Drupal 7 End of Life: What You Actually Need to Do
Drupal 7 stopped receiving security updates on January 5, 2025. If you’re still running it, your site is now in the danger zone. Not “maybe you should think about this” zone — actual security risk zone where vulnerabilities won’t be patched.
I’m not saying this to scare you. I’m saying it because I’ve migrated dozens of Drupal 7 sites and I’ve seen what happens when organizations procrastinate. You don’t want that.
Your Options, Honestly Assessed
You’ve got three real paths: migrate to Drupal 10 or 11, move to WordPress, or go headless.
Drupal 10/11 migration is the “safe” choice if you’re deeply invested in Drupal’s ecosystem. You keep your authoring experience, your contributed modules get updated, and Drupal handles the complexity of modern web architecture. The problem? It’s expensive and time-consuming. If you’ve customized Drupal 7 heavily, you’re rebuilding those customizations. A typical medium-sized Drupal 7 site takes 3-6 months and $15,000-40,000 to migrate properly. That’s not a number I’m pulling from thin air — that’s what the market actually charges.
WordPress migration makes sense if you’re running a content-heavy site and you’ve got simple data structures. WordPress is easier to host, cheaper to maintain, and there’s a massive ecosystem of plugins. The downside: if your Drupal 7 site does complex things (custom workflows, complex taxonomy structures, data relationships), WordPress might feel limiting. A WordPress migration typically takes 6-12 weeks and $5,000-15,000 depending on customization.
Headless Drupal (using Drupal as a backend API only) is trendy right now and it’s genuinely useful if you’re building a new frontend anyway. You decouple your CMS from your presentation layer, which gives you flexibility. But headless migrations are the most expensive and time-consuming option. You’re essentially building two systems instead of one.
The Mistakes I’ve Seen Organizations Make
The first one: waiting too long. Organizations assume they have more time than they do. “We’ll migrate next year.” Then compliance asks about security patches. Then vendors won’t support your site. Then you’re rushed into a bad decision. Start planning now.
The second one: treating the migration like a technical lift-and-shift. A real migration is an opportunity to audit your content, clean up your data structure, and rebuild thoughtfully. Organizations that try to just port everything as-is end up with a Drupal 7 site that runs on Drupal 10’s server. That defeats the purpose. The migration takes longer because you’re not optimizing for your actual current needs.
The third one: not budgeting properly. Clients think a migration is cheap because “it’s just moving data.” It’s not. It’s rebuilding your entire system on a new platform with new architecture, new dependencies, and new development practices. If you’re quoted $3,000 for a full migration, you’re either getting a very simple site or you’re getting a bad outcome.
The fourth one: not involving your team early. If you’re the only person who understands your Drupal 7 site, that’s a risk. Before migrating, document what you’ve got, how it works, and why you built it that way. That documentation is invaluable when the developers arrive.
What Happens If You Do Nothing
Security vulnerabilities will be discovered in Drupal 7 core and contributed modules. They won’t be patched. Your site becomes increasingly vulnerable to compromise. Hosting providers are already warning Drupal 7 sites about the EOL deadline. Some are starting to drop support.
Browsers and security tools will start flagging older sites. Google’s going to continue prioritizing fast, modern sites in search rankings. Your Drupal 7 site, running on older infrastructure, will slowly slip down results.
Your tools won’t work with it anymore. Payment processors, email services, analytics platforms — they’re dropping support for old CMS integrations. You’ll find yourself in a position where you can’t integrate modern services because your CMS is too old.
The Real Path Forward
If you own a Drupal 7 site, get a technical audit done first. Understand what you’ve actually got: how much custom code, how much data, how much complexity. That audit costs $1,500-3,000 and it’s the best money you’ll spend because it tells you exactly what your migration path should be.
Then choose: Drupal 10/11 if you love Drupal, WordPress if you want simplicity, or headless if you’re building something new anyway.
Finally: budget properly and plan for 4-6 months of work if your site is substantial. If you try to rush it, you’ll make decisions you regret.
The hard truth: Drupal 7 migrations aren’t fun. They’re complex, they require careful planning, and they cost real money. But they’re infinitely cheaper and less painful than dealing with a compromised site or a legacy system that nobody can maintain.
If you’ve got a Drupal 7 site and you’re weighing your options, we’ve done enough of these migrations to help you think through which path makes sense for your organization. The key is deciding sooner rather than later, before the security debt becomes unmanageable.