Drupal 7 end of life

Drupal 7 end of life (EOL) is the point at which the Drupal project stopped maintaining the Drupal 7 branch. Sites that still run Drupal 7 get no security updates from the project, and a newly found vulnerability will stay unpatched unless the owner pays a vendor or leaves the platform.

What changed on 5 January 2025

Drupal.org states that Drupal 7 security support ended on 5 January 2025. It describes that date as the final extension; the end-of-life date had been moved before, from 1 November 2023, in public service announcement PSA-2023-06-07.

According to that announcement, the Drupal Security Team no longer provides support or security advisories for Drupal 7 core, and the same holds for contributed modules and themes. The announcement also warns that security issues may be disclosed publicly and that external vulnerability scans will flag Drupal 7 as insecure. The end-of-life page adds that sites may fall out of compliance with standards such as FedRAMP, PCI, HIPAA and SOC 2.

Your options

The Drupal.org end-of-life page names two options and adds one piece of advice:

• Migrate to a current Drupal version. The Drupal Association points to its Migration Resource Center and Certified Migration Partners.
• Buy extended security support. The Drupal Association runs an Extended Security Support Provider Program. On 26 October 2026 its partner page lists HeroDevs and Tag1 Consulting as the certified vendors.
• Tell your users and stakeholders, such as customers, managers or your CISO, what your security plan is.

Extended support is a commercial service bought from one of those vendors, and Drupal.org lists no prices or term lengths. Because the Drupal Security Team no longer publishes Drupal 7 advisories, fixes do not reach you through the standard security update flow.

How migration works in Drupal 11

Drupal 11 core includes the modules Migrate Drupal and Migrate Drupal UI to bring a Drupal 6 or Drupal 7 site into a new Drupal 11 site. In the 11.4.10 source, the UI module adds an Upgrade page at /upgrade, described as upgrading content and configuration from a Drupal 6 or Drupal 7 site, and its form accepts either version as the source.

Both modules are marked lifecycle: deprecated in core 11.4.10. The Drupal.org page on deprecated extensions, last updated 21 September 2026, says Migrate Drupal UI was deprecated in 11.3.0 and is removed in Drupal 12.0, and that Drupal 12 keeps the migration API but not the Drupal 6 and 7 sources. It adds that Drupal 7 sites should migrate to Drupal 11 and then use the regular upgrade route to Drupal 12. The 11.4.0 release notes say the Drupal 7 migration path stays supported throughout the Drupal 11 release cycle.

Example

Take a brochure site on Drupal 7 with one custom module. The module will not run on Drupal 11, so the team rebuilds it as a new Drupal 11 custom module. Then it points the Upgrade page at the old database to migrate the pages, and keeps the old site under extended support until the new one launches.

Common mistakes

• Treating a PHP upgrade as a fix. Updating the server does not bring Drupal 7 back under project support.
• Hoping the date moves again. It has passed, and Drupal.org names no later date for project support.
• Ignoring the contributed modules. Each one needs a Drupal 11 release or a replacement; the old code will not move over.

For marketing and content teams

Ask your developer or host which Drupal version your site runs. If the answer is 7, the site is past end of life. Put the migration into the budget, and use the move to clean out old pages instead of carrying everything across.

Sources

• Drupal.org: Drupal 7 end of life
• Drupal.org: Extended Security Support Provider Program partners
• Drupal.org PSA-2023-06-07: Drupal 7 end of life extended to 5 January 2025
• Drupal.org: Deprecated and obsolete extensions (Migrate Drupal)
• Drupal.org: Drupal 11.4.0 release notes
• Drupal core 11.4.10 source: migrate_drupal_ui module (git.drupalcode.org)