Hi, I'm Melanie, and I've been building Drupal websites for around 15 years — across versions 5, 6, 7, 8, 9, 10 and now 11. I've seen first-hand how the platform has evolved, and I've made my share of mistakes upgrading sites along the way. Here's what I've learned, and what's actually true heading into 2026.

Still running Drupal 7? Here's what you need to know

If your website is still running on Drupal 7, you're not alone — but it's well past time to act. Drupal 7 officially reached end-of-life on 5 January 2025. That means no more official core updates and no more security advisories from the Drupal Security Team, so the risk only increases the longer a Drupal 7 site stays online. (Some vendors offer paid extended support for Drupal 7 beyond this date — worth checking if you need more runway to plan.)

Is a Drupal 7 migration really a full rebuild?

This is something I got wrong in an earlier version of this article, so I want to correct it properly: a move from Drupal 7 to Drupal 10 or 11 isn't automatically a full manual rebuild. Drupal core ships with the Migrate and Migrate Drupal modules, which can transfer supported content and configuration from a Drupal 7 (or 6) site into a new Drupal 10+ site in a fairly automated way.

What those tools can't carry across is your theme — Drupal's front-end architecture changed fundamentally from Drupal 8 onward, so themes need to be rebuilt rather than migrated. Custom modules and some contributed modules without an upgrade path also typically need manual or custom migration work. In practice, how much of the project is 'migration' versus 'rebuild' depends heavily on how customised your Drupal 7 site is.

  • Content, taxonomy and most configuration — usually migrate automatically
  • Theme and front-end design — needs to be rebuilt
  • Custom modules and custom code — usually needs manual migration or a rewrite
  • Contributed modules without a Drupal 10/11 release — needs an alternative or custom solution

Even when a project leans more 'rebuild' than 'migration', it's still an opportunity — to rethink the design and user experience, clean up outdated content, improve performance and mobile responsiveness, and set the site up for far easier upgrades from here on.

Already on Drupal 9, 10 or 11? Here's the real upgrade path

If you're already on Drupal 8 or 9, you're ahead of the Drupal 7 problem — but both are also past end-of-life (Drupal 8 in November 2021, Drupal 9 in November 2023), so you're not out of the woods. If you're on Drupal 10, it's still supported for now, but Drupal 10 reaches end-of-life on 9 December 2026, with Drupal 12 shipping that same week. Drupal 11, released in August 2024, is the version with the longest runway right now — supported into 2028.

Here's the part I also got wrong originally: Drupal doesn't require you to install every single point release in sequence (8.9 → 9.0 → 9.1 → 9.2…). The actual rule, per Drupal's official upgrade documentation, is simpler but still strict — you can't skip a major version (9 → 10 → 11, not 9 → 11 directly), and before moving to the next major version you need to be on the latest minor release of your current major version, with all deprecated code and incompatible modules resolved first.

That distinction matters in practice. When I first upgraded a site from Drupal 8, I tried to shortcut the process and jump ahead too quickly — and ended up with a broken site and failed database updates. The real issue wasn't skipping point releases, it was moving to the next major version before every module and piece of custom code was actually compatible with it. Things like outdated CKEditor configurations, themes referencing deprecated APIs, and database schema updates that silently fail are what actually derail an upgrade. If something breaks partway through, you roll back, fix the specific incompatibility, and move forward again — it's careful, methodical work, and tools like Upgrade Status and Drupal Rector help, but they don't remove the need for that attention.

Drupal vs WordPress: a fairer comparison

I used to tell people Drupal was simply more secure than WordPress and could safely go longer between updates. That's not a fair claim, and I want to correct it here too. Both platforms are mature, well-maintained open-source projects with active security teams — the real differences are in architecture and ecosystem, not a blanket security advantage for either one. A badly maintained Drupal site is not safer than a well-maintained WordPress site, or vice versa.

Where they genuinely differ: WordPress has a much larger developer pool, a bigger plugin ecosystem and generally lower upfront costs, which suits many businesses well. Drupal tends to cost more to build and maintain and has a smaller specialist developer pool, but its content architecture, granular permissions and structured-data handling make it a strong fit for complex, content-heavy or highly permissioned sites. Neither is the 'better' platform in the abstract — it depends on what the site actually needs to do.

Planning your next move

Whether you're migrating off Drupal 7 or upgrading an existing Drupal 9, 10 or 11 site, the same principle applies: understand what you actually need from the platform before committing to a path. We use our Digital Blueprint process to assess an existing site, work out what can realistically migrate versus what needs rebuilding, and agree a plan before any development starts. If a straight upgrade isn't the right call, our website redesign and modernisation work covers the rebuild side, and our Drupal development and support page has more on what that looks like day to day.

You don't need to figure this out alone. I've been through failed upgrades, broken themes and database errors first-hand — happy to point you in the right direction, however far along you are.