Drupal 7 loses its last commercial security support on January 5, 2026, when Tag1's extended coverage ends. Site owners then have three options: upgrade to Drupal 10/11, go headless with Next.js and a backend-as-a-service, or switch to another CMS. Migration costs for a mid-complexity site usually run $28k to $95k. The exact cost depends on technical debt and content complexity.

Key takeaways

  • Drupal 7's last commercial security support, from Tag1, ends January 5, 2026. After that, unpatched CVEs become open doors for attackers.
  • You have three real options: upgrade to Drupal 10/11, rebuild headless with Next.js + Supabase (or another headless CMS), or move to WordPress, Craft, or Astro.
  • Mid-complexity migrations typically cost $28k-$95k. Three-year total cost of ownership varies a lot by path and site size.
  • Headless setups usually cost less to host and maintain over time than an upgraded Drupal 10/11 site. But they need more upfront work on content modeling.
  • The right choice depends on your team's tool preferences, multilingual and permissions needs, and budget.

Updated 26 August 2026: sources added, experience claims checked against our project record, summary added.

Drupal 7 End of Life 2026: Migration Options, Costs & Decision Guide

The Drupal 7 EOL Timeline: What Actually Happens

These dates can be confusing. Here's the clear timeline:

After January 2026, you're on your own. Your site won't break overnight, but risks build up fast:

  1. No security updates for Drupal 7 vulnerabilities
  2. PHP compatibility problems as hosts drop support for older PHP versions
  3. Hosting barriers as providers stop supporting outdated PHP versions
  4. Compliance issues with standards that require current software, including GDPR
  5. Insurance hurdles, since insurers increasingly require patched, supported platforms for cyber cover

Understanding Your Current Drupal 7 Site

Before you pick a path, get a clear picture of your site's current state. Skip this step and your budget will likely balloon later.

Content Audit

Start with a content audit. Pull your content types with:

SELECT type, COUNT(*) as count 
FROM node 
GROUP BY type 
ORDER BY count DESC;

You'll want to know:

  • Entity references and how they interconnect
  • Media attachments and where they're stored
  • Taxonomy vocabularies and any hierarchies
  • Custom fields added by contrib modules

Module Inventory

List your enabled modules:

drush pm-list --status=enabled --type=module

Sort them by:

  • Core functionality
  • Custom creations, which may need the most rework
  • Integration pieces (payment gateways, CRM, SSO)
  • Forgotten modules you didn't remember existed

Custom modules are the real wild card. Without the original developer or documentation, migration can take far longer than planned.

Traffic and Performance Baseline

Get your analytics ready so you can compare against the new site later:

  • Monthly sessions and unique visitors
  • Core Web Vitals (LCP, INP, CLS)
  • Server response time (TTFB)
  • Cache hit ratios (particularly if Varnish or a CDN is involved)

Option 1: Upgrade to Drupal 10/11

Migrating from Drupal 7 to 10 is more like building a new house than renovating an old one. The architecture changed completely between D7 and D8, the foundation for D10/11. Here's what's involved:

What's Involved

  1. New Drupal 10/11 setup. You generally can't reuse D7 themes
  2. Content type recreation and field matching
  3. Content migration via Drupal's Migrate module or a custom ETL process
  4. Views reconstruction
  5. Custom module rebuilding for the Symfony-based architecture
  6. Contrib module substitutes research

When This Makes Sense

  • Your editorial team is embedded in the Drupal workflow
  • You rely on Drupal-specific features, such as granular permissions
  • Multilingual content is a core requirement
  • You're in a sector like government or education with Drupal-heavy tooling

When It Doesn't

  • Your content model is lean
  • Frontend performance improvements are the priority
  • Budget is tight (roughly under $40k)
  • You don't use most of Drupal's feature set

Drupal 7 End of Life 2026: Migration Options, Costs & Decision Guide - architecture

Option 2: Go Headless with Next.js + Supabase

For most mid-to-large sites, this is the path we recommend. The idea: a headless CMS serves content, a frontend framework renders it, and a backend-as-a-service handles server-side tasks.

The Stack

  • Headless CMS: Consider Sanity, Contentful, or Storyblok
  • Frontend: Next.js, with server-side rendering and static generation
  • Backend/Database: Supabase for authentication, databases, file storage, and logic
  • Hosting: Vercel or Netlify for the frontend, Supabase for the backend

Why Supabase?

Supabase bundles Postgres with REST and GraphQL APIs, authentication, file storage, and edge functions. That covers:

  • User registration and login without Drupal's user modules
  • Webform submissions stored directly in Postgres
  • File handling
  • Search (via Postgres full-text search, or Typesense if you need more)
  • Standard CRUD tasks

Supabase is budget-friendly: the free tier suits small sites, and the Pro plan starts at $25/month.

// Example: Migrating a D7 webform to Supabase
import { createClient } from '@supabase/supabase-js'

const supabase = createClient(
 process.env.NEXT_PUBLIC_SUPABASE_URL!,
 process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
)

export async function submitContactForm(formData: ContactFormData) {
 const { data, error } = await supabase
 .from('contact_submissions')
 .insert({
 name: formData.name,
 email: formData.email,
 message: formData.message,
 submitted_at: new Date().toISOString(),
 })
 .select()

 if (error) throw new Error(`Submission failed: ${error.message}`)
 return data
}

Content Migration Strategy

Here's a rough outline for content migration:

  1. Export content from D7 using custom Drush scripts or database queries
  2. Transform it to fit your new CMS setup. This is where most of the real work happens
  3. Import into your headless CMS via its API
  4. Validate everything. Check for broken references and missing media

A typical site with 5,000 nodes might need about 2-4 weeks dedicated to migration alone.

Option 3: Migrate to Another CMS Platform

Not every project needs a headless setup. WordPress, Craft CMS, or a static site generator like Astro are all solid alternatives.

Platform Comparison

Factor Drupal 10/11 Next.js + Headless CMS WordPress Craft CMS Astro (Static)
Content complexity Excellent Good (CMS-dependent) Moderate Excellent Simple
Editorial UX Steep Varies Easy Good Needs CMS
Performance Moderate Excellent Moderate Good Excellent
Developer pool Shrinking Growing Large Small Growing
Hosting cost/mo $50-$300 $0-$50 $10-$100 $20-$100 $0-$20
Maintenance High Low-Medium Medium Medium Low
Multilingual Excellent Good Plugin-dependent Good Varies
Migration complexity High High Medium Medium-High Low-Medium

Cost Comparison: Real Numbers for Real Projects

The figures below are planning-level estimates for typical project sizes, not a quote for your specific project. Actual costs depend on your content model, custom module count, and design goals.

Small Site

Cost Category Drupal 10 Upgrade Next.js + Headless WordPress Migration
Development £15k-£25k / $20k-$35k £12k-£20k / $15k-$28k £8k-£15k / $10k-$20k
Content migration £3k-£5k £3k-£5k £2k-£4k
Design/UX £5k-£10k £5k-£10k £3k-£8k
Hosting (annual) £600-£3,600 £0-£600 £120-£1,200
Maintenance (annual) £3k-£8k £1k-£3k £2k-£5k
3-year TCO £34k-£75k £23k-£44k £19k-£43k

Medium Site

Cost Category Drupal 10 Upgrade Next.js + Supabase WordPress Migration
Development £40k-£80k / $55k-$110k £35k-£65k / $45k-$90k £25k-£50k / $35k-$70k
Content migration £8k-£15k £8k-£15k £6k-£12k
Design/UX £10k-£20k £10k-£20k £8k-£15k
Hosting (annual) £1,200-£6,000 £300-£1,800 £600-£3,600
Maintenance (annual) £6k-£15k £3k-£8k £4k-£10k
3-year TCO £79k-£178k £63k-£129k £53k-£117k

Large/Enterprise Site

Cost Category Drupal 10 Upgrade Next.js + Headless CMS
Development £100k-£250k / $130k-$350k £80k-£200k / $100k-$275k
Content migration £20k-£50k £20k-£50k
Design/UX £20k-£40k £20k-£40k
CMS licensing (annual) £0 £3k-£30k
Hosting (annual) £3,600-£24,000 £1,200-£6,000
Maintenance (annual) £15k-£40k £8k-£25k
3-year TCO £196k-£532k £147k-£413k

CMS Licensing Note: Drupal is open source with no license fees. Some SaaS headless CMS platforms get expensive fast at scale. For a self-hosted option with no CMS licensing fees, consider Payload CMS.

Hosting and Infrastructure Considerations

It's easy to underestimate hosting costs when planning a migration.

Drupal 10 Hosting

Drupal needs a real hosting setup:

  • Pantheon, Platform.sh, and Acquia: managed Drupal hosts, with monthly plans that scale with traffic, environments, and support tier
  • VPS: a cheaper, do-it-yourself option, but you handle every update and security patch

Next.js + Supabase Hosting

  • Vercel: free tier for smaller projects, with the Pro plan billed per team member
  • Supabase: free tier to start, Pro plan from $25/month
  • Headless CMS: pricing varies widely by provider and usage

The combined total is often well below typical Drupal hosting costs.

SSL, CDN, Email -- Oh My!

Drupal setups often need extra services added on: Cloudflare for CDN, a transactional email provider, and SSL via Let's Encrypt. Headless setups usually include more of this by default, but you'll still need to set up transactional email.

The Decision Framework

Use this framework to keep your decision grounded:

Stay with Drupal (Upgrade to D10/11) if:

  • Your editorial team is committed to the Drupal way of working
  • You need Drupal's granular permissions
  • Multilingual content isn't optional
  • Industry or regulatory requirements lock you in

Go Headless (Next.js + Supabase/Headless CMS) if:

  • Performance makes or breaks your site
  • Cutting long-term costs matters
  • Your team prefers JavaScript/TypeScript
  • You want a fast, app-like frontend experience
  • Decoupling fits your content strategy

Go WordPress if:

  • A simple content site suits your needs
  • Budget is the primary constraint
  • You want the simplest editorial toolkit

Go Static (Astro) if:

  • Information delivery is the main goal
  • Maximum performance matters most
  • Pages and updates are limited in number
  • You don't need complex user interaction

Finding the Right Agency

Here's how to identify a capable migration partner:

Ask about their migration protocol. If the plan sounds like "we'll figure it out as we go," keep looking.

Gauge their Drupal expertise. Even if you're leaving Drupal, deep knowledge of it helps avoid a messy migration.

Check their frontend experience. A headless build requires real expertise in your target framework.

Get a fixed-price quote. A short discovery phase to define scope, before signing a statement of work, is worth the time.

Clarify support arrangements. Know who's on call when something breaks after launch.

If you're weighing this decision, we're happy to talk it through. Reach out any time.

FAQ

When exactly does Drupal 7 support end?

Drupal 7's community security support ended on November 1, 2023. Tag1's paid extended support closes on January 5, 2026. After that date, no vendor patches Drupal 7. Any new vulnerability stays open unless you migrate or arrange custom support.

Can I just stay on Drupal 7 after end of life?

Yes, the site keeps running, but you lose all security patching. This leaves current and future vulnerabilities open indefinitely. Insurers and auditors increasingly treat end-of-life software as a compliance gap, so staying on Drupal 7 can also put your cyber insurance and data protection compliance at risk.

Is migrating from Drupal 7 to Drupal 10 really a full rebuild?

Yes. The architecture changed completely between Drupal 7 and Drupal 8, the foundation for Drupal 10 and 11. It moved from a custom PHP core to Symfony components. Custom modules, Views, and themes generally can't be reused as-is, so budget for a full rebuild, not an incremental upgrade.

How long does a typical Drupal 7 migration take?

Timelines vary by site size. Small sites typically take 6 to 10 weeks. Medium sites take 12 to 20 weeks. Large or enterprise sites take 6 to 12 months. Content migration and QA usually take longer than planned, especially with undocumented custom modules.

What's the cheapest migration option?

WordPress is usually the cheapest path for simple content sites. Development often starts around $10k for a small site. Over three years, though, a headless Next.js migration can end up cheaper overall. Lower hosting and maintenance costs offset the higher upfront build cost.

Should I migrate to Drupal 10 or go headless with Next.js?

Drupal 10 or 11 suits teams already embedded in Drupal's workflow, with complex permissions or heavy multilingual needs. A headless Next.js build usually wins on performance and long-term cost when the content model is simpler and the team knows JavaScript. Use the decision framework above to weigh your priorities.

What headless CMS should I use to replace Drupal 7?

Sanity, Payload CMS, and Storyblok are all solid choices. Payload offers a self-hosted option that avoids ongoing CMS licensing fees. The right pick depends on your team's technical comfort, content complexity, and whether you want a managed SaaS platform or full control over hosting and data.

Do I need to redesign my site during the migration?

Not necessarily. Redesign and migration often get bundled because doing both at once costs less than a second overhaul later. You can also copy your existing design into the new stack and plan a redesign once budget allows.

Key takeaway:

Migrate before January 2026. Unpatched Drupal 7 CVEs expose live exploit paths.