End of life — meaning the software no longer receives security patches — is one of those phrases that sounds administrative until you understand what it actually means. For Drupal 7, it means this: when a security vulnerability is found in the software, nobody fixes it. There is no patch. There is no update to apply. The vulnerability just exists.
Drupal 7 reached that point in January 2025. It's now nearly two years into end-of-life status, which means any vulnerabilities found since then are unfixed, publicly documented, and available to anyone looking for unpatched Drupal 7 sites to exploit.
A significant number of Drupal 7 sites are still running. This post is for the people responsible for them.
What end of life actually means, practically
While a version of Drupal is actively supported, the Drupal Security Team monitors for vulnerabilities, coordinates with developers to build patches, and publishes security advisories — official announcements that a vulnerability has been found and a fix is available. Site owners apply the fix. That process works reasonably well.
When a version reaches end of life, the Security Team stops covering it. No more advisories. No more patches. If someone finds a vulnerability in Drupal 7 tomorrow, they can publish it, talk about it publicly, build working exploit tools — and there is nothing official that will ever fix it.
This is not the same as being behind on security updates. When you're behind on updates, there are updates to apply. When you're on an end-of-life version, there aren't. That's a fundamentally different situation.
Why so many sites are still on Drupal 7
It's worth being honest about this: Drupal 7 was an excellent piece of software. It ran well, it was well-supported for over a decade, and many organisations built substantial sites on it. Migrating away is real work — often significant work — and it doesn't come with an obvious immediate benefit when the existing site is still functioning.
The Drupal community extended the end-of-life date more than once specifically because so many sites were still running it. The final date of January 2025 was the result of those extensions.
The other factor is that Drupal 7 migrations aren't simple version bumps. Drupal 8, 9, 10, and 11 represent a substantial architectural change from Drupal 7 — effectively a different framework. A Drupal 7 to Drupal 10 or 11 migration is closer to rebuilding the site than updating it. The time and cost involved is real, and it's understandable that organisations have been reluctant to start.
Drupal version status at a glance
| Version | Released | End of life | Status |
|---|---|---|---|
| Drupal 7 | January 2011 | January 2025 | End of life |
| Drupal 8 | November 2015 | November 2021 | End of life |
| Drupal 9 | June 2020 | November 2023 | End of life |
| Drupal 10 | December 2022 | ~January 2026 | Nearing end of life |
| Drupal 11 | August 2024 | ~Late 2027 | Supported |
Note that Drupal 10 is itself nearing end of life. If you're migrating from Drupal 7, migrating to Drupal 11 directly avoids having to do this again in the near term.
What happens to a Drupal 7 site now
In the short term, probably nothing dramatic. End of life doesn't cause an immediate collapse. Your site continues to function. Visitors can browse it. You can still log in and edit content.
What changes is the trajectory. Every month that passes, the security position of a Drupal 7 site gets incrementally worse. More vulnerabilities go unfixed. More exploit tools become available. Automated scanners that probe the internet for vulnerable sites don't stop scanning.
The question isn't whether this creates risk. It does. The question is how much risk your organisation is comfortable carrying, for how long.
A note on extended support options: there are third-party providers offering paid extended support for Drupal 7 — essentially continuing to produce security patches commercially. This is a legitimate short-term option if migration isn't immediately feasible, but it's worth understanding that this is a temporary bridge, not a permanent solution. Migration remains the only permanent resolution.
What a Drupal 7 migration actually involves
As mentioned above, this is real work. It's not a software update. It's closer to a site rebuild that brings your content and configuration across to a modern Drupal installation.
The practical steps typically involve:
- Auditing what's on the current site — content types, features, integrations, contrib modules (the add-ons and extra features built on top of Drupal)
- Identifying which of those have equivalents in modern Drupal and which need to be rebuilt or replaced
- Building the new site on Drupal 10 or 11
- Migrating content across — which Drupal has built-in tools for, though they require configuration
- Testing thoroughly before launching
The timeline and cost vary significantly depending on the complexity of the site. A straightforward content site with a handful of content types is a very different proposition to a large site with complex custom functionality, integrations, or editorial workflows.
Getting started
If you're not sure what's on your current Drupal 7 site or what a migration would involve, a site audit is usually the right first step. Understanding the scope of the work makes it much easier to plan and budget for it.
Nodely works with organisations moving from Drupal 7 to modern Drupal. We can assess what's involved and, once you're on a supported version, keep it maintained properly going forward. Get in touch if you'd like to talk through where your site is.