Drupal 7 is end of life: your options in 2026

Drupal 7 stopped receiving community security fixes on 5 January 2025, so any new vulnerability in it can be published with no patch. You can pay for extended support, rebuild on a current Drupal, or move to a static site; for a small-business site the static option leaves the least to patch.

Written by the nextwebsite.co team, and last checked on November 7, 2026.

What end of life means for your site

Drupal 7 reached its end of life on 5 January 2025, after 14 years². Drupal.org no longer releases fixes for Drupal 7 core or its modules, and the security team says any vulnerability that affects Drupal 7 may now be made public without an advisory or a fix¹.

Your site doesn't stop working on that date. It keeps running, with every weakness found from then on left open. Drupal 7 sites also tend to sit on old PHP: PHP 7.4 lost its own security support in November 2022³, and 48.4% of PHP websites run a version that no longer gets security fixes⁴.

Your three options

Paid extended support. Commercial vendors sell security patches for Drupal 7 under extended support programmes. It buys time, but you're paying to stand still, and the PHP underneath still has to be supported by someone.

Move to a current Drupal. Drupal 10 and 11 are supported, but moving from 7 isn't an upgrade; it's a rebuild. The theme, many modules and custom code have to be redone. It makes sense if you rely on Drupal's strengths: complex content types, many editors with different permissions, or integrations built around it.

Rebuild as a static site. For a business site of tens or hundreds of pages, a static site built from your Drupal content gives you speed and a much smaller attack surface, with an editor your staff can use. There's no database or PHP on the public site to patch.

How to choose

Ask what the Drupal site actually does for visitors. If most pages are content, plus a contact form and perhaps a search, a static rebuild fits. If you run member accounts, workflows with approvals, or a large multilingual publication, a current Drupal may be the right home.

Moving without losing your rankings

Drupal sites often have years of path aliases, such as /node/123 alongside /about/our-team. List every one, and decide which address each page keeps. Where an address changes, redirect it permanently to its new page. Google's site-move guide recommends keeping those redirects for at least a year⁵.

Once the new site is live and stable, switch off the old server and its database. An old Drupal 7 install left running on a forgotten subdomain is still a target.

Checklist

Confirm the Drupal version and the PHP version your server runs.
List the modules the site depends on, and which of them do real work for visitors.
Export content, files and users, and list every URL including path aliases.
Choose: paid extended support for now, Drupal 10 or 11, or a static rebuild.
Redirect every URL that changes, and keep the redirects for at least a year.
Switch off the old server and database once the new site is live.

Check your own site

The free scan reads your platform and PHP version, and says whether it still gets security fixes. It takes under a minute.

Or run just this check: the php version checker.