Quick answer: Drupal 7 reached end of life on 5 January 2025 and no longer receives official security updates. Australian organisations still running it should plan a migration to Drupal 11. This is a rebuild rather than a simple upgrade, because Drupal 7 can’t be upgraded in place. If you can’t migrate straight away, paid extended security support from a certified vendor can bridge the gap, but it is a temporary measure, not a long-term plan.
If your organisation’s website is still running on Drupal 7, you’re not alone. Drupal 7 was released in 2011 and powered thousands of websites, including many in Australian government, universities, not-for-profits and businesses. Many of those sites have kept running reliably for well over a decade.
But reliability and safety are different things. Since January 2025, Drupal 7 has been unsupported by the Drupal community, which means new security problems are no longer officially patched. This guide explains what that means, what your options are, and how a migration to Drupal 11 works.
What Drupal 7 end of life actually means
When the Drupal Association and Security Team ended support for Drupal 7, it meant:
- No official security updates. If a vulnerability is found in Drupal 7 core, the community Security Team no longer publishes a fix.
- No compatibility updates. Drupal 7 won’t be updated to keep pace with newer PHP versions and other technology it depends on.
- Reduced module support. Contributed modules that Drupal 7 sites rely on are no longer maintained in
- • Growing hosting friction. Hosts are retiring older PHP versions that Drupal 7 depends on, which can leave an old site stuck on an insecure server or unable to run at all.
The site itself doesn’t stop working on 5 January. The risk builds quietly over time. An unpatched, public-facing website becomes a more attractive target the longer it stays unsupported.
Why Australian organisations need to act
For many organisations, the pressure to move doesn’t come only from the technology. It also comes from the people and processes around it.
- Privacy and data protection. If your site collects personal information through forms, accounts or donations, an unsupported system makes it harder to show you’ve taken reasonable steps to protect that data. Organisations covered by the Privacy Act, and those handling sensitive data, should take this seriously.
- Government and education expectations. Departments, universities and funded organisations commonly expect software to be supported and patched, and unsupported platforms can raise flags in security reviews and tenders.
- Cyber insurance and procurement. Insurers and corporate customers increasingly ask whether your systems run supported software.
- Brand and trust. A hacked or defaced website, or one that goes offline, damages credibility fast.
This isn’t a reason to panic, but it is a reason to stop treating the migration as something for later.
Why this is a migration, not an upgrade
A common misunderstanding is that Drupal 7 can be “updated” to Drupal 11. It can’t. Drupal changed fundamentally after version 7. Drupal 8 introduced a new architecture built on modern PHP and Symfony components, and every version since has built on that foundation.
In practice, moving from Drupal 7 to Drupal 11 means:
- Building a new Drupal 11 site with a clean structure
- Migrating your content, users and files across using Drupal’s migration tools
- Rebuilding your theme using the modern Twig templating system
- Replacing or rebuilding modules. Many Drupal 7 modules now have Drupal 11 equivalents, some are built into core, and some need to be rebuilt as custom code
The upside is that you get a modern, supported platform, a much better editing experience and easier maintenance from then on. If you want to see where Drupal is heading, read our guide to Drupal CMS 2.0 and Canvas for Australian businesses.
Your three realistic options
1. Migrate to Drupal 11 (recommended)
This is the long-term fix. You end up on a supported platform with ongoing security updates, modern features and a site that is far easier to maintain and extend.
2. Stay on Drupal 7 with extended security support (temporary)
The Drupal Association runs a program where certified vendors sell extended security support for Drupal 7. This can keep your site patched while you plan and carry out a migration. It’s useful if your budget, approvals or project timelines mean you can’t move immediately. But it adds an ongoing cost and doesn’t solve the underlying problem, so treat it as a bridge, not a destination.
3. Move to a different platform
Some organisations decide a migration is the right moment to leave Drupal altogether. This can make sense if your needs have become very simple, or if you no longer have the technical support to run a CMS like Drupal. But if you rely on Drupal’s strengths, such as complex content structures, multilingual publishing, granular permissions or integrations, you’ll usually get a better result by moving to modern Drupal than by rebuilding on a different platform.
| Option | Security | Cost | Effort | Best for |
|---|---|---|---|---|
| Migrate to Drupal 11 | Fully supported | Higher upfront, lower long-term | Significant project | Most organisations |
| Drupal 7 with extended support | Vendor-supported only | Ongoing fees | Low now, migration still needed | Short-term bridge |
| Different platform | Depends on platform | Varies | Full rebuild | Very simple sites |
What the migration process looks like
Every site is different, but a well-run Drupal 7 to Drupal 11 migration usually follows these stages.
1. Site audit. List your content types, fields, modules, custom code, users, integrations and traffic. This shows what’s actually in use and what can be dropped.
2. Content and architecture review. Decide what to keep, merge, rewrite or retire. Old sites often carry years of outdated pages that don’t need to move.
3. Migration planning. Map Drupal 7 content structures to Drupal 11, and decide how users, files and taxonomy will transfer.
4. Build and theme. Create the Drupal 11 site, rebuild the design in a modern theme, and replace or rebuild modules.
5. Content migration and testing. Run the migration, check content accuracy, and test forms, search, permissions and integrations.
6. SEO, redirects and accessibility checks. Map old URLs to new ones, preserve metadata and test for accessibility.
7. Launch and support. Go live with a rollback plan, then monitor, fix issues and keep the site updated.
Our Drupal Migration & Upgrades service follows this approach, adapted to the size and complexity of each site.
What affects cost and timeline
No two migrations cost the same, because sites vary so much. The main factors are:
- Volume and complexity of content. More content types, fields and relationships mean more migration work.
- Custom modules and integrations. Custom functionality, and connections to CRMs, payment systems or internal tools, often take the most effort.
- Design approach. A like-for-like rebuild is quicker than a full redesign.
- Multilingual or multisite setups. These add planning and testing.
- Content clean-up. Reviewing and trimming content takes time but usually saves money and improves the result.
- Approvals and internal processes. In larger organisations, review cycles can matter as much as development time.
The best way to get a reliable estimate is a short audit of your existing site, which shows what needs to move and what doesn’t.
Common migration mistakes
- Migrating everything without a content clean-up. You carry over years of clutter and pay to do it.
- Leaving SEO and redirects until the end. This is how organisations lose search traffic after launch.
- Underestimating custom module work. Features that “just worked” on Drupal 7 may need to be rebuilt.
- Treating extended support as permanent. It delays the problem and adds cost.
- Skipping a staging and testing plan. Surprises are far cheaper to find before launch than after.
- Not planning for ongoing maintenance. A migrated site still needs regular updates. See our Drupal Maintenance & Support service.
Which Drupal 11 version to target
Drupal 11 is the current major version, and it receives minor releases with their own support windows. Because older Drupal 10 releases are also approaching end of life, there’s little reason to migrate to anything other than Drupal 11. Check the current release and support dates on drupal.org when you start planning, and read our post on Drupal 10 end of life if you have a mix of Drupal 7 and Drupal 10 sites.
How to get started
If you’re not sure where to begin, a simple first step is to answer these questions:
- How many pages, content types and users does the site have?
- Which modules and custom features does it rely on?
- Which integrations connect to it?
- Which pages actually receive traffic?
- Does anything on the site need to be available in more than one language?
With those answers you can scope the project properly, decide whether you need an extended support bridge, and set a realistic timeline.
Frequently asked questions
Is Drupal 7 still safe to use?
Not without extra protection. Drupal 7 no longer receives official security updates, so any new vulnerabilities go unpatched unless you pay for extended support from a certified vendor. Even then, it should be a temporary arrangement.
Can I upgrade Drupal 7 directly to Drupal 11?
Not in place. You build a new Drupal 11 site and migrate your content, users and files into it. Themes and many modules need to be rebuilt or replaced.
How long does a Drupal 7 migration take?
It depends on the size and complexity of your site. A small brochure site can be migrated relatively quickly, while large sites with custom modules, integrations or multiple languages take considerably longer. A site audit gives you a realistic estimate.
What happens to my SEO when I migrate?
If the migration is planned properly, you can keep your search performance. That means mapping old URLs to new ones with redirects, keeping page titles and metadata, and checking the site after launch. Problems usually come from skipping these steps.
Do I need extended support while I migrate?
Only if your migration will take a while to start or finish and you want your site to stay protected in the meantime. If you can migrate soon, you may not need it.
Final thoughts
Drupal 7 had a good run, but it has reached the end of the road. The longer a Drupal 7 site stays online unsupported, the more risk and cost builds up. The good news is that migrating to Drupal 11 gives you a cleaner, faster, easier-to-manage site that is supported for years to come.
If you’re not sure where to start, Drupal Professionals offers a free Drupal 7 migration assessment for Australian organisations. Get in touch and we’ll review your site, outline your options and give you a clear plan.