If your organisation’s website still runs Drupal 7, this post is for you — and it’s written in plain English, not developer jargon.
What “end of life” means
Drupal 7 no longer receives official security support from the Drupal Security Team. When a vulnerability is found now, there is no guaranteed patch coming. Historically, serious Drupal vulnerabilities have been exploited on unpatched sites within hours of public disclosure.
Why waiting makes it worse
- Module maintainers move on. The contributed modules your site depends on stop receiving fixes, one by one.
- PHP versions expire underneath you. D7 sites often depend on old PHP versions that hosts are retiring.
- The migration gets harder. Fewer developers work in D7 each year, and knowledge of your site’s custom code fades.
What a migration actually involves
A Drupal 7 to Drupal 11 move is a rebuild, not an upgrade — content models are redesigned and custom modules rewritten or replaced with modern equivalents. That sounds daunting, but it’s also the opportunity: faster pages, a modern editing experience, and a platform with a supported future.
The sensible first step is a fixed-price discovery: a content and code audit that turns “how bad is it?” into a written report, a firm quote and an honest timeline — before you commit to anything.
Running D7 and want a straight answer about your options? Tell us about your site and a developer will reply with genuine first thoughts.