Drupal 7 will stop receiving security updates in January 2025.

Many organizations have not upgraded from Drupal 7 to later versions due to fundamental differences introduced in Drupal 8 and beyond. Those differences mean it’s often just as much effort to build a new Drupal 10 site as it is to update Drupal 7 to a later version.

Drupal 8 was released in 2015 and version 7 largely stopped receiving feature updates shortly thereafter. Sites that remain on Drupal 7 have likely been around for eight or more years without a major refresh. It’s likely that other parts of the site, like its visual identity, content organization, accessibility, security, and infrastructure could also benefit from an update.

Now is a good time to consider a change. Because considerable effort will need to be made one way or another, organizations reaching the end-of-life for this platform have the freedom to explore other platforms and other strategies that better serve their current business requirements.

If your organization is facing this wall, you have some decisions to make.

Pay for extended support or roll the dice and do nothing

There is a large community of developers who contribute to the core Drupal project and even more providing modules to extend it. It’s the size and passion of this community that helps surface and fix vulnerabilities. There are companies that purport to offer unlimited support into the future, but as the community pulls away from an officially unsupported release, those companies won’t have the broad base of resources to even find what to fix, or even access to original developers to fix contributed modules.

This is the path of least resistance but introduces the highest risk. We don’t recommend this for any serious site.

Build a new Drupal 10 site

For large teams that are used to managing a Drupal 7 site, the savings on retraining costs may be enough to warrant staying with Drupal. Effort will still need to be made to build out and transition to a new site. This is a great opportunity to perform a design refresh—maybe even rolled into a re-brand for the entire organization.

Organizations that go this way will have a relatively easy time transitioning their existing content model. Nevertheless, it’s a good idea to evaluate old information that can be archived or if there are features on the current site that no one uses anyway.

Do something different

If it’s been ten years since a website has been updated, it’s a good bet that the organization behind it has grown and changed in that time. Maybe the overhead of a system as robust as Drupal is overkill for what could be a simpler site. Maybe content organization has gotten out of control and a different paradigm is in order. Maybe the team that set up the site originally is long-gone and internal support is lacking.

Taking a sober look toward the future with a clear understanding of actual requirements can inform an entirely new site with an improved user experience and business utility.