What's up with those Umbraco updates?

Let's start with the conclusion (there are several conclusions, but this one is probably the most important):

• The threats to data security, such as website hacking, are higher than ever.

• Umbraco's security level is very high because Umbraco is constantly developing and updating its technology.

• Your own website will only remain secure if you keep up with the updates, and keeping your website up-to-date is a prerequisite for GDPR compliance.

Your house needs maintenance - and so does your CMS

It's a bit like a house. When you build a new house with new bricks, windows and doors, it's solid and secure. Wind and water can't get in and you can sit quietly in your cosy living room. But as time passes, the need to fix little things here and there arises.

Fortunately, it doesn't have to be that bad. If you maintain the joints and regularly paint the woodwork, you'll avoid corrosion, rot and cracks in the structure where moisture can penetrate. However, if you wait until the damage is done, it can be extremely expensive because parts of the house will have to be completely replaced.

It's the same with your CMS. Over time, holes and cracks can appear that pose a threat to data security. Not because the design was poor from the start, but because technology evolves and shady cybercriminals get better and better at finding their way in.

If you regularly maintain your CMS, you can avoid the cracks opening up for hackers to get in. It can be a pain to spend time and money on, but in the end, it means you don't have to spend a lot more time and money repairing or replacing your CMS - or at worst, losing data to the wrong people.

Goodbye to tech debt

In the tech world, we talk about avoiding tech debt. The bottom line is that small problems can grow big if you don't deal with them along the way. When systems are not maintained or become obsolete, tech debt grows steadily. At first, the debt isn't that big, but over time, interest accrues and eventually the debt becomes much larger than if you had put in smaller amounts along the way.

Since Umbraco launched its first version in 2003, there have been thousands of improvements. Many of them have been tiny, but together, the development has been enormous.

Companies that ignore the updates for years to save a few thousand dollars every now and then often end up having to replace everything. The cost depends on the complexity of your website, but several hundred thousand dollars is not uncommon.

Hello to security and GDPR compliance

Keeping your Umbraco installation up to date isn't just a good idea from a technological perspective. It's also an important factor if you want to comply with GDPR requirements - how you handle personal data. When you update your CMS, you not only close the security gaps that inevitably arise along the way, you also get ongoing access to new features that improve data management and data protection.

So updates are inevitable. But how often should you update your Umbraco installation and what does it cost you in time and money?

The difference between minor and major releases

As mentioned, Umbraco is constantly developing the technology behind the CMS. Every six weeks they release a minor release with small improvements, bug fixes and optimisations. This is when the version name changes from, for example, version 15.0 to 15.1.

The improvements in minor releases are typically small bug fixes or new, minor features, and the vast majority of companies do not need to react to these separately. However, the same cannot be said for major releases.

Umbraco's major releases are released every six months and involve larger and more fundamental changes, both in terms of functionality and security. Here, the version name changes in whole numbers, e.g. from version 15 to 16.

As a starting point, we recommend that you have the latest major version. As a rule, this will also be the version we develop for if you come to us and need a completely new website. That way you get the highest level of security, the most user-friendly solution and the best possible performance.

Still, there are companies that don't want (or need) to update every six months. In that case, it makes sense to consider how long you can support your web solution.

Short Term Support and Long Term Support

Umbraco divides their major releases (the ones that come out every six months) into two more categories: Long Term Support (LTS) and Short Term Support (STS). Every fourth major release is an LTS version; the others are STS versions. In other words, a new LTS version is released every two years.

As the names indicate, the LTS versions are supported with security updates and other improvements for a longer period than the STS versions.

If you want to keep your CMS updates to a minimum, a sensible guideline is to update every time a new LTS version is released. This way, you can maintain a reasonable level of security and performance despite limited resources.

The figure below shows when Umbraco expects to release the different updates.

And then there are the security patches...

If you’re feeling a bit overwhelmed, that’s understandable. For now, it’s about you and your Umbraco partner deciding whether to update with every minor release (every six weeks) or only with the larger releases every six months or two years.

However, there is one last, very important thing that can pop up from the right at any time (typically about every four months): security patches. Security patches are when Umbraco discovers a significant security flaw that can't wait to be fixed until the next minor or major release.

Security patches are something you should never ignore, but luckily it's something your trusted Umbraco partner can keep an eye on - and fix - for you.

How often should I update my Umbraco CMS?

There is no one answer that is right for all companies when it comes to how often you should update your CMS. In particular, it depends on your company's requirements for security, usability and performance.
Let's summarise what this article has provided as rules of thumb:

• Minor releases (every six weeks): Minor updates that you don't necessarily have to deal with.
• Major releases (every six months): Major updates in terms of security and functionality. You should be aware of these. If you don't want (or need) to update every six months, it's a good idea to update at least every two years when the released update is a Long Term Support version.
• Security patches (anytime): You should always respond to these.

If you continuously update and thus maintain your website, you'll have a solid building that can last for many years.

Companies that keep their website updated will find that they don't have to start from scratch, even though they may eventually want a completely new graphic design. They will also find that their website performs better because it doesn't limp along on outdated technology.

Maintenance is therefore not just about avoiding security disasters or keeping the technological debt down. It's also about future-proofing your website so that your business gets value from it for many years to come.