February 2025: Umbraco 8 went out of support, at the bottom of a quarterly digest

· JD + AI · Umbraco

February 2025: Umbraco 8 went out of support, at the bottom of a quarterly digest

Umbraco 8 stopped receiving security patches in February 2025. If you still have a site on it, that is the only sentence here that changes your risk profile, and the rest is context.

The rest is also thin. Our harvest found six Umbraco items in the whole of February, and this post cites all six. That is not a shortlist, it is the month. Three of the six come from umbraco.com's own blog, so half of what we can cite is the vendor writing about itself, and one of the remaining three is not about Umbraco at all. February 2025 is also a month we reached backwards through feed archives rather than harvesting live, which under-represents the community blogs that publish without a durable archive. Read the thinness as partly ours.

One 4,000-word post is carrying the entire month

Umbraco Product Update - Q1 2025 — Filip Bech-Larsen, Umbraco — the vendor writing about its own products

Published on 27 February, and it is doing the work of four or five separate announcements. Well down the page, under a heading called In other news…, sits the one with teeth: Umbraco 8 has reached end of life, and sites on it "will no longer receive security patches, bug fixes, or official support from Umbraco HQ". Six years, and the end of .NET Framework in the supported line. The sites keep working, which is exactly why this gets deferred.

Two dated deadlines sit in the same post, relayed from Microsoft's TLS schedule: Azure blob storage moves to TLS 1.2+ only from 1 April 2025, and Azure SQL databases from 1 September 2025. Umbraco says its internal monitoring shows no Cloud customer will be affected. That is a statement about their hosting, not about the integration you wrote in 2017 that still pins an old protocol, so check that before you take the reassurance.

Then a free win that is nearly embarrassing to read: by Umbraco's own internal monitoring, about 20% of Cloud traffic that could be cached at the CDN is not. One toggle. Go and look at yours.

The Cloud security additions are worth diarising for a different reason. The Web Application Firewall is on automatically for new projects and environments but must be enabled by hand on existing ones, which means every project you inherited is the one without it. Management API Security adds IP allowlisting on the .git and .scm.umbraco.io domains, which closes a door most teams did not realise was ajar.

On Commerce 15, Umbraco reports order throughput moving from 30,000 to 70,000 per hour and P95 response times dropping from 2s to under 1s. Those are the vendor's own test numbers on the vendor's own tiers. Useful as a direction of travel, not as a figure to put in a client proposal before you have measured your own configuration.

The forward-looking items are all still forward-looking: Tiptap becomes the only rich text editor shipped in Umbraco 16, with TinyMCE surviving as a paid Marketplace package; a search abstraction RFC was open for comment; containerisation and backoffice load balancing were described as in progress. If you have custom TinyMCE configuration, the Tiptap decision is your v16 work item and it was announced here, in a digest, in February.

The positioning post, which is a positioning post

Why we think of Umbraco as a CMS platform - and why that matters — Filip Bech-Larsen, Umbraco

755 words of marketing from the company that sells the thing, and it does not pretend otherwise: "Even our competitors want to be in our marketplace - and we take pride in that." Nothing to act on. Worth reading once, because this is the vocabulary that will come back at you in a procurement document.

What the community actually published

uProfile February 2025 - Terence Burridge — credited on the page to "The Umbraco Community", with no individual byline

Terence Burridge, an Umbraco MVP, died on 8 February 2025. The post collects tributes from people who organised the meetups he travelled absurd distances to attend, and closes with a message his wife Angela shared afterwards, in which he described contributing back to the community as something that "provided a beacon of light in what was a difficult and often dark final time". This is not release notes and we are not going to file it as community news and move on. It is the item from this month with the longest half-life.

Season of AI: Recap of the Microsoft Trustworthy AI Meetup in Gothenburg and I was interviewed by Detectify on the topic of Security as an Enabler — Dennis Adolfi

Two short notes, 90 and 97 words. The first records a 35-person Gothenburg meetup on Microsoft's Trustworthy AI framework; the second points at an interview hosted on Detectify's blog, where Adolfi argues that "a strong Security posture can actually foster a strong innovation culture". Neither is Umbraco content. Both are here because an ecosystem's blogs are where its people are, and in February 2025 its people were at meetups.

A developer with ADHD? — Owain Williams, writing at Owain Codes; the harvest recorded the byline as the site handle "Owain.Codes", which is the record being wrong rather than the page

A personal post about recognising adult ADHD symptoms after years of being told his coding speed needed to increase, to the point where he now says it first himself: "I know I'm slow at coding." No Umbraco in it. It is on this list because it is in the month's record, and because the gap between "slow developer" and "undiagnosed" is one that a lot of teams get wrong from the manager's side.

The argument this month is evidence for

A vendor's quarterly digest is the wrong container for an end-of-life announcement. The Umbraco 8 EOL, an Azure TLS deadline, a change to firewall defaults and a doubled Commerce throughput figure all arrived in one post, on the 27th, under a heading that reads In other news…. Every one of those has a different audience and a different deadline, and bundling them means the person who needed the first one skimmed past it on the way to the product screenshots. Security and lifecycle news should travel on their own, on the day they are true.

And on our side, the honest reading of a six-item month is that our source list was too short for February 2025, not that the ecosystem was asleep. The fix is more sources, not a lower bar.

Sources

umbraco · sitecore-search · umbraco-cms · umbraco-backoffice · umbraco-cloud · deployment · commerce · product

2026 © Umbracolombia - All rights reserved.