scope.
- We migrate content and media, keep URL mappings for pages that must stay reachable, and test each migration batch against the source.
- We run security testing on the new application and its APIs, and harden hosting, database and identity configuration before go-live.
How we hand over
- We deliver architecture notes, runbooks, backup and restore procedures and a record of configuration decisions for your team.
- We prepare evidence of controls and change records that your internal assessors or independent auditors can review, without issuing any audit report ourselves.
- We walk your engineers through upgrades, content editing and incident response so the platform stays operable after handover.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- If the cutover date moves, we can agree a written interim plan for hardening and monitoring the existing Xperience 13 site.
- Retainer scope, response expectations and upgrade cadence are confirmed in writing, so you can ask for them in your quote.
