Ægir is the good old friend of open-source hosting, the Drupal control panel that made running many sites simple. We rebuilt that friend as a superhero. The same easy panel tasks now drive the very latest codebases, Drupal 11 and Drupal CMS, super-armoured against the newest threats. We made Drupal 9, then 10, then 11 run on Ægir after most of the field called it impossible, then took over its stewardship. One promise runs under all of it: we don't strand the people who trusted us.
Under the friendly panel is armour we sharpen almost daily: a stack where crashed services restart on their own, traffic storms get shed, and updates land unattended, so a fifteen-year-old site and a brand-new one stay protected side by side. Most vendors' roadmaps are a list of endings: versions dropped, products sold, licences that climb. Ours has none of those. It runs ~30 years, one team, from the 1995 first control panel to Ægir's wheel today. Here is the case, on five counts.
The portfolio
The through-line was never any single product; it is a standard: open, sovereign, fast, structured, built to last. For ~30 years we have backed the platforms that meet it and refused the ones that don't. Drupal simply served that standard best for the longest stretch. Pressflow 6 and Drupal 7 are the orphans we keep first-class; Backdrop, the Drupal 7 continuity path, now runs here first-class too; Textpattern, the kindred platform we chose before Drupal, is rejoining; Grav runs our own docs. The portfolio is the receipt that "we support the new without leaving the old behind" is a fact, not a tagline.
1. Still running
When a platform reaches end of life, handling it becomes our job: old sites stay first-class here, never retired on a schedule.
- Pressflow 6 and Drupal 7 first-class on our own improved core forks: D7 on the latest PHP 8.5, and a legacy site and a modern one running side by side (PHP 5.6 through 8.5, per site).
- Elsewhere: Acquia dropped Drupal 7 platform support after November 2025 and routed extended support to a third party (HeroDevs).
- On other roadmaps: Pantheon's free Drupal 7 LTS (with Tag1) ends 2027-01-05, a dated cliff already on the calendar.
The industry retires your sites on a schedule. We keep them running.
2. Still maintained
This is where the good old friend turns superhero: Drupal 9, 10 and 11 made to run on Ægir when the field called it impossible. Then we took over its stewardship, and the panel still works with the same few clicks.
- One panel installs the latest Drupal and Drupal CMS alongside a broad, maintained catalogue: the same one-click tasks, the newest codebases, no "build it yourself."
- Meanwhile: Platform.sh rebranded to Upsun (September 2025) and split the product into Fixed and Flex: the platform under your site can be renamed and reshaped from above.
- Elsewhere: Lagoon's owner, amazee.io, turned towards Kubernetes and enterprise-AI consulting, and Drupal is heritage there now, no longer the centre of gravity.
3. Runs itself
The security-and-self-healing core we improve almost daily to protect every tenant: stuck services get restarted, hostile traffic gets shed, and fixes land on their own, no ticket required.
- Self-healing watchdogs catch a down or stuck service and repair it in place, usually before you'd notice; a load auto-pause rides out a traffic storm and recovers on its own.
- An always-on abuse guard drops hostile floods, scanners and unwanted AI bots at the edge, including the distributed one-request-per-IP attacks that per-IP limits never catch.
- A per-site IP lock puts the whole site, or only its login and admin pages, behind the addresses you choose (IPv4, IPv6 or CIDR ranges), from a control file in your own account: an unreleased staging site answers to your team and nobody else, and your live SSH connection is always admitted, so you cannot lock yourself out.
- SKYNET keeps the whole stack current with zero touch; on hosted plans, files back up every 6 hours and the database every night, both kept 90 days.
- Underneath the stack, the operating system patches itself as well: OS security updates now apply between our releases instead of waiting for the next upgrade run, security-only and on by default on modern systems, with a new kernel activated through BOA's own graceful reboot, never a surprise restart.
- Working before you configure anything: Valkey (the open Redis-class cache) just works, nothing to do; New Relic monitoring is one licence key in a control file plus one line in the site's INI; Composer and Drush are ready to use. And it is deeply tunable when you want it: all 12 PHP versions, from legacy 5.6 and 7.0 to the latest 8.5, switch per site or globally. The cheat sheets show those dials one page at a time.
- Elsewhere: six-hourly backups on a 90-day window sit against an industry norm of daily or weekly.
Boring, on purpose. You know we're there.
4. Yours to own
The instinct that won't abandon a customer won't be captured by a vendor either: leaving is always possible, so staying remains your decision.
- Free/libre open source, LTS free forever, running on any server in any country, on fork choices (Devuan, Percona, Valkey) that keep any vendor's licence pivot away from your stack.
- Others enforce a workflow. We only suggest one. Nothing here is enforced, only recommended: manage your sites through Ægir's panel, through git and Composer, or entirely by hand over secure FTP (FTPS), no git and no Composer required. We provide the tools, deep configurability and control; how you use them stays your call.
- By contrast: Pantheon, Acquia and Upsun each run only on their own cloud, with no self-hosting and no bring-your-own-provider.
The loop runs both ways. The whole case is on the sovereignty page.
5. Still one team
One focused team since 1995: no private-equity owner, no rebrand carousel, no pivot to something else.
- The line runs unbroken, from the 1995 first web-hosting control panel through ~19 years of Drupal and ~16 years of Ægir hosting: ~30 years, one team, now Ægir 3's lead maintainer.
- We already carried customers across the web's single largest break: Perl to PHP, the pre-CMS era into Drupal. A Drupal version bump is a smaller crossing than one we have already made.
- Elsewhere: Acquia has been private-equity-controlled since Vista Equity Partners took a controlling stake in 2019 (~$1B), and now sells a broad multi-product suite where hosting is one layer.
The proof
The argument rests on artefacts you can inspect for yourself. Security and reliability hardening across the stack, an abuse-guard toolchain rebuilt from legacy Perl into modern shell, publicly disclosed-and-fixed vulnerabilities, SSH hardening across the fleet, and a full product documentation site, all in the open. The clone-and-migrate that used to take an afternoon now delivers a living copy of the whole site in 3–6 minutes. The durable version of all of it lives at docs.boa.io.
The verdict
On every count the evidence points one way: your sites still running, the platform still maintained by us, the service quietly fixing and defending itself, the stack yours to run anywhere, the team unchanged since 1995. The market's story is discontinuity, with dates attached. Ours is ~30 years of the opposite: the good old friend, re-armoured, still carrying everyone forward. If continuity is the thing your platform is missing, this is the safe harbour.