What to do after Drupal 7 is still a live question in 2026. Official Drupal 7 support ended on January 5, 2025, but many sites continue to run on that version. The decision is no longer a simple CMS update. It is often a choice of platform, content model, and how you will maintain the site for the years ahead.

In this article:

• What does Drupal 7 end of life really mean?
• Why is a Drupal 7 to Drupal 11 migration not a normal update?
• Which requirements appeared after many Drupal 7 sites were built?
• When is Drupal 11 or Drupal CMS the strongest choice?
• When is a technical 1:1 migration enough?
• When should you consider another CMS?
• Can Astro or a static site generator replace a CMS?
• Can you stay on Drupal 7 a little longer?
• What should you prepare before a migration or new-site quote?
• How should you present options to the board?
• What is the best decision after Drupal 7?

Drupal 7 reached official end of life on January 5, 2025. That means the version is no longer developed in the standard way and no longer receives official security updates under the same model as supported Drupal releases.

In practice, the problem is bigger than a calendar date. The site may still load, editors may still publish news, forms may still send messages, and visitors may see no difference. The risk sits underneath: old PHP, unsupported modules, outdated hosting, missing security updates, and a rising cost of finding people who still know Drupal 7 well.

So the question is no longer only “do we have to do something?” A more useful question is: “what do we want instead of the current site for the next 5-10 years?”

In many organizations - especially in the public sector, education, municipal utilities, local banks, and companies with a long-running website - Drupal 7 is still part of daily work. This is not a historical topic. It is a real decision that often returns only when a security audit, WCAG requirements, a hosting issue, or a new website project lands on the table.

Read also: how to prepare for Drupal 7 end of life

With Drupal 7, the word “migration” is often misleading. In many systems, an update means raising the version, fixing a few modules, and deploying. Moving from Drupal 7 to Drupal 11 is different.

Drupal 7 and Drupal 11 differ in architecture, module building, theming, hosting requirements, and developer tooling. A Drupal 7 theme usually needs a rebuild. Custom modules need to be rewritten, replaced, or removed. Some features that once required contrib modules are now in core or in a mature new-module ecosystem. Some old modules no longer have a sensible upgrade path.

The simplest analogy: moving from Drupal 7 to Drupal 11 is more like relocating to a new building than renovating one room.

That is not bad news. It means you can treat the project not as “patching the old site,” but as building a new site on a supported engine, while migrating the content, URLs, files, and features that still have value.

In client conversations, it helps to separate a few terms:

• Update: raising the version within a similar architecture.
• Migration: moving data, content, and some configuration into a new system.
• Redesign: changing look and user experience.
• Rebuild: rebuilding the site or application on a new architecture.
• Replatforming: changing platforms, for example from Drupal to WordPress, a headless CMS, or a static setup.

After Drupal 7, a project often includes several of these at once.

Read also: Drupal 7 vs Drupal 11 - how the system and its features have changed

Many Drupal 7 sites were built 10-15 years ago. Website expectations were often simpler then: present information, a few forms, a news list, downloadable files, and an editorial panel. Today the same type of site has to meet far more requirements.

The most common new requirements are:

• Digital accessibility and WCAG - especially important for the public sector, universities, institutions, municipal companies, and organizations serving a broad audience.
• Cookie consent and privacy - cookie banners, analytics and marketing consent, GDPR and ePrivacy alignment.
• Mobile-first and responsive design - the site must work well on phones, not only “scale somehow.”
• Core Web Vitals and performance - load speed, layout stability, image optimization, cache, and CDN affect SEO and user experience.
• CMS admin security - stronger passwords, 2FA, restricted admin access, captcha, and brute-force protection.
• Current SEO needs - 301 redirects, schema.org, metadata, heading structure, indexability, canonicals, and Search Console monitoring.
• Analytics and conversions - GA4, GTM, form and campaign measurement, events, and CRM integration.
• Better editorial UX - media library, components, publishing workflow, versioning, moderation, and simpler day-to-day work for editors.
• Safer forms - validation, anti-spam, consent capture, notifications, and safe storage of submissions.
• DevOps process - staging, backups, deployment, monitoring, SSL, logs, and a recovery plan.
• Integrations - CRM, newsletter, maps, payments, internal systems, APIs, search, trusted profile tools, or other industry systems.
• Operational content - urgent notices, outage bars, service status, alerts for residents or customers.

All of this means a new website in 2026 is often more complex than a site built in the Drupal 7 era. At the same time, we have tools that did not exist then.

AI and LLMs can speed up content analysis, first drafts of information architecture, migration field mapping, documentation, QA, regression checks, and prototypes. They do not remove team responsibility, but they shorten parts of the analytical and development work.

In the Drupal ecosystem there is also Drupal CMS - a ready starter for new projects. In the Drupal 7 days you often started from a bare install and assembled modules by hand. Today you can start with a more complete feature set, which gives more options when building a new site and can shorten the path from decision to a working prototype.

The takeaway is simple: if your current D7 site is 10+ years old, migrating without reviewing new requirements may only move an old problem into a new technology.

Drupal 11 or Drupal CMS makes the most sense when the site is more than a simple brochure. If the organization needs content structure, permissions, forms, multiple roles, security, editorial workflow, multilingual support, integrations, and long-term growth, Drupal remains a strong choice.

That matters especially for organizations that do not want another replatforming soon. A well-designed Drupal backend can serve for 5-10 years. The frontend and visual layer can be refreshed more often - for example every 2-5 years - to match new UX trends, campaigns, mobile needs, and accessibility. Not every visual change has to mean replacing the whole CMS.

Drupal fits especially well when you need:

• complex content types and fields,
• multiple editorial roles,
• publishing workflow,
• integrations with other systems,
• multilingual support,
• a stable API,
• a strong permissions model,
• high security requirements,
• a long platform lifecycle,
• room to grow the site into an application or portal.

It is no accident that Drupal is used by banks, governments, universities, public institutions, and large organizations. Not because it is the simplest CMS for every site, but because it is a solid engine for systems that must stay stable, secure, and adaptable.

For organizations similar to municipal utilities, a sensible path often looks like this: a new site on Drupal 11 or Drupal CMS, with migration of valuable content, preservation of important URLs, WCAG improvements, cleaner forms, cookie consent, and operational features such as an outage bar.

Not every organization needs a full redesign. Sometimes the goal is mainly to move the site safely from Drupal 7 to a supported version with minimal visual change.

That option makes sense when:

• the budget is limited,
• the current look is acceptable,
• the site has specific features that must stay,
• the team mainly wants to remove EOL risk,
• the project needs to be fast and as predictable as possible,
• there is no need to design a new UX.

In practice, even this path is not “clicking an update.” You still need to agree which features migrate, which content stays, which modules get replaced, and which pieces are not worth recreating.

A technical 1:1 migration can be a good bridge when an organization wants to reduce risk but is not ready for a full new-site project. Be clear that UX, content, and design issues then stay for later.

Drupal does not have to be the best answer for every site after Drupal 7. Sometimes the current site was built on Drupal because it was a good choice then, but today’s needs are much simpler.

If the site has a few content types, rare updates, a simple editorial panel, no complex roles, and few integrations, it is worth comparing Drupal with other systems.

Example options:

• WordPress - large ecosystem, simple admin, many vendors, a good fit for simpler marketing and content sites.
• Craft CMS - a content-focused CMS with a strong content model.
• TYPO3 - strong in DACH, enterprise, and parts of the public sector.
• Joomla - a classic full-stack CMS for simpler sites and teams with existing know-how.
• Wagtail - a Python/Django CMS that can fit teams with Python skills.
• Umbraco - an option for organizations in the .NET and Microsoft ecosystem.
• Strapi, Directus, Payload - headless/API-first options when the frontend is a separate application.
• Ghost - a system for publishing, newsletters, and simpler content sites.

It also helps to use a comparison such as CMS Battle, which compares 15 CMS platforms, 110 features, and 24 categories. That kind of material moves the conversation from “which CMS do we like?” to “which CMS best matches our requirements?”

Changing CMS does not remove migration work. You still need to move content, files, media, forms, URLs, metadata, analytics, and editorial logic. If the old site has Google history, 301 redirects and SEO continuity are mandatory regardless of technology.

A static or hybrid site - for example on Astro, Next.js, Hugo, or Eleventy - is increasingly discussed as an alternative to a classic CMS. That approach can speed up delivery and simplify maintenance.

The benefits are concrete: strong performance, a smaller attack surface, simpler hosting, less backend, cheaper scaling, and good Core Web Vitals. For sites that are mainly informational and rarely updated, this can be a very sensible direction.

There is a real trade-off. Creating content in this model is often less convenient than in a classic CMS. An editor may work with Markdown or MDX files, pull requests, GitHub, GitLab, or with help from a technical person. For a development team that can feel fast and clean. For an editorial team that has worked in a CMS panel for years, it can be a barrier.

You can soften that with a headless CMS or an editorial layer such as Tina, Decap, Sanity, or Contentful. Editors get a more convenient interface, while the frontend stays fast and modern. But then some of the complexity that the static site was meant to remove comes back.

So Astro and similar tools are worth considering, but not as the default answer to every Drupal 7 problem. First check who will update content, how often, what the approval process looks like, and whether the organization accepts a Git-based content workflow.

Sometimes the organization does not have the budget, board decision, or time for an immediate migration. Then you can prepare a staged plan. Do not confuse that with a target strategy.

A minimum plan should include:

• a current copy of files and database,
• a tested restore from backup,
• a security review,
• restricted access to the admin panel,
• a check of PHP version and hosting,
• a list of critical modules and forms,
• availability monitoring,
• an incident plan,
• a deadline for the migration or replatforming decision.

You can also consider extended support for Drupal 7 if the organization needs time. One example is D7Security, an unofficial initiative independent of Drupal.org that provides extended support for selected Drupal 7 modules and themes and publishes new releases for projects that can no longer return to support on Drupal.org.

That can be a practical security bridge for organizations that are not ready to migrate immediately. It should not be treated as the destination strategy. D7Security, paid legacy support, or other LTS-style options buy time - they do not answer which platform should run the site for the next years.

The worst option is leaving Drupal 7 with no plan, no backup, no owner, and no decision date. Then risk grows quietly.

Without basic data, every quote is guesswork. Before talking to a vendor, prepare a short information pack.

The most important items are:

• the current site URL,
• confirmation that it is Drupal 7,
• a copy of files and database,
• a list of key content types,
• a list of forms,
• a list of integrations,
• language information,
• number of editors and roles,
• WCAG, privacy, and cookie requirements,
• content to keep,
• content to remove,
• the most important organic URLs,
• visual examples you like,
• an indicative budget,
• the expected launch window.

For older sites, a short audit is a very good first step. It does not need to be a huge document. Often a concise analysis is enough: what you have, what is worth moving, what can go, where the risks are, and which options are realistic.

Read also: the biggest challenges when migrating Drupal 7 to Drupal 10 or 11

The board usually does not need a full module list. It needs a decision, risk, cost, timeline, and consequences. Instead of one answer - “migration costs X” - show a few options.

A table like this helps separate the technology conversation from the goal conversation. The goal is not “have Drupal 11.” The goal is a secure, usable, accessible, and maintainable website that matches the organization’s real needs.

If a rebuild is already on the table, it also helps to run the decision through a modernization lens first - see our framework: Don’t rebuild, evolve.

There is no single answer for everyone. Each organization should decide based on its own requirements: site scale, number of editors, WCAG needs, budget, security, SEO, integrations, publishing frequency, and growth plans.

For a simple marketing site, WordPress, Astro, or another lighter system may be a good fit. For a publishing site, Ghost may be enough. For a .NET team, Umbraco may make sense. For API-first work, Strapi, Directus, or Payload may fit.

If the organization needs a stable backend, advanced content modeling, permissions, forms, workflow, multilingual support, integrations, and security, Drupal 11 or Drupal CMS is a strong direction. It gives a chance to build a platform you will not need to replace again soon.

That matters especially after the Drupal 7 experience. If you build a new site on a stable backend today, you can refresh the frontend, design, components, and campaigns for years without replacing the whole engine. The backend can stay; the visual layer can mature with the organization.

That is why Drupal is chosen by banks, governments, universities, and large institutions. Not because it is the simplest choice for every small site, but because it is solid, secure, adaptable, and proven where stability matters.

If your site still runs on Drupal 7, do not start with “how much does migration cost?” Start with a short analysis: what is worth keeping, what to remove, what to rebuild, and which system fits the next years best.

We can help prepare that analysis and compare real options: a technical migration, a new site on Drupal 11 or Drupal CMS, a CMS change, an Astro/static approach, or a phased plan. Visit our Drupal migration services to see how we can help you choose a safe path for your Drupal 7 site.