Security support for Drupal 7 ends on 5 January 2025. In the last few years, there have been multiple extensions to the Drupal 7 lifeline but this is the final one; Drupal 7 will not receive any new security updates after that.
In this post, we provide you with all the available options to help you reach an informed decision on how to migrate (or not) your Drupal 7 website(s).
Drupal 7 end of life: Some history
5 January 2025 marks 14 years since Drupal 7’s release. Hundreds of thousands of sites, from micro to Enterprise, have been utilising Drupal 7 and, fortunately, its usage has been decreasing during the last few years:
Nevertheless, Drupal 7 is currently (Drupal usage statistics shown above are from 1 September 2024) powering 291,386 Drupal websites; That's almost 40% of the 728,784 Drupal websites! That's a huge number of websites reaching their end of life (EOL) in less than 4 months from the time of writing.
Drupal 7 to 8 (or higher) upgrade path
Drupal is on the surface a procedural system, because it is built in a procedural language (PHP without classes).
The statement above is from a very old drupal.org article (last updated on 23 December 2016) but it does encapsulate how Drupal 7 has been perceived through the years and especially when compared to higher versions.
Drupal 8 was released on 19 November 2015 and it has been a major rewrite of the Drupal Core and its APIs. Drupal 8 code rewrites widely adopted Object Oriented Programming paradigms but that meant that there would most probably be no easy upgrade path to Drupal 8 (or higher). As a result, upgrading a website from Drupal 7 to Drupal 8 is considered to be a much harder task compared to upgrading from version 8 to any other higher version.
Upgrading to Drupal 10 & 11 and CMS features
We've written an informative guide on Drupal 10's features as well as Drupal 11 release announcement and description of features. Make sure you've gone through these posts as well as the detailed Drupal 10 upgrade guide to gain a deeper understanding of what features and upgrade paths are available for the latest versions of Drupal CMS.
Drupal 7 risks after 5 January 2025
1. Security vulnerabilities
Drupal 7 will no longer receive any security updates after 5 January 2025. If your live website is still on Drupal 7 beyond this date, it will be open to critical security risks.
2. Compatibility and compliance issues
While technology and the web evolve over time, compliance standard specifications (and their more recent versions as time goes by) will continue to be valid. But Drupal 7 websites will have no solid way of catching up with this progress, leading to non-compliance against standards such as HIPAA and SOC 2.
Lower versions of PHP that Drupal 7 is compatible with won't be supported anymore either and in many cases, Drupal 7 server requirements will start becoming incompatible with the stacks hosting providers support. You can find more information on Drupal 7's system requirements on the corresponding drupal.org page.
3. Unsupported modules, themes and libraries
As soon as Drupal 7 modules and themes became unsupported, they remained as such (see related Public Service Announcement on drupal.org) and no drupal.org community support is to be provided anymore for any Drupal 7 modules and themes:
Community support for contributed modules and themes will continue as it has to date. However, beginning August 1, 2023, once the Drupal 7 branch of a contributed module or theme is marked unsupported it will not be eligible for new maintainership and will not be marked supported again. This will be true if an existing maintainer marks the module/theme unsupported, or if the security team marks it unsupported for lack of response. If there are Drupal 7 modules or themes that you or your clients rely on, then we strongly encourage you to adopt these projects proactively.
This is a problem that affects libraries and plugins too (for example CKEditor versions lower than 5).
For any plugins that need expanding, maintaining or bug fixing, Drupal 7 website owners and maintainers will have to resort to planning and implementing these changes themselves (also adopting a project all-together) within the in-house team or by contracting an external digital agency or contractors. This naturally requires a significant investment of time and money on keeping Drupal 7 websites afloat.
4. Depreciation of your web assets
Trying to maintain an obsolete application substantially intervenes with the ability to establish and nurture professional relationships with clients, partners and team members. No new features will be added to Drupal 7 websites and problems with software incompatibilities and deteriorating performance will keep coming up, depreciating your Drupal 7 website(s) more and more with time. As a result, your website(s) will be less appealing to leads, partners and collaborators.
Available options for your Drupal 7 website
1. Migrate to the latest stable Drupal version
Migrating your website from Drupal 7 to Drupal 11 or 10 will most probably be the most time-consuming option from all the alternatives presented below as Drupal 7's Core, modules and themes don't exactly have a clear upgrade path to higher versions of the CMS.
But this is still the most technically sensible option if you want to have the latest and greatest in the CMS market. Drupal 11 (and 10 as Drupal 11 was only released in August 2024) is the most features-rich version of the Drupal CMS and it can support any size and kind of your web application needs, from micro/brochure websites to full-blown enterprise solutions.
There are two logical ways of upgrading your Drupal 7 website:
- Migrate from D7 to D8 and then to D11
- Migrate from D7 directly to D11
Regarding the first option, because Drupal 8 is also EOL, it's not recommended to stay on this version. Instead, a complete migration to Drupal 11 should occur after this first stage is complete.
The migrate module (included in Core from Drupal 8 and up) can be extremely useful for complex migrations from Drupal 7 to higher versions and its companion module, Drupal 8 upgrade evaluation, can be used to analyse your project's compatibility to Drupal 8 (note that the evaluation module is no longer supported so only use locally with caution).
Regarding the second option, completely redeveloping your website on Drupal 11 and then performing a content migration is a very common scenario. The content migration could be manual or, through the use the migration module, it could involve exporting the D7 website's content in a structured data format (e.g. CSV or YML) and then using the exported data files to import the content into the new Drupal 11 website. This option also provides you the opportunity to redesign your website under a new shiny Drupal 11 theme or apply some partial tweaks to give your new website a refreshed look and feel.
2. Migrate to another Content Management System
This option only makes financial sense if your D7 website is small enough to allow for a relatively easy rebuild using an alternative CMS platform or even low/no-code solutions such as SquareSpace, Webflow, Weebly or Wix. This would allow you to save up resources that would otherwise be allocated to upgrading to a higher Drupal version and, for simple brochure websites, it could be the way to go.
3. Stay on Drupal 7 and create a static public version for your visitors
This option involves "translating" your dynamic D7 website into static HTML files and serving these files to your visitors. This static copy of your website could be hosted anywhere and no special system requirements would be required anymore.
The back office of your D7 website would be "locked" and only available to your content editors or site administrators under very secure measures (e.g. IP restriction, Cloudflare Rules, VPN etc.) which would keep the more vulnerable and dynamic aspect of your D7 website "hidden" from the public.
4. Stay on Drupal 7 and tread carefully i.e. maintain your website using your own resources
This option is similar to the previous one but doesn't necessarily involve creating a static copy of your website. Instead, this option would ensure that your Drupal 7 website is using the latest stable versions of Core, modules and themes and additional measures would be taken to fortify the website from vulnerabilities.
That would mean that your in-house team of an external agency would monitor and maintain the website to a high degree, making sure that no Drupal 7 exposed vulnerabilities can pose an actual threat for the website; fixes would have to be coded on an ad hoc basis.
For large or complex Drupal 7 websites, this option could require a high volume of resources devoted to the project and, sooner or later, the application will become so obsolete that you'll eventually have to resort to an alternative strategy.
Conclusion
At the time of writing, less than four months remain until Drupal 7 becomes EOL. This is the time to take some important decisions regarding your D7 web assets and it's advisable to come up with your D7 migration plan sooner than later.
ORION WEB can help you migrate, maintain and EOL-support your Drupal 7 website. Contact us to analyse your D7 EOL strategy and discuss the steps required for your website to remain up-to-date and competitive.