Drupal 7's Long Goodbye: Run the Migration Math Now

The Drupal project announced in late February that Drupal 7’s end-of-life moves to November 2023, the second pandemic-era extension. The announcement’s own framing was admirably direct about why. The installed base still running 7 is enormous: hundreds of thousands of sites. They concentrate exactly where we work. Higher education, government, healthcare, enterprise. Cutting them loose on the prior schedule would have created a security event of the kind the Drupalgeddon era taught everyone to price.

our reading, delivered in the vocabulary the situation deserves: the extension is mercy, not reprieve. The deadline moved. The decision did not. The decision triangle has not changed since we drew it two years ago, and the extra runway gets consumed by whichever option you defer, because all three options are measured in institutional quarters and the calendar is now measured in eighteen months.

This post is the planning-meeting version. The triangle’s three corners with honest numbers, the reopened question that rebuilds always reopen, and the calendar candor that is our recurring service to organizations whose procurement cycles are longer than their runways.

The triangle, with honest numbers

Corner one: migrate to modern Drupal, 9 now, 10 arriving. The destination is excellent. The steady-updating model we celebrated in 2020, the boring-majors era, a platform we recommend confidently at the tiers that fit it. The path is the thing to price honestly, per the warning we have maintained since 2015. 7-to-modern is a rebuild, not an upgrade. The content models reconceived. The theme rebuilt entirely, since nothing transfers. The custom modules re-implemented against a different API world. The integrations re-plumbed. Budget and staff it as the re-platforming it is, with the migration tooling easing the content transfer and nothing else.

Corner two: replatform elsewhere. This corner exists because of corner one’s honest pricing. If rebuilding anyway, the platform evaluation reopens, fairly. WordPress at its current maturity, with the governance mechanisms our FSE coverage documents. The headless tier, where the field-guide gate passes. The SaaS platforms, where requirements fit. All deserve their hearing against modern Drupal on the standing criteria: requirements, team shape, ecosystem fit, total cost over the decade. Many 7 sites will re-choose Drupal on the merits. The point is choosing rather than defaulting, because the rebuild cost is being paid either way.

Corner three: extended-support insurance. The commercial vendors offering post-EOL security coverage. A legitimate bridge with bridge economics. It buys time, real, priced, renewable. It does not buy a destination. The site remains a 2011-era architecture drifting further from the modern ecosystem. The correct use is explicitly transitional: purchased with a decision and a project plan attached, not as the annually renewed avoidance tool the vendors will happily sell it as.

The calendar candor

• Count backward, honestly: November 2023, minus launch stabilization. Minus the migration build, two to four quarters for real institutional sites, per our project history. Minus discovery and content strategy, a quarter, and worth it. Minus procurement, an institutional quarter or two, RFP to signature. Minus the internal decision process that precedes procurement. Run the subtraction and the finding writes itself. A site starting the decision process this spring finishes near or after the deadline. A site starting next year finishes well after it, carrying the exposure between.

• The exposure has a documented shape: the Drupalgeddon record is the case law. Post-EOL, advisories stop, the unpatched tier becomes the harvest, and the institutions carrying it are betting their reputations on obscurity. We have watched that bet lose repeatedly and never watched it win.

• The sequencing that works: decision this quarter, the triangle run against your requirements, with the platform evaluation given its honest hearing. Procurement through the fall. Build through 2023. Extended support purchased now if the math says you will cross the deadline mid-project. A bridge under a moving project, not a roof over a parked one.

The cost of deferral

The 7 cohort’s situation illuminates something we keep teaching. The sites in the hardest position this year are not there because of any decision made this year. They are there because of a decade of accumulated deferrals, in which each year’s ‘not this budget cycle’ was locally reasonable and the compound was not.

The 8-era rebuild cost was real. We said so in 2015, loudly. The deferral was understandable, and the math never stopped running. The rebuild is not cheaper now. The runway is shorter. The 2011-era architecture is a decade older. The organizations that crossed early, the 2016-2019 migration cohort, have spent the intervening years on the steady-updating escalator collecting boring afternoons, while the deferring cohort accumulated exposure.

The transferable lesson, for every platform we cover: end-of-life dates are the only deadlines in this industry that never actually move in your favor. Extensions acknowledge reality. They do not change it. The correct time to run migration math is when the date first publishes, not when it first threatens. The 7 sites reading this have eighteen months and this post. The sites on every other platform have their own dates, published, and the same subtraction available today, at slack prices.

The compressed version for the meeting that decides

Three corners: rebuild to modern Drupal, rebuild elsewhere, insure and decide. One honest constant: the rebuild is being purchased in two of three corners, so evaluate like it. One unforgiving subtraction: November 2023 minus your institution’s actual speed. And one firm recommendation: start the decision now, while the calendar still contains choices rather than consequences.

We run these evaluations weekly this year, and the finding across them is consistent. The organizations that run the math this spring end up with plans they chose. The ones that run it next spring end up with the plan the calendar left them.

Planning beats deadlines. Ask us how we know, and read our 2014 coverage if the security half of the argument needs its refresher. The long goodbye has a date now. Say it early, on purpose, with a destination booked, and let November 2023 arrive the way every well-planned deadline arrives: as the day the old site was already empty.