Drupal 7 End of Life: Support Ended January 5, 2025 — What Stopped, What Still Runs, and the Two Ways Forward

By Scott Bissett  ·  Published: August 19, 2026  ·  Reference — Drupal 7 and every supported Drupal release  ·  Dates verified against drupal.org and the Drupal release schedule — methodology

Drupal 7 reached end of life on January 5, 2025. That was the final date after several extensions, exactly fourteen years after Drupal 7's release, and it was final: the Drupal Security Team no longer covers Drupal 7 core or its contributed modules, and drupal.org no longer publishes fixes for either. A Drupal 7 site in 2026 is running an unpatched, internet-facing content management system unless it is paying a certified vendor for extended security coverage.

The reason so many are still running is structural, not negligent: Drupal 7 to Drupal 10 or 11 is not an upgrade but a migration to a different architecture, and the sites that stayed on 7 the longest are usually the ones with the most custom modules. This page is the reference for what actually ended, what the supported Drupal releases and their dates are, how to identify what you run, and the two realistic exits — migrate, or bridge with extended support while you migrate. Per-version detail lives on the Drupal product page.

Key Dates at a Glance

• Drupal 7: released 2011-01-05; end of life 2025-01-05
• Drupal 8.9: end of life 2021-11-02
• Drupal 9.5: end of life 2023-11-01
• Drupal 10.5: end of life 2026-06-17
• Drupal 11.2: end of life 2026-06-17
• Drupal 10.6: active support ended 2026-06-16; end of life 2026-12-16
• Drupal 11.3: active support ended 2026-06-16; end of life 2026-12-16
• Drupal 11.4: released 2026-07-01; active support ends 2027-01-01; end of life 2027-07-07

Drupal EOL Risk Scores

An end-of-life date on its own does not tell you how urgent a version is. We publish an EOL Risk Score (0–100) for every tracked version, combining how long past — or how close to — end of life it is, the attack surface of the software class, whether CISA lists the product in its Known Exploited Vulnerabilities catalog, and whether commercial extended support exists. Drupal is a public-facing CMS with entries in the KEV catalog (the “Drupalgeddon” remote-code-execution flaws are the canonical example), and extended support for 7 exists, which is why 7 plateaus in the high band rather than critical.

Scores update automatically at every site build; every release is on the Drupal product page and the methodology on the EOL Risk Score page.

What Actually Ended on January 5, 2025

• Security Team coverage. The Drupal Security Team no longer reviews, coordinates or publishes advisories for Drupal 7 core or Drupal 7 contributed modules. New vulnerabilities are not fixed on drupal.org, and there is no longer a security advisory to tell you one exists.
• Compatibility updates. No further releases for new PHP versions, database versions or dependencies. Drupal 7's final release was 7.103.
• Contributed modules. Modules' 7.x branches are unsupported regardless of what an individual maintainer does; the ecosystem's attention has been on 10 and 11 for years.
• Compliance standing. drupal.org itself notes that running unsupported Drupal 7 may put a site outside FedRAMP, PCI DSS, HIPAA and SOC 2 expectations; auditors treat an end-of-life CMS as a control failure.

What did not end: the site keeps running. That is the problem — nothing breaks on the date, so nothing forces the decision.

Drupal Release and Support Schedule

Modern Drupal (10 and 11) ships two minor releases a year, in June and December; each minor gets roughly six months of active support (bug and security fixes) and then six months of security fixes only, so two minors are supported at any time. Drupal 10 and Drupal 11 run in parallel and are supported together.

Note the two clocks: Drupal 8 and 9 each died within about a year of their successor because they were built on the same modern core and upgrading was routine. Drupal 7 got fourteen years precisely because it was not.

Why Sites Are Still on Drupal 7

Drupal 8 (2015) rebuilt Drupal on Symfony components, object-oriented PHP and a new theme layer. Every Drupal 7 site's custom modules and themes had to be rewritten, and every contributed module needed a modern equivalent. Sites with a large custom code base, or that depended on modules that never got a modern port, deferred — and each year the gap between 7 and current Drupal grew. The result is a long tail of government, education and enterprise sites for which the migration is a budgeted project rather than an update, and for which end of life arrived before the budget did.

How to Check Your Drupal Version

• /admin/reports/status in the admin UI — the core version is the first row.
• drush status (Drush 9+) or drush core-status (older Drush) from the command line.
• In code, VERSION in includes/bootstrap.inc (Drupal 7) or \Drupal::VERSION (8+).

Anything reporting 7.x is end of life. Across a portfolio, the EOL Checker maps a version to its status and dates; the Stack Scanner flags Drupal alongside the PHP and database versions underneath it, which have their own clocks.

Your Two Ways Forward

1. Migrate to Drupal 10 or 11. The destination. Build the new site, bring content and configuration across with the Migrate API, rebuild the theme, replace or rewrite each module. Drupal 11.4 is the current line; Drupal 10.6 is a fine target if a critical module lags 11. Budget by module count, not page count.
2. Bridge with certified extended support while you migrate. The Drupal Association's Extended Security Support Provider Program certifies commercial vendors to ship security patches for Drupal 7 core and widely used contributed modules past January 5, 2025, priced per site per year. It keeps the site defensible and audit-clean during the migration; it is not a reason to skip the migration. See extended support options.

Backdrop CMS — a community fork that keeps a Drupal-7-like architecture — is a third path for small sites that cannot justify a rebuild; it is a different project with its own release cadence and security team, not Drupal. Whichever path, the order is the same: inventory modules, harden the current site (WAF, admin IP restrictions, no new modules), and set the date.

Frequently Asked Questions

Related Resources

• Drupal product page — live status, dates and risk scores for every release
• PHP end of life — the runtime under every Drupal site
• Symfony end of life — the framework modern Drupal is built on
• EOL Watch · EOL Checker · EOL Risk Score methodology