Drupal 7 End of Life: What It Means and What to Do Now

The short answer

Drupal 7 reached end of life on January 5, 2025. Your site did not switch off that day, and it probably still looks fine. But it no longer gets security updates from the Drupal project, so every new vulnerability found in Drupal 7 or its modules stays open on your site.

If your organization still runs Drupal 7, you have three real options: rebuild on current Drupal, move to WordPress, or move to a modern headless setup. Paid extended support can buy you time, but it is a bridge, not a plan. This guide explains what end of life actually means, what the risks are, and how to pick the right path.

What Drupal 7 end of life actually means

End of life means the Drupal Security Team no longer reviews or patches Drupal 7. Core gets no new releases, and most contributed modules have stopped updating too. The community has moved on to Drupal 10 and 11, which are a different codebase.

In practice, three things change:

• Security holes stay open. When a vulnerability is published, attackers can use it against Drupal 7 sites, and no official fix is coming.
• Hosting gets harder. Drupal 7 depends on older versions of PHP and other server software. As hosts retire those versions, an old site can break during a routine server update.
• Help gets harder to find. Fewer developers want to maintain Drupal 7 code, so every fix costs more and takes longer.

Drupal 8 and 9 are already past their own end-of-life dates (November 2021 and November 2023), so sites on those versions are in the same position.

The real risks of staying on Drupal 7

The biggest risk is a hack. Old CMS sites are a favorite target because attackers can scan the whole web for one known weakness. A compromised site can serve spam pages, redirect visitors, or leak form submissions, and cleaning it up costs far more than a planned move.

There are quieter costs too. Insurance questionnaires and grant or vendor security reviews increasingly ask whether your software is supported. Old themes often fail accessibility checks, which matters if you serve the public or receive federal funding (see our accessibility audit page). And every month on an unsupported platform makes the eventual migration a little bigger.

Your options after Drupal 7

1. Rebuild on Drupal 10 or 11

There is no one-click upgrade from Drupal 7. Drupal 8 was a complete rewrite, so moving to current Drupal means building the site again and migrating the content with Drupal's Migrate API. This is the right path when the site has complex content types, many editors with different permissions, or integrations that depend on Drupal.

2. Move to WordPress

For most small businesses and nonprofits, WordPress is the practical choice. It is easy for editors to learn, it runs on almost any host, and there is a large pool of developers if you need help. The content still moves by script, so pages, images, categories and authors arrive intact.

3. Go headless with Next.js and Sanity

A headless setup separates the content editor from the website itself. The result is a very fast site with a much smaller attack surface, and an editing experience most teams enjoy. It is a good fit for organizations that want a modern site they will not need to rebuild again in five years. It is what our own site runs on.

A stopgap: paid extended support

Some vendors sell extended security support for Drupal 7. It can be worth it if you need six to twelve months to plan and budget a migration. It does not fix old hosting requirements, old themes or the shrinking developer pool, so treat it as a bridge to one of the options above.

How to choose the right path

Ask four questions:

• Who edits the site, and how often? A small team that updates pages weekly usually does best on WordPress or a headless CMS.
• How complex is the content? Many content types, custom workflows and fine-grained permissions point toward current Drupal.
• What does the site connect to? CRMs, donation tools, member logins and custom modules all need a plan on the new platform.
• Is it time for a redesign anyway? The templates are rebuilt in every option, so a migration is the cheapest moment to refresh the design.

If you are not sure, a short review of your current site usually makes the answer obvious. We are happy to say so if staying on Drupal is the right call.

What a Drupal migration involves

A good migration is mostly planning. The work usually runs in four stages:

• Audit: an inventory of content types, fields, modules, users, files and integrations.
• Plan: a content map, a redirect map from every old URL to its new address, and a launch plan.
• Build and migrate: the new site is built, then content is moved by script and checked page by page.
• Launch: redirects go live, Search Console is monitored, and editors are trained.

The step that protects your Google rankings is the redirect map. Most traffic drops after a migration come from old URLs that lead nowhere. Done properly, visitors and search engines land on the right new page every time.

What it costs

Cost depends on how much content you have, how custom the site is, and where it is going. Our Drupal migration services start at $7,500, with a fixed quote after a free review. A migration combined with a redesign is quoted as one project. Once you are on the new platform, a care plan keeps it updated so you are not facing the same problem again in a few years.

Next step

If your site still runs Drupal 7, the best time to plan the move is before something breaks. Book a free Drupal migration review and we will look at your site, recommend where it should go, and give you a fixed price.