Platform reality check
The Umbraco release and support picture in 2026
Before choosing a CMS, look at the maintenance calendar it puts you on and the attack surface it hands you. Every figure below is traceable to the source named under its column.
Where WordPress vulnerabilities came from in 2025
Patchstack, State of WordPress Security in 2026
Of 11,334 new WordPress ecosystem vulnerabilities in 2025, 91 percent sat in plugins and 9 percent in themes. Only six touched core.
1,966 of those issues were high severity, the class most likely to be swept up by automated mass attacks.
Total disclosures rose 42 percent year on year, and high severity disclosures rose 113 percent.
How the CMS and runtime market splits
W3Techs CMS and server-side language surveys, 4 August 2026
WordPress sits on 41.2 percent of all websites and 59.1 percent of the tracked CMS market, which is why its plugins are scanned so hard.
ASP.NET runs 4.3 percent of sites with a known server-side language against 70.5 percent for PHP. Smaller, but it is where enterprise .NET estates live.
Umbraco measures at less than 0.1 percent of all websites. It is a deliberate niche platform, and that shapes both hiring and vendor choice.
Four numbers worth writing on the whiteboard
Umbraco tracks the Microsoft .NET release train, so your CMS upgrade calendar and your runtime upgrade calendar become one calendar. That is a real advantage for a .NET shop and a real cost if nobody owns it.
If your site is still on Umbraco 13, the third tile is the one that matters. Per endoflife.date, security patches stop on 14 December 2026 unless you buy extended support, and Umbraco 8 took its last security patch in February 2025.
Umbraco against WordPress on the things that decide a buildPlatform choice
Sources: W3Techs surveys dated 4 August 2026, Patchstack State of WordPress Security in 2026, Umbraco documentation and endoflife.date. A fit comparison, not a verdict. WordPress wins plenty of briefs.
| Feature | Umbraco | WordPress |
|---|---|---|
| Runtime and language | ||
| Licence for the core CMS | ||
| Release cadence | ||
| Support window you can plan against | ||
| Third party code exposure | ||
| Talent pool | ||
| Best fit |
| Feature | Umbraco |
|---|---|
| Runtime and language | |
| Licence for the core CMS | |
| Release cadence | |
| Support window you can plan against | |
| Third party code exposure | |
| Talent pool | |
| Best fit |
Umbraco Cloud, self-hosting, and the licence questions
The core CMS is free. The money shows up in hosting, in the paid Umbraco products, and in who keeps the version current.
Umbraco Cloud
Managed hosting from Umbraco HQ Cloud runs your site on Azure with environment deployment built in. Umbraco documentation publishes the envelope per plan: Starter includes one environment and allows two, with 20 percent CPU and 1,500 MB memory. Standard includes two and allows three at 35 percent CPU. Professional includes three, allows four, and lifts CPU to 50 percent. DesignRush's 2026 pricing breakdown lists Starter at 40 euro a month, Standard 250 euro and Professional 650 euro. Confirm current rates with Umbraco before budgeting.
Self-hosted Umbraco
Your Azure, AWS or data centre Because the CMS is MIT licensed you can run it anywhere .NET 10 runs, on SQL Server 2016 or later, with SQLite for local development. Self-hosting is cheaper on infrastructure and dearer on people: backups, environment promotion, CDN and upgrades all become yours. It is the right call when data residency or an existing cloud agreement drives the decision.
The paid Umbraco products
Forms, Deploy, Workflow, Commerce, Engage Umbraco HQ sells commercial add-ons around the free core. DesignRush's 2026 breakdown lists Forms at 250 euro per domain, the Heartcore headless product from 55 to 1,000 euro a month by tier, and Deploy on premises between roughly 4,550 and 9,100 euro one off plus an annual subscription. We tell you which of these you need before you buy any, and the answer is often none.
Version strategy
LTS or ride the train Two majors ship each year. Per endoflife.date, long term support versions get 24 months of support plus 12 months of security fixes, while standard releases get nine plus three. Umbraco 18, released 25 June 2026 with 178 fixes and 36 breaking changes, is a standard release and loses security support on 25 June 2027. Most business sites should sit on the LTS.
If you are running Umbraco 13 or older
The December 2026 deadline Version 13 stops receiving security fixes on 14 December 2026 per endoflife.date, and version 8 took its last one in February 2025. Umbraco 17 supports a direct upgrade from 13 with migrations applied automatically, which is the cleanest route. Extended support contracts buy time, and on Cloud an end of service policy moves unsupported projects to dedicated hosting before hosting stops.
How a Dcrayon Umbraco engagement runs
New build, a version 13 upgrade or ongoing care, the shape is the same and the artefacts are yours at every stage.
- 1Free audit and version position
We check your version against the published support calendar, plus hosting, custom document types, package dependencies and the build pipeline. You get a written position on what is safe, what is out of support and what an upgrade really costs. No obligation to continue.
- 2Content model and editor experience
Umbraco projects fail on document type design far more often than on code. We model content types, compositions, block lists and the Library elements introduced in version 18 around how your editors publish, then prove it in the back office before front end work starts.
- 3Build in C# with review gates
Everything ships as reviewed C# in your repository, with environment configuration kept out of code, the case insensitive SQL Server collation Umbraco documents as a requirement, and a pipeline that fails on a broken build. Peer review is mandatory on every task.
- 4Test what visitors and editors touch
We benchmark real page weight, Core Web Vitals, back office responsiveness, forms, search and your integrations. Findings come with numbers, and anything that regresses gets a root cause note rather than a silent patch.
- 5Handover and version maintenance
You get documentation, the deployment runbook and a maintenance plan pinned to the published Umbraco and .NET support dates, so nobody meets an end of life date by surprise. Keep us running it or take it in house cleanly.
Who you work with
Your Umbraco team works from Delhi
Web builds we have shipped
Selected work from our web development practice.
+143%
Speed Improvement
McCormick & Company
Within one sprint cycle, desktop Google PageSpeed Insights score rose from 35 to 85 — a 143% improvement. Mobile score moved from below 40 to 75. C...
24h
Order dispatch
GRYT Health Labs
The launched site reads as a focused, conversion-first shop rather than a catalogue dump. Because it is a custom Laravel build, the cart, checkout...
Daddy of Tastes
The launched storefront gives customers a quick path from category to dish detail to cart, with offers and ratings visible where they aid the decis...
Instacertify
The site reads as a single command center for certification, with search and clear calls to action giving buyers an obvious first step. The card-dr...
Northern Tile Distributors
The storefront gives Northern Tile Distributors a clean way to present deep tile and timber ranges so builders can scan collections quickly and che...
Raa Logistics
The launched site gives Raa Logistics a clean, professional presence that reads well on both desktop and phones, with the quote request and trackin...
Umbraco questions buyers ask
The CMS is, under the MIT licence. What costs money is hosting, the optional commercial products Umbraco HQ sells around the core such as Forms, Deploy, Workflow, Commerce and Engage, and the development work. DesignRush's 2026 pricing breakdown lists Umbraco Cloud at 40 euro a month for Starter up to 650 euro for Professional. Self-hosting removes the Cloud line and adds an operations line.
For most business sites, the current long term support release. Umbraco 17 LTS shipped on 27 November 2025, runs on .NET 10 and, per endoflife.date, is supported until 27 November 2027 with security fixes to 27 November 2028. Umbraco 18 arrived on 25 June 2026 with 178 fixes and 36 breaking changes, but as a standard release its security support ends on 25 June 2027. Build on 18 only if you need something specific in it.
Reasonably urgent. Per endoflife.date, version 13 receives its last security fixes on 14 December 2026, after which patches stop unless you buy an extended support contract. Umbraco 17 supports a direct long term support to long term support upgrade from 13 with migrations applied automatically, so it is a single planned project rather than four sequential ones.
When you already run .NET, when the site integrates with internal systems, when editorial governance matters more than plugin choice, and when the site will live for years rather than a campaign season. The security data helps: Patchstack recorded 11,334 new WordPress ecosystem vulnerabilities in 2025, 91 percent of them in plugins. If your brief is a fast content site with no .NET context, WordPress is often the better answer and we will say so.
We do not claim a partner tier. Umbraco runs a commercial partner programme, and any agency's status can be checked on the official Umbraco partners directory. We would rather you verify a claim than take it from a sales page. What we do offer is a .NET development practice, C# code you own in your own repository, and a named human lead who answers for the work.
Yes. The Delivery API is part of the CMS, and Umbraco 18 generates typed OpenAPI schemas per content type, which makes a typed TypeScript client straightforward for a React or Next.js front end. Umbraco also sells Heartcore as a managed headless product, and at Codegarden 2025 announced a Model Context Protocol server and a Toronto Cloud region, as reported by CMS Critic. Headless or server rendered Razor should come down to your front end team and caching strategy, not fashion.
Get a free Umbraco audit
Tell us your current version, hosting and the problem you are solving. We will come back with a written view on your options.
Plan your Umbraco build with Dcrayon
A new build, a version 13 upgrade before the December 2026 deadline, or steady maintenance on an LTS release. Start with a free audit and a named lead who answers for the work.