Where things stand: Shopware 5 ended in July 2024
Shopware stopped developing version 5 at the end of July 2024. There have been no security updates since 31 July 2024. The later release 5.7.20 (June 2025) was a pure maintenance release. Third parties such as safefive sell security patches – explicitly without bug fixes or new features. Their own motto: "secure, not keep".
The underrated date: 31 December 2026
Shopware 5.7 officially runs on PHP 8.2 at most. PHP 8.2 only receives security updates until 31 December 2026. From 2027, both your shop and its runtime run without patches. PHP 8.3 works with Shopware 5 only partly; retailers in the forum report a broken plugin manager and blog. Many hosts also retire old PHP versions or charge extra for them.
Five risks you don't see day to day
- Open vulnerabilities. Every newly found gap stays open. Shops are popular skimming targets because payment data flows through them.
- GDPR liability. A breach must be reported within 72 hours. Known outdated software makes your defence hard.
- Payment compliance. Since 31 March 2025, scripts on payment pages must be authorised and monitored (PCI DSS 4.0). Shops with a pure payment iFrame or redirect can be relieved of this, but must show that their page is not vulnerable to script attacks. On outdated software that is hard.
- Accessibility. Since 28 June 2025 the German Accessibility Act (BFSG) applies to B2C online shops. Only micro-enterprises with fewer than 10 employees and an annual turnover or balance sheet total of at most €2 million are exempt. Fines up to €100,000.
- Standing still. New payment methods, marketplace connections and AI features are built for Shopware 6 only. Every integration on version 5 is costly custom work.
What Shopware 6 measurably delivers
Speed is revenue. A Deloitte study commissioned by Google across 37 brands and over 30 million sessions found that a 0.1 s faster mobile load time lifted retail conversions by 8.4 % and spend by 9.2 %. Shopware 6 relies on HTTP cache, Elasticsearch/OpenSearch and a modern Bootstrap 5 storefront.
Less manual work. With Rule Builder and Flow Builder you build shipping rules, discounts and email flows yourself, without a developer ticket.
Future-proof. Shopware 6.7 includes accessibility improvements for the European Accessibility Act and gets security updates until February 2028. Its API-first approach lets headless frontends, apps and ERP connect cleanly.
In practice: We have completed more than 20 Shopware migrations, including shops with over 100,000 products and up to 6,000 orders a day. Along the way we built internal tools for data validation, redirects and go-live that you won't find anywhere else.
Why migrations fail – and how to avoid it
The official Migration Assistant moves products, customers, orders and SEO URLs. According to Shopware's documentation it does not move templates, shopping worlds, shipping cost rules, email and document templates, or B2B Suite data. Plugins must be replaced or rebuilt.
The typical mistakes: starting integrations too late, no test migration with live data, forgotten 301 redirects, go-live on a Friday. The fix is a four-phase process: analysis, data migration with test runs, parallel development, cutover with delta sync and monitoring.
What does it cost?
Cost depends mainly on design, plugins, integrations and data volume. In our projects a small B2C shop starts at €15,000; a mid-sized shop with ERP usually lands between €50,000 and €80,000. Our migration calculator gives you a fixed price and a go-live date in three minutes – guaranteed after a free migration check.
Conclusion
Shopware 5 still runs – for now. But every month adds risk and effort, and the PHP deadline at year-end turns "later" into "now". A migration is predictable when scope, price and date are fixed up front.
FAQ
Is Shopware 5 still secure?
Not without extra measures. There have been no security updates since 31 July 2024. The later release 5.7.20 (June 2025) was a pure maintenance release.
How long does a migration take?
Typically 5 to 12 weeks, depending on design, plugins and integrations. Large shops with ERP integration take up to about 6 months.
Will I lose my Google rankings?
Not if SEO URLs are carried over and every old URL is 301-redirected.
Can I keep my design?
Yes, it is rebuilt for Shopware 6. Templates cannot be transferred 1:1 technically.
Sources (checked 16 Oct 2026)
- Development ends at the end of July 2024 (docs.shopware.com)
- 5.7.20 of 5 June 2025; 6.7 security support until 28 Feb 2028 (endoflife.date)
- Shopware 5.7 at most PHP 8.2, 5.7.20 included (github.com)
- PHP 8.2 EOL 31 Dec 2026 (herodevs.com)
- Extended support without bug fixes/features (maxcluster.de)
- What the Migration Assistant does not move (docs.shopware.com)
- PCI DSS 4.0 6.4.3/11.6.1 (docs.clover.com)
- BFSG from 28 June 2025, up to €100,000 (t3n.de)
- Deloitte/Google, 37 brands, 30 million sessions, data from late 2019 (web.dev)
- EAA improvements in 6.7 (shopware.com)