24,332 websites still run Drupal 7, more than 20 months after it stopped receiving security fixes on January 5, 2025. That is 21% of Drupal websites with a detectable version, and 1,005 of them rank among the 1 million most visited websites.
Analysis of 141,306 Drupal homepages · the public HTTP Archive crawl, September 2026
Key Findings
- 1.24,332 websites still run Drupal 7, which stopped receiving security fixes on January 5, 2025.
- 2.21% of Drupal websites with a detectable version still run Drupal 7, and 17.2% of all Drupal homepages do.
- 3.24.4% of Drupal websites outside the 10 million most visited run Drupal 7, more than twice the 11.4% of the 10,000 most visited.
- 4.1,005 Drupal 7 websites rank among the 1 million most visited websites, including 5 among the 10,000 most visited.
- 5.Drupal homepages fell from 185,552 in October 2024 to 141,306 in September 2026.
Summary
A university department's website has run on Drupal 7 for twelve years. It works, the staff know how to edit it, and rebuilding it has never reached the top of the budget. Since January 2025, though, any new security hole found in Drupal 7 stays open unless someone pays a third party to fix it.
Drupal is an open-source content management system used by many universities, governments and large organizations. The Drupal Security Team stopped releasing fixes for version 7 on January 5, 2025. Moving from Drupal 7 to a current version is close to a full rebuild, which explains why so many websites have waited, and every month they wait, fewer developers still work on the old version.
24,332 websites still run Drupal 7, 21% of Drupal websites with a detectable version, about one in five. Most are less-visited websites, but 1,005 rank among the 1 million most visited.
What we measured
We counted homepages running Drupal in the September 2026 HTTP Archive crawl, a public project that loads millions of homepages each month and records the technologies they use: 141,306 in all. For the 115,809 where the major version was visible, we recorded it, and we split the results by how popular each website is, from the 10,000 most visited to those outside the top 10 million.
End of life means the software's makers no longer release security fixes or updates for it. A major version is the main release number, such as Drupal 7 or Drupal 10. "Drupal 8 and newer" groups every version from 8 onward.
One in five Drupal websites runs a version past end of life
That is 24,332 websites, or 17.2% of all Drupal homepages including those that hide their version. Each one runs core software that no longer receives security fixes from the Drupal project, unless the owner pays for extended support from an outside vendor.
The rest of the Drupal world is not fully covered either. Drupal 8 and 9 have also reached end of life, and they are counted inside the 91,461 websites running Drupal 8 and newer. The share of Drupal websites on a supported major version is lower than the 79% that the Drupal 8 and newer figure suggests.
Less-visited Drupal websites are the slowest to upgrade
The Drupal 7 share is lowest among popular websites and highest among the least visited. Around 9% to 11% of Drupal websites in the 100,000 most visited are on version 7; beyond the top 10 million it is 24.4%, nearly one in four. The less-visited web also holds most of the Drupal 7 websites in absolute terms: 23,327 of the 24,332 sit outside the 1 million most visited.
Source: Suff Digital analysis of 141,306 Drupal homepages · the public HTTP Archive crawl, September 2026
| Website popularity | Drupal homepages | With version | Drupal 7 | Share of versioned | Drupal 8 and newer |
|---|---|---|---|---|---|
| 10,000 most visited | 70 | 44 | 5 | 11.4% | 39 |
| 10,000 to 100,000 | 872 | 584 | 50 | 8.6% | 534 |
| 100,000 to 1 million | 10,561 | 8,025 | 950 | 11.8% | 7,075 |
| 1 million to 10 million | 81,367 | 66,778 | 13,482 | 20.2% | 53,285 |
| Beyond the top 10 million | 48,436 | 40,378 | 9,845 | 24.4% | 30,528 |
| All websites | 141,306 | 115,809 | 24,332 | 21% | 91,461 |
Popular websites are not clear of it. 1,005 Drupal 7 websites rank among the 1 million most visited, and 5 of the 44 Drupal homepages with a readable version among the 10,000 most visited still run Drupal 7. The 1,005 carry the most traffic, so they have the most to lose from running without core security patches.
Fewer Drupal websites overall
The version problem sits inside a shrinking base. Drupal homepages in the HTTP Archive crawl fell from 185,552 in October 2024 to 141,306 in September 2026. Since moving from Drupal 7 to Drupal 10 or 11 is close to a full rebuild anyway, that rebuild is also the natural moment to choose a different platform.
That makes the Drupal 7 decision a platform decision. An organization rebuilding its website has three routes: a current version of Drupal, another content management system, or a hosted builder. Each involves moving years of content, custom page addresses and the backlinks that point at them.
What this means for organizations running Drupal 7
If you are on Drupal 7, you have two sensible options. Buy extended support from a vendor that still patches Drupal 7 while you plan a move, or rebuild on Drupal 10 or 11 or on another platform. Staying on unsupported Drupal 7 with no source of security patches is the one option to avoid.
Treat the rebuild as a migration as well as a redesign. Drupal 7 websites often have years of content, custom page addresses and backlinks that need redirects. Our drupal migration services map every old address to its new home and test the redirects before launch, so the new website keeps the search traffic the old one earned.
Embed this research
Paste this on your site to embed the charts. It links back to the source automatically.
<iframe id="sd-drupal-7-sites-after-end-of-life" src="https://www.suffdigital.com/embed/data-studies/drupal-7-sites-after-end-of-life" width="100%" height="600" style="width:100%;border:1px solid #E5E7EB;border-radius:12px" loading="lazy" title="24,332 Websites Still Run Drupal 7, 20 Months After Security Support Ended - Suff Digital"></iframe>
<script>window.addEventListener("message",function(e){if(e&&e.data&&e.data.sdEmbed==="drupal-7-sites-after-end-of-life"&&e.data.height){var f=document.getElementById("sd-drupal-7-sites-after-end-of-life");if(f){f.style.height=e.data.height+"px";}}});</script>
<p style="font:14px/1.5 system-ui,sans-serif">Source: <a href="https://www.suffdigital.com/resources/data-studies/drupal-7-sites-after-end-of-life">24,332 Websites Still Run Drupal 7, 20 Months After Security Support Ended - Suff Digital</a></p>
Cite this study
Suff Digital. (2026). 24,332 Websites Still Run Drupal 7, 20 Months After Security Support Ended. https://www.suffdigital.com/resources/data-studies/drupal-7-sites-after-end-of-life
24,332 Websites Still Run Drupal 7, 20 Months After Security Support Ended - Suff Digital - https://www.suffdigital.com/resources/data-studies/drupal-7-sites-after-end-of-life
Frequently asked questions
Related studies
- Website MigrationDrupal Runs on 23.8% Fewer Websites Than Two Years Ago
- Website Migration1,669 Online Stores Still Run Magento 1, Six Years After Support Ended
- Website Migration382,097 Websites Still Load a Google Analytics Tag That Stopped Working in 2023
- Website MigrationShopify Won 41% of Websites That Switched Platforms in Six Months