Shopware 5 EOL: The Decision Shop Owners Now Face

Since July 31, 2024, Shopware 5 has officially been end-of-life. No security updates, no bug fixes, no vendor support. Two years on, thousands of shops still run on it — and by now every month of continued operation isn't a saving, it's an unquantified liability. This article sorts out what that means in practice and which decision is actually on the table.

What end-of-life really means

End-of-life sounds like a date, but it's a process that keeps getting worse:

• Security holes stay open. When a vulnerability is found in Shopware 5 or one of its dependencies, nobody patches it anymore. Every published vulnerability is an invitation with assembly instructions.
• Compliance tips over. If you process card payments, PCI DSS requires supported software. GDPR likewise demands state-of-the-art protection — a system without security patches is the opposite of that.
• The ecosystem dies with it. Plugin vendors no longer maintain their Shopware 5 extensions, payment providers switch off legacy interfaces, and modern PHP versions and current server environments become a compatibility risk.
• Every investment is sunk. Every line of custom code still written for Shopware 5 today is money spent on a platform without a future.

The point isn't that the shop fails tomorrow. The point is that the risk grows every month while your options shrink — whoever migrates under pressure migrates expensively.

The three options — an honest assessment

1. Hardened interim operation. If you can't take on the migration right away, harden what you have: isolate systems, put a WAF and monitoring in front, freeze the plugin inventory, test your backups. That buys time — nothing more. Interim operation is a bridge with an expiry date, not a strategy.

2. Migration to Shopware 6. For most Shopware 5 merchants the logical path: the data world is related, the team knows the vocabulary, and Shopware 6 isn't a polished-up version but a new architecture — API-first, with the Rule Builder and B2B capability in its core. Important: it's a migration, not an update. Data and business logic move; old code stays behind. Planning it as an update is how budgets fail.

3. Replatforming to another system. The EOL moment is also the right time for the fundamental question. If you have no custom processes, no B2B and no integration landscape, a cloud site builder may be the more honest choice. Once real process requirements appear, the calculation flips back — that threshold should be calculated, not guessed.

How to decide now

The decision doesn't need months — it needs a clean inventory:

1. Take stock: Which plugins, which custom code, which integrations actually carry revenue? What is dead inventory?
2. Price the risk: What does a day of downtime cost, what does a data breach cost? That's the reference figure for every migration quote.
3. Define the target: Migration is the best moment to cut legacy — if you rebuild the status quo one-to-one, you pay for ten years of mistakes a second time.
4. Frame the budget realistically: Replatforming projects start at around €30,000 and scale with data volume and integrations. The cost blocks in detail are on our pricing page.

For the execution itself — from data migration through SEO preservation to a go-live without downtime — our migration page covers the complete process including a checklist. And for how such a switch plays out in practice, see the Handelskönig replatforming: JTL-Shop to Shopware 6, with zero breaks in data, SEO and operations.

Shopware 5 is past its end. The only open question is whether you plan the switch — or it plans you.