Pantheon Sets 31 March 2027 Deadline for Legacy Global CDN Migration

Customers hosting websites on Pantheon have until 31 March 2027 to migrate eligible legacy Global CDN (GCDN) sites to its next-generation infrastructure. In a release note published on 26 October 2026, Pantheon said it will begin migrating sites that have not been upgraded in April 2027. Customers can identify sites requiring migration through a GCDN banner on the Site Dashboard.

The deadline affects organisations managing Drupal and WordPress websites on Pantheon's older CDN infrastructure. The replacement network runs on Cloudflare and includes bot protection enabled by default, alongside support for custom certificates, platform vanity domains and Multizone Failover. Pantheon also lists Edge Traffic Visibility and Workspace Performance Insights among the new capabilities. Sites already using NextGen GCDN, including those created on or after 10 September 2026, do not require another migration. Pantheon also plans to migrate sandbox sites automatically by the end of 2026.

Advanced Global CDN (AGCDN) customers follow a separate process and must not initiate the standard self-service upgrade. Pantheon has committed to contacting them by 15 December 2026 to coordinate their migration. An earlier AGCDN release note dated 14 October 2026 confirms that the company is migrating advanced configurations in phases, with its Professional Services team reviewing existing rules, preparing supported configurations and coordinating DNS changes. Customers who have not received instructions must wait for Pantheon's guidance. Pantheon also warns AGCDN customers who have already started a self-service upgrade not to change DNS records and to contact Support.

Standard GCDN customers using custom SSL certificates or platform vanity domains also require assistance rather than an entirely self-managed transition. For customer-provided certificates, Pantheon must upload the certificate to the replacement CDN before the associated domains move. For vanity domains, the company coordinates the necessary DNS changes with customers. Other eligible sites can follow the documented migration process, which requires a DNS TXT record for domain ownership verification and, by default, a second TXT record for certificate issuance before updating DNS to the new CDN. Pantheon also offers HTTP-based certificate validation through its Terminus plugin, but that option cannot provision the certificate before cutover and may entail brief downtime.

Pantheon's migration instructions identify compatibility requirements that site administrators must address before switching. Custom-domain CNAME records pointing to Pantheon platform hostnames ending in pantheonsite.io are unsupported on the new CDN and will cause interruptions during migration. Administrators must use the DNS records provided for their domains, not CNAMEs to platform hostnames; Pantheon advises affected customers to contact Support before migrating. The platform also requires third-party CDNs and reverse proxies to send matching TLS Server Name Indication (SNI) and HTTP Host values. Requests with mismatched values receive HTTP 403 responses, and Pantheon identifies Azure Front Door as currently incompatible with this requirement.

For Drupal sites, Pantheon's technical FAQ states that the standard migration does not require application code changes. Existing caching behaviour is maintained, including support for the Pantheon Advanced Page Cache module and surrogate-key-based cache invalidation. The module connects Drupal's cache metadata with Pantheon's CDN so that affected pages can be cleared when underlying content changes. These capabilities are expected to continue operating on the replacement infrastructure.

Automated integrations, however, may require additional checks because NextGen GCDN applies bot protection to incoming requests. Pantheon acknowledges that legitimate automated services can encounter managed challenges after migration, potentially returning HTTP 403 responses or challenge pages instead of the expected content. This can affect Drupal-related workflows involving feed imports, API clients, monitoring tools or other automated requests. Pantheon documents a terminus gcdn:bot-bypass command for obtaining tokens that authorised automated clients can send in the x-pantheon-bot-bypass request header. These tokens should be treated as credentials, and other platform protections still apply; customers requiring further exceptions should contact Support.

Pantheon describes the standard migration as designed to avoid downtime, although its documentation identifies circumstances where interruptions remain possible. The company notes that platform hostnames may experience a few minutes of downtime while the migration completes. Certificate verification through HTTP, for example, may cause brief downtime because the certificate cannot be provisioned before the DNS cutover. Customers using an existing Cloudflare proxy must also follow the supported Orange-to-Orange configuration process rather than assuming their current DNS settings will remain suitable. These conditions make pre-migration checks important even where the Drupal application itself remains unchanged.

After 31 March 2027, Pantheon will take responsibility for migrating remaining eligible sites and says customers will receive at least 60 days' notice before their scheduled migration. Organisations that migrate earlier can select their own change window and validate DNS, certificate handling, caching and external integrations before the deadline. Pantheon directs customers to its setup documentation and support channels for the migration procedures applicable to their configurations.