Preparing for the Drupal 7 End of Life

It’s been said that all good things must come to an end.

Since 2011, Drupal 7 has powered tens of thousands of enterprise websites. In its day, Drupal 7 was a powerful, highly-configurable content management system, great for complex use cases that its better-known competitor—WordPress—struggled to handle.

Now, after nearly thirteen years, the Drupal team has announced that official support for the platform will be ending on January 5, 2025.

After this date, Drupal 7 will no longer be actively maintained. This means that websites that are still on the platform after this time will face security issues if vulnerabilities are discovered after that time. It also means that the themes and plugins your organization may be depending on may break and go unfixed.

The Drupal 7 end-of-life has been a long time coming. It was originally scheduled for November 2021, but the deadline has been extended several times since then.

Officially, the reason for the change was the COVID-19 pandemic and its impact on business priorities and budgets. Unofficially, it’s likely that at least part of the reason for the delay is how slow many enterprise users have been to upgrade to a newer version of Drupal.

With under a year until the deadline, the time to start thinking about a Drupal 7 migration is now. In this article, we’ll go over why upgrading or migrating is so critical and what you need to consider as you move your organization’s website to a better, more secure platform.

Why You Need to Migrate

Before we dive into why you need to upgrade or migrate, we need to touch on the difference between legacy and unsupported software.

When we’re talking about content management systems, “legacy” usually means old or obsolete. Drupal 7 was first released in January 2011. Over the last thirteen years, CMSes have become faster, more versatile, and easier to work with.

We’ve already written about the benefits of migrating to a modern CMS in another article. Still, just because something is old doesn’t mean it’s broken. Drupal 7 has been receiving regular updates since its release date that have fixed bugs and patched security vulnerabilities. This has allowed companies to stay on the platform for an extraordinarily long time.

As of January 2025, however, Drupal 7 will no longer be supported. Developers who have been maintaining their plugins for Drupal 7 will shift to working on plugins for Drupal 10. If you are still using Drupal 7 after that date, you are putting your site and your visitors at risk.

Security Risks

Security risks in content management systems tend to come in two flavors—vulnerabilities in the CMS core and vulnerabilities in plugins or dependencies.

Core vulnerabilities are issues with the content management system itself. A notable example was the March 2018 remote code execution vulnerability that was discovered in Drupal 6, 7, and 8. As long as your CMS is being actively maintained by its developers, core vulnerabilities tend to get discovered and patched. In the case of the March 2018 vulnerability, the Drupal team even patched several unsupported versions of the CMS due to the severity of the issue.

Plugin and dependency vulnerabilities occur when an issue is discovered in a third-party add-on or a third-party package that is required by the CMS. These threats can be more insidious because they often involve plugins that are widely used but no longer under active development. Abandoned or poorly-maintained plugins can expose sites to danger for a long time before they are patched or removed.

Once Drupal 7 reaches its end-of-life, the Drupal development team and most plugin developers will shift to working with other versions of the CMS. While it’s likely that an especially severe core vulnerability would be patched even if Drupal 7 is no longer receiving official support, issues will probably not receive the same attention or priority as they would in a newer version. It’s likely that many (if not most) plugin vulnerabilities will go un-fixed.

The safest course of action—for your website and everyone who visits it—is to upgrade to a newer version of Drupal or migrate to a more modern CMS altogether.

Features and Integrations

So far, we’ve focused on the ways in which an unsupported legacy CMS can jeopardize your site and the safety of your visitors. But there’s another reason why you should consider migrating.

Newer content management systems have features that make it significantly easier for your team to keep your website updated and integrate third-party services you rely on. Drupal 7’s interface is fine for web developers, but most new content management systems (and current versions of Drupal) feature editing tools and workflows that are easy for non-technical users to interact with.

When you upgrade to a modern content management system, you’ll also have access to an updated library of plugins. You’ll finally be able to use tools that can keep your team better-organized and increase your website’s conversion rate, including:

• Forms that integrate with your CRM

• E-commerce and digital payments

• SEO tools

• Multilanguage support

• Live chat

• …and more

Finally, modern content management systems tend to be faster. This is often due to a combination of more efficient data handling and frontend optimizations that were difficult or impossible to implement with older templating frameworks. Load time isn’t a vanity metric; a faster and more reliable website translates into better visitor retention, which means more leads and sales.

Migration Challenges

Drupal 7 was the last major version to have its core developed 100% in-house. Every version since Drupal 8 has utilized Symfony, an open source web application framework.

Lots of major software projects are based on Symfony besides Drupal, so it gets a lot of developer attention and support. Switching to a Symfony core has helped Drupal’s development team focus on improving Drupal’s features rather than worrying about minutiae.

Because Drupal 7 uses an entirely different core, though, upgrading to a newer version is not a straightforward process. Core changes, differences in plugins / contributed modules, and changes to Drupal’s templating system are just a few of the things that make it impossible to simply press a button and upgrade your site.

Whether you plan on sticking with Drupal or want to move to an entirely new CMS, you should think of this project as a migration—not just a simple upgrade.

Choosing a Path Forward

You know you need to get off of Drupal 7. Now what?

For most organizations, the choice boils down to upgrading to a new version of Drupal or switching to another content management system that will better serve their needs.

Drupal 7’s codebase is radically different from subsequent versions of Drupal and other modern content management systems. Whether you decide to switch to a newer version of Drupal or move to a more modern, feature-rich CMS like Statamic, you should treat this project as a full migration and not just a simple upgrade.

Migrations don’t happen overnight, so whichever option you choose, be sure to budget enough time to make sure your organization’s website is fully ported over by January 2025.

Upgrade to Drupal 10

Your first option is to migrate your Drupal 7 website to Drupal 10.

Even though you are sticking with “Drupal” as a content management system, Drupal 7 and 10 are so different that they might as well be different CMSes altogether.

Upgrading from Drupal 7 to 10 involves several steps, including:

• Conducting a content audit

• Backing up your Drupal 7 database and site files

• Evaluating contributed module (plugin) differences

• Assessing theme compatibility

• Migrating your data and content

• Rebuilding custom views, layouts, and custom functionality

• Validating data integrity

• Comprehensive post-migration testing

If you want to upgrade to a newer version of Drupal, you will need to find an agency that is capable of performing the job. The first place to start looking is on Drupal’s official list of certified migration partners. Agencies of all sizes are represented, from small shops all the way up to enterprise-scale digital partners that have worked with major corporations and NGOs.

Migrate to a New CMS

Your other option is to switch to an entirely new CMS.

In the thirteen years since Drupal 7 was released, the number of enterprise-grade CMSes on the market has grown exponentially.

That includes open source projects like Drupal, but also an increasing number of commercial options with improved features and better support options. Cloud-based CMSes are also available, freeing you from the need to maintain your own web servers or pay for separate hosting.

Every enterprise-grade content management system needs to be capable of managing, retrieving, and displaying a large amount of data. Where they differ is in their approach to handling those tasks. Drupal 10 is much better-equipped to handle those challenges than Drupal 7 was, but depending on your use case, another CMS may offer an even better solution.

We’ve written a comprehensive guide on CMS migrations that details everything you need to know about weighing your options, planning and budgeting for a migration, and choosing a partner to help you through the process.

It’s worth taking a look at all of the options that are out there. Even if you decide to continue using Drupal for the time being, you may discover a CMS that can help you solve a different business challenge down the road.

Pay for Ongoing Support

If you’re totally unsure of which path you want to take, there is a third option available: paying for long-term support from a third-party web development agency.

Dozens of different agencies are capitalizing on the upcoming Drupal 7 end-of-life by offering support options to organizations that either can’t decide on a path forward or have extremely long approval processes (e.g. healthcare, government).

So how do these companies plan on maintaining Drupal 7 after its official developers have stopped working on it?

At least some of them are doing so by maintaining private forks of the official Drupal 7 codebase. This means they are maintaining their own copies of the Drupal 7 core and commonly-used modules. The more reputable long-term support providers have hired experienced members of the Drupal 7 development team to guide them. Most providers rely on automated tools to help identify core vulnerabilities and scan installations for exploits.

While paying for ongoing support might seem like a quick fix, it’s a sub-par option with some major pitfalls to consider. Consider the following:

• It’s cost-prohibitive. Maintaining a Drupal 7 website with a long-term support provider is massively more expensive than budgeting for a one-time migration project. Newer content management systems can be hosted inexpensively.

• Feature improvements aren’t part of the bargain. Adding new functionality to your Drupal 7 website usually falls outside of a long-term support agreement. Integrations that would take a few hours to add on a modern CMS may take a development team weeks to graft into your old website.

• It isn’t Drupal 7 anymore. Even though your dashboard will still say “Drupal 7,” you will be on a non-standard “Frankenstein” installation. As time goes on and your LTS provider makes more changes to the core of your CMS, documentation and self-help tutorials may no longer make sense. Changes they make may introduce vulnerabilities of their own.

The only scenario in which ongoing support for Drupal 7 makes sense is when you know you will either be upgrading to Drupal 10 or migrating to a new CMS but need some additional time due to how your company handles project approvals or budgeting. It shouldn’t be seen as a substitute for migration.

Conclusion

You only have a few more months to decide what you want to do about your Drupal 7 website. Thankfully, there are many organizations in the same boat and many agencies that are willing to help. If you need help evaluating your options and planning next steps, talk to a trusted digital partner who can evaluate your unique situation and provide you with honest advice.