Drupal 7 reached end of life on January 5, 2025. The Drupal Security Team no longer issues security advisories for Drupal 7, no longer releases patches, and no longer coordinates responses to newly discovered vulnerabilities. Sites running Drupal 7 are not receiving security support.
This is not a hypothetical future risk. It is the current state of every Drupal 7 installation as of January 2025.
What End of Life Means in Concrete Terms
Security vulnerabilities will not be patched. When a vulnerability is discovered in Drupal 7 core or in contributed modules that have not been updated beyond their Drupal 7 versions, there is no official fix. Organizations on Drupal 7 must either develop their own patches, rely on community-developed unofficial patches, or accept the exposure.
Contributed module support has largely ended. Most contributed module maintainers ended their Drupal 7 support at or before the core EOL date. Modules that are not receiving updates carry vulnerabilities that will not be addressed.
Hosting compatibility will narrow. Drupal 7 requires PHP versions that are themselves approaching or past end of life. PHP 8.0 reached end of life in November 2023. PHP 8.1 reaches end of life in December 2025. Hosting providers will eventually drop support for older PHP versions, which means Drupal 7 sites may find themselves on increasingly limited or unsupported hosting configurations.
Compliance risk increases over time. Organizations subject to compliance requirements — HIPAA, FERPA, GDPR, PCI DSS, or contractual security standards — that require running supported software are now potentially out of compliance on their Drupal 7 installations.
What Has Not Changed
Drupal 7 sites continue to function. End of life does not mean the software stops working. Sites on Drupal 7 continue to run and serve content. The functionality that existed before EOL continues to operate. EOL means the security support model has ended, not that anything breaks immediately.
The urgency depends on the site’s risk profile. A Drupal 7 site serving low-traffic, non-sensitive informational content carries different risk than a Drupal 7 site handling user registrations, processing payments, managing personal data, or subject to security audits. The exposure is the same; the consequence of exploitation differs.
What the Path Forward Looks Like
There is no upgrade path from Drupal 7 to Drupal 10 or 11 in the traditional sense. The architecture, module system, and database schema changed too significantly in Drupal 8 to allow a direct in-place upgrade. A Drupal 7 to current Drupal transition is a migration project.
What that migration involves: a content audit and migration using Drupal’s Migrate module, a new theme built on current Drupal standards, a review of custom modules (which must be rebuilt for the new Drupal version’s architecture), and a new hosting environment appropriate for Drupal 11.
The scope depends on what the Drupal 7 installation contains — how much content, how many custom modules, how complex the data model, and what integrations exist. A technical assessment of the current installation is the necessary starting point for realistic scoping.
Extended Security Coverage
The Drupal Association and a number of commercial providers offered Extended Long-Term Support (ELTS) for Drupal 7 — paid security coverage that continued beyond the official EOL date. Some hosting providers bundled this coverage for their Drupal 7 customers.
If the site is not on ELTS coverage, it is receiving no security updates at all. If it is on ELTS coverage, that coverage has a defined end date that should be confirmed — ELTS is a bridge, not a permanent solution.
The Decision
The decision is not whether to migrate off Drupal 7 — that decision has been made by the platform’s EOL. The decision is when and in what form.
Migrating proactively, with a planned scope and realistic timeline, is significantly less expensive and disruptive than migrating reactively after a security incident forces an emergency transition. Organizations that have been deferring this decision are paying the cost of that deferral in accumulated risk, not in avoided work — the work is coming either way.
How Cool Fire Inc Approaches Drupal 7 Transitions
Cool Fire Inc has managed Drupal 7 to current version migrations for higher education, nonprofit, and enterprise clients. Every migration begins with a technical assessment of the current Drupal 7 installation that produces a realistic scope and timeline before any commitment is made.
Frequently Asked Questions
Is my Drupal 7 site in immediate danger now that it has reached end of life?
The risk depends on the site’s exposure. A Drupal 7 site with known vulnerabilities, high traffic, and user data is at meaningful risk. A low-traffic informational site with no user data has lower immediate risk but is still operating without security support. All Drupal 7 sites should be migrated — the question is how urgently.
Can I stay on Drupal 7 indefinitely?
Technically, yes — the software continues to function. Practically, the risk profile worsens over time as vulnerabilities accumulate without patches, hosting compatibility narrows, and compliance exposure grows. Extended Long-Term Support buys time but is not a permanent solution. Migration is the only path that resolves the situation.
How long does a Drupal 7 migration take?
A well-scoped migration from a moderately complex Drupal 7 site to Drupal 11 typically takes three to six months. Larger sites with significant custom modules, complex data models, and multiple integrations take longer. The technical assessment produces a realistic estimate for the specific site.
How much does a Drupal 7 migration cost?
A straightforward migration from a simple Drupal 7 site can be completed for $20,000 to $40,000. A complex migration from a heavily customized Drupal 7 site with significant custom modules and content volume is a larger project. The technical assessment is the right starting point for an accurate estimate.
What are the risks of a Drupal 7 security incident?
The risks include: site defacement, spam injection, phishing redirects, data exfiltration if user data is present, SEO damage from Google blacklisting a compromised site, and downtime during incident response. For organizations with user data or compliance obligations, the additional regulatory and notification costs can be significant.