ColdFusion modernisation
Solve With Software takes over ColdFusion applications the business still depends on: CFML written between 2000 and 2015, on a version Adobe no longer patches, by a developer who's moved on. ColdFusion is still a live product, so there are three paths: upgrade to ColdFusion 2025 and modernise in place, move the same code to the open-source Lucee engine, or leave CFML one page at a time behind a proxy. The assessment reads the code and prices each as a fixed number.
Free · 1 hour · no obligation
Where ColdFusion stands
Adobe still ships it. ColdFusion 2025 is current, on a subscription licence, and supported to April 2030; ColdFusion 2023 is supported to May 2028. Everything before that is out of support: 2018 ended in July 2023, and 2021's core support ended on 10 November 2025 with extended support ending 10 November 2026. An application on CF 9, 10 or 11 has been unpatched for years.
The other engine matters. Lucee is an open-source CFML server that runs most ColdFusion code with small changes, on a current Java, with no licence fee. For a business that wants to keep its CFML and stop paying per core, it's a serious option, and it's where a lot of the CFML community has gone.
What hasn't changed is the shape of the applications: a set of .cfm pages with the logic in them, a database, a few custom tags, written when that was how web applications were built, and the same page-by-page problem Classic ASP has.
Three paths
Upgrade in place to ColdFusion 2025. Keep the code, move the runtime. Deprecated tags and functions get fixed, security settings tightened, and the application ends on a supported version with Adobe behind it. Costs the subscription, keeps everything familiar.
Move to Lucee. The same code, an open-source engine, a current Java underneath, no licence. Some ColdFusion-specific tags and behaviours need adjusting, which the assessment lists. Right for a business that wants to keep CFML and cut the cost.
Leave CFML in stages. Where the application would be rebuilt anyway, or where nobody left can hire for CFML. The new system is built alongside in .NET or the web stack, one page or one process at a time behind a proxy, with ColdFusion still serving what hasn't moved. Users see one change at a time.
Often the first or second, then the third. Get it supported first, because that removes the risk; then decide the rest with the pressure off.
The staged path
- Get it running on a current machine, from source control, against a copy of the database. Missing custom tags, hard-coded paths and a datasource nobody can recreate are the first surprises. The assessment does this first.
- Safety net. A test environment, a staging environment, and tests around the processes that matter.
- Move the runtime, to ColdFusion 2025 or Lucee, fixing the deprecated and engine-specific code the compatibility check lists. Run in staging against the live schema, reconcile, switch.
- Secure it. Old CFML applications were written before most of today's attacks; input handling and the admin console are checked and fixed.
- Replace page by page, where leaving is the plan, behind a proxy, in order of risk and value.
- Retire the old server when the last page has moved.
Each stage has its own fixed price and each ends with the application safer than before.
Your data
Usually SQL Server or MySQL, sometimes Access or Oracle, and it stays where it is. A runtime move changes how queries are run, so the data layer never meets a change until the change has proven itself somewhere else: tested against a copy in a test environment, then run in staging against the live schema with results reconciled, before anything connects to live.
Can this be done gradually?
Yes. A runtime move is one switch, rehearsed in staging. A rebuild goes one page at a time behind a proxy, with the ColdFusion application serving the rest, and can pause between pages with everything still working.
What it costs
The assessment is from £395 + VAT, sized on a free one-hour consultation, with an exact price before you commit. For a ColdFusion application it gets the code running on a copy, runs the compatibility check against ColdFusion 2025 and Lucee, maps every page and datasource, and prices the three paths as fixed numbers alongside what each costs to run. What drives the price and the payment terms each have a page.
The risks of waiting
The date, first: 10 November 2026 for ColdFusion 2021, and everything older has been unpatched for years. ColdFusion has had serious remote vulnerabilities, and an old application facing the internet on an old engine is the exposure a security questionnaire will find. Then the people: CFML developers are hard to hire, and the one who knows this application is a single point of failure.
How we approach it
Get it running, make it safe, move the runtime, then decide the rest. Marc Allington reads CFML as one more server-side language from the same era as Classic ASP, and builds in the .NET and web stacks a ColdFusion application moves to. Everything we build runs on open, widely used technology, in your own accounts, with full source code and ownership transferring to you on final payment.
The technical checklist for a ColdFusion application
| Check | Why it matters |
|---|---|
| ColdFusion version and licence, Java version underneath, Windows or Linux | Sets the urgency and what the runtime move costs. |
| Does it run on a current machine from source, against a copy of the database? | If not, that's stage one. Missing custom tags and datasources are the usual reason. |
| Compatibility check against ColdFusion 2025 and Lucee | Lists the deprecated tags and engine-specific code each path has to fix. |
| Every page, and which ones carry the logic | Maps the application; decides the order of a page-by-page rebuild. |
| Datasources, and whether they can be recreated | Often the only copy of a connection string is on the live server. |
| Input handling, session handling, admin console exposure | Where old CFML applications are attacked. |
| Integrations: email, payment, file drops, scheduled tasks | Every one has to keep working through a runtime move. |
| Tests, source control, deployment process | Usually none. The safety net comes first. |
Each answer goes into the report with its path, its consequence and a fixed price.
Questions
What people ask before they book.
Is ColdFusion dead?
No. Adobe ships ColdFusion 2025 on subscription and supports it to 2030, and Lucee is an active open-source engine. What's dead is the version most old applications are on. Staying on CFML and moving the runtime is a real option.
What is Lucee, and can our code run on it?
An open-source CFML engine on a current Java, with no licence fee. Most ColdFusion code runs on it with small changes; the assessment's compatibility check lists which tags and behaviours in your application need adjusting.
ColdFusion 2025 is subscription only. Do we have to pay it?
Only if you stay on Adobe's engine. Lucee removes the licence; leaving CFML removes the engine. The assessment prices all three paths alongside what each costs to run each year.
Can we replace it one page at a time?
Yes. A proxy in front routes each path to the old ColdFusion application or the new one, so users see a single site while pages move in order of risk and value. It's the same approach we use for Classic ASP.
How long does a ColdFusion modernisation take?
It depends on how many pages there are and which path the assessment recommends. The shape is the usual one: running and safe first, on a supported runtime within about six weeks, then one stage at a time, each priced before you commit.
Start with a free consultation
An hour on your system, online or by phone. From there we size the assessment, from £395 + VAT, and give you an exact price before you commit.
Want the numbers first? See how pricing works.
Written by Marc Allington, founder. .