Your Drupal countdown is already at zero. A year have passed since the community pulled the plug on Drupal 7, and Drupal 9 has been dark even longer. If your org is still on either version, you’re running unsupported software. Here’s what that risk really means and the three practical routes teams can take before the next audit hits.
January 5 Came and Went — Now What?
Drupal 7 officially left the safety net on January 5, 2025. Drupal 9 has been unsupported since November 1, 2023. Together, they still power more than 200,000 live sites, all now labeled “unsupported” in compliance scans.
Running legacy code isn’t an immediate catastrophe, but it is an open invitation for automated exploits, higher cyber-insurance premiums, and “critical” findings in PCI or HIPAA audits. The fix isn’t mysterious; you need to upgrade, migrate, or buy long-term support (LTS). This post walks through each option, matches it to real-world constraints, and gives you a punch-list you can act on this quarter.
How Drupal’s Release Cycle Shifted
Drupal has moved to a two-year major release cycle. Drupal 12 is planned for mid-to-late 2026, and each version receives security support until two versions later (about four years total).
Planning an upgrade now? Don’t wait for Drupal 12 if you’re on an unsupported version. Drupal 10 or 11 will get you on the modern stack, and Drupal 12 will be a smoother upgrade (not a full rebuild).
Predictable for new builds, painful for anyone still two versions behind.
Why “End-of-Life” Is More Than a Label
A short refresher before we dig into options:
Before EOL, Drupal core receives monthly security releases, module authors keep their projects in sync, and the community forum answers edge-case questions. After EOL, those benefits vanish, leaving you with:
- Zero official patches: Any vulnerability that surfaces stays exposed.
- Stalled modules: Dependencies drift out of sync and may fail on PHP upgrades.
- Audit headaches: Most risk frameworks flag unsupported software as non-compliant.
If your site handles payments, patient data, or even a modest marketing database, that risk turns into higher insurance deductibles or failed audits. Acting now is cheaper than explaining a breach later.
What Staying on Drupal 7 Really Costs
Valuebound’s 2025 cost study shows midsize orgs are spending $20,000 to $50,000 a year on third-party security coverage alone. Add a 30% productivity hit for developers maintaining legacy code, and the meter keeps running. Delay the move by just one quarter, and migration specialists say you tack on 1% to 2% to the final project cost.
Three Paths Forward — All Viable, One Will Fit
When Drupal hits end-of-life, organizations usually pick one of three routes. Here’s how each path stacks up.
1. Upgrade Inside Drupal
Staying on Drupal means moving to a newer, supported version (currently, either Drupal 11 or 10).
2. Migrate to WordPress
WordPress powers 43% of the public web; its block editor may be all you need.
3. Buy Commercial Long-Term Support (LTS)
Yes, you can keep Drupal 7 or 9 patched — for a price.
Quick-Decision Filters
Need a gut-check? Answer these six questions:
Budget Benchmarks (Late 2025)
These ranges are based on agency quotes and mid-market project averages. Real costs will vary based on complexity, integrations, accessibility needs, and internal team involvement.
(Assumes a responsive, WCAG-compliant site with 100 core pages and standard integrations)
- Drupal 7 → Drupal 10/11 rebuild: $85,000 to $140,000
- Drupal 9 → 11 upgrade: $20,000 to $45,000
- WordPress migration: $55,000 to $90,000
- Commercial LTS (Drupal 7 or 9): $6,000 to $12,000 per year + patch labor
Note: For Drupal 7 projects, add 1%–2% cost per quarter of delay, per migration specialists surveyed. WordPress savings can be eroded if the original Drupal site used heavy custom modules or workflows.
Real numbers vary, but these brackets match what agencies and in-house teams are quoting this year.
Six-Step Plan You Can Start This Week
Every path — upgrade, migrate, or LTS — benefits from early prep. Use this six-step roadmap to stay on schedule:
- Inventory everything: List modules, themes, custom code, and integrations.
- Choose your path: Select upgrade, migrate, or LTS based on the filters above.
- Freeze new features: Stop adding functionality to legacy Drupal; it won’t port cleanly.
- Prototype one template: Prove theme, block, and API concepts before full dev.
- Migrate in waves: Use Drupal Migrate API or WP All-Import; editors spot-check.
- Cut over in low-traffic hours: Freeze content for at least 48 hours, flip DNS, monitor logs.
Follow the checklist and you avoid the “all-at-once” weekend panic.
Field Note: Big Fundraising Ideas — From Drupal 7 to Drupal 10
Big Fundraising Ideas, a Corpus Christi company that helps K-8 schools raise millions of dollars each year, rebuilt its aging Drupal 7 site on Drupal 10.3 (AWS hosting). Key wins included:
- 67% faster page-load speed: Core Web Vitals jumped from the 45th to the 75th percentile.
- 30% lift in conversion rate thanks to a one-step Drupal Commerce checkout and CRO-focused UI.
- 100% gain in content-management efficiency: non-technical staff now update pages without developer assistance.
- 50% faster product updates after back-end workflow automation.
The migration delivered these gains and positioned the site for future upgrades.
Final Takeaway: Doing Nothing Costs More
The longer you wait, the higher the quote, the tighter the timeline, and the greater the risk. Pick a lane, lock a budget, and start work this quarter.
Want real numbers for your site? Schedule a 30-minute call, and leave with a line-item roadmap you can show leadership.
FAQs
Can we skip Drupal 11 and wait for Drupal 12 in 2026?
Skipping versions doubles quality assurance time and breaks deprecated code. Incremental upgrades cost less and finish sooner.
Is Drupal 11 stable yet?
Drupal 11.2 alpha began in May 2025; 11.2.0 reached stable release in late June 2025, and most widely used modules already list Drupal 11 compatibility.
Will WordPress handle our SSO and roles?
Yes, with plugins like WP SSO / SAML and PublishPress Capabilities, but be sure to budget for configuration.
Does LTS add new features?
No. LTS providers deliver security patches only. Feature development must wait for your eventual migration
