--- title: "Drupal Version Statistics: 27% Run Unsupported Releases" url: https://www.suffdigital.com/resources/data-studies/drupal-version-health description: "Drupal version statistics from 956 websites: 26.6% run Drupal 7, 8 or 9, releases with no security fixes, and 13.8% still run Drupal 7. See the data." lang: en --- Share Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fdrupal-version-health&text=27%25%20of%20Drupal%20Websites%20Run%20a%20Version%20That%20No%20Longer%20Gets%20Security%20Fixes Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fdrupal-version-health Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fdrupal-version-health Share on Reddit: https://www.reddit.com/submit?url=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fdrupal-version-health&title=27%25%20of%20Drupal%20Websites%20Run%20a%20Version%20That%20No%20Longer%20Gets%20Security%20Fixes **26.6%** of Drupal websites that show their version run Drupal 7, 8 or 9, releases that have reached end of life and no longer get security fixes. Drupal 7, retired in January 2025, is still the most common of the three. Analysis of 956 Drupal websites · public websites running Drupal, September 2026 ## Key Findings 1. 1. **26.6%** of Drupal websites that show their version run Drupal 7, 8 or 9, releases that no longer receive security fixes. Copy stat 2. 2. **13.8%** of Drupal websites that show their version still run Drupal 7, which reached end of life in January 2025, more than Drupal 8 and 9 combined. Copy stat 3. 3. **12.8%** of Drupal websites that show their version run Drupal 8 or 9, which can reach a supported release with an upgrade rather than a rebuild. Copy stat 4. 4. **40.3%** of Drupal websites that show their version run Drupal 10, the most common release, and 33.1% run the newest, Drupal 11. Copy stat 5. 5. Drupal websites announce their server software **12.8%** of the time, the highest rate of nine website platforms and more than twice the 5.3% across all websites. Copy stat ## Summary Three organizations each launched a Drupal website in the early 2010s. Two of them have since moved to Drupal 10. The third still runs Drupal 7, which stopped getting security fixes in January 2025, and every new weakness found in it since then stays open. Drupal is used by many larger organizations, and it has a strong security team. But that team supports each major version for a fixed period, and moving from Drupal 7 to a modern release is closer to a rebuild than an update, so the oldest websites tend to wait the longest. Most Drupal websites are on a supported release. **26.6%** are not: they run Drupal 7, 8 or 9, and more than half of those are still on Drupal 7. ## What we measured In September 2026 we checked 956 public websites running Drupal, mostly in the US. 718 of them show their major Drupal version, and we grouped those by version. We also recorded whether each website redirects visitors to its secure https:// address, whether its server announces its software, and which version of the jQuery code library it loads, and ran the same checks on 25,708 websites across nine platforms. A release reaches end of life when the Drupal project stops publishing security fixes for it. Drupal 7, 8 and 9 have all reached that point, so we count them as outdated; Drupal 10 and 11 are supported. A website has no HTTPS redirect when typing or following the plain http:// address leaves the visitor on the unencrypted page instead of moving them to the secure https:// version, which browsers label "Not secure". A server that shows its software names the program it runs in its response headers, information most security guides recommend keeping private. ## One in four Drupal websites runs an unsupported release 26.6% of Drupal websites that show their version run a release without security support. Drupal 10 is the largest group, on 40.3% of Drupal websites that show a version, and Drupal 11 is close behind at 33.1%. The rest are on releases that no longer get fixes: 13.8% on Drupal 7, 7.8% on Drupal 9 and 5% on Drupal 8. The Drupal 7 group, 99 websites, is larger than Drupal 8 and 9 combined. Drupal 7 websites wait longest because the move is hardest. Drupal 8 rebuilt the system from the ground up, so leaving Drupal 7 means rebuilding the site's structure, theme and custom modules rather than running an update. Share of Drupal websites showing a version by drupal version Drupal 7 13.8% Drupal 8 5% Drupal 9 7.8% Drupal 10 40.3% Drupal 11 33.1% Source: Suff Digital analysis of 956 Drupal websites · public websites running Drupal, September 2026 | Drupal version | Drupal websites | Share of Drupal websites showing a version | Gets security fixes | | --- | --- | --- | --- | | Drupal 7 | 99 | 13.8% | No | | Drupal 8 | 36 | 5% | No | | Drupal 9 | 56 | 7.8% | No | | Drupal 10 | 289 | 40.3% | Yes | | Drupal 11 | 238 | 33.1% | Yes | ## Drupal 8 and 9 websites are the quickest wins 12.8% of Drupal websites that show their version run Drupal 8 or 9. Unlike Drupal 7, those releases share their architecture with Drupal 10 and 11, so bringing them up to date is an upgrade, not a rebuild: update the code, replace retired modules and test. Old jQuery is a second sign of an old Drupal install. Drupal 7 core shipped an old jQuery release, and where a Drupal website shows its jQuery version, 36.8% load one older than 3.5.0, the release that fixed two publicly documented security flaws. ## Drupal websites show their server software more than any other platform 12.8% of Drupal websites name their server software in response headers, the highest rate of the nine platforms, ahead of OpenCart at 11%, and more than twice the 5.3% across all 25,708 websites. That is a hosting setting, and it takes minutes to turn off. On the other checks Drupal does well. 7.4% of Drupal websites do not redirect visitors from http:// to https://, below the 9.1% across all websites and far below OpenCart's 19.3%. No redirect from http:// to https:// by platform WordPress 4.9% Drupal 7.4% Joomla 12.5% Magento 8.9% PrestaShop 4.9% OpenCart 19.3% Shopify 1.4% Squarespace 6.3% Wix 0.1% All websites 9.1% | Platform | Websites | No redirect from http:// to https:// | Show server software | | --- | --- | --- | --- | | WordPress | 7,515 | 4.9% | 4.8% | | Drupal | 956 | 7.4% | 12.8% | | Joomla | 707 | 12.5% | 7.6% | | Magento | 550 | 8.9% | 7.5% | | PrestaShop | 387 | 4.9% | 6.5% | | OpenCart | 426 | 19.3% | 11% | | Shopify | 1,636 | 1.4% | 0.1% | | Squarespace | 2,004 | 6.3% | 0.05% | | Wix | 1,853 | 0.1% | 0% | | All websites | 25,708 | 9.1% | 5.3% | ## What this means for Drupal site owners If you are on Drupal 7, budget for the move now. Every month on an unsupported release adds weaknesses that will never be fixed, and the move is a rebuild, so it needs a plan: an inventory of content types, custom modules and integrations, and a decision on whether to rebuild on Drupal 11 or another platform. If you are on Drupal 8 or 9, schedule the upgrade to Drupal 10 or 11 as a contained project, and in the meantime ask your host to hide server software details. Whichever you choose, protect what the site has earned in search. Experienced drupal migration services (https://www.suffdigital.com/services/website-migration/drupal-migration) map every old URL to its new home so rankings and links carry over. ## Embed this research Paste this on your site to embed the charts. It links back to the source automatically.

Source: 27% of Drupal Websites Run a Version That No Longer Gets Security Fixes - Suff Digital

## Cite this study APA Suff Digital. (2026). 27% of Drupal Websites Run a Version That No Longer Gets Security Fixes. https://www.suffdigital.com/resources/data-studies/drupal-version-health Plain link 27% of Drupal Websites Run a Version That No Longer Gets Security Fixes - Suff Digital - https://www.suffdigital.com/resources/data-studies/drupal-version-health ## Frequently asked questions ### How many Drupal websites are out of date? ### How many websites still run Drupal 7? ### Is Drupal 7 still safe to use? ### Which Drupal version is most common? ## Related studies - Website Maintenance 44.5% of WordPress Sites Are Behind the Latest Release, and Popular Sites Barely Do Better: https://www.suffdigital.com/resources/data-studies/outdated-wordpress-versions - Website Maintenance 83% of PrestaShop Websites Showing a jQuery Version Run One With Known Flaws vs 36.1% Web-Wide: https://www.suffdigital.com/resources/data-studies/outdated-jquery-websites - Website Maintenance 61.6% of Websites Skip HSTS, the Security Header That Forces Secure Connections: https://www.suffdigital.com/resources/data-studies/hsts-security-header-missing - Website Maintenance 48.1% of Websites That Show Their PHP Version Run One With No Security Fixes: https://www.suffdigital.com/resources/data-studies/end-of-life-php-versions ## Structured data ```json [ { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://www.suffdigital.com/#organization", "name": "Suff Digital", "alternateName": "Suff Digital Marketing", "url": "https://www.suffdigital.com/", "logo": { "@type": "ImageObject", "@id": "https://www.suffdigital.com/#logo", "url": "https://www.suffdigital.com/logo.png", "contentUrl": "https://www.suffdigital.com/logo.png", "caption": "Suff Digital" }, "image": { "@id": "https://www.suffdigital.com/#logo" }, "description": "Suff Digital is a full-stack digital marketing agency that turns websites into predictable revenue engines, SEO, paid media, content, CRO, and web design built around revenue, not vanity metrics.", "slogan": "Digital marketing built for what's next.", "email": "hello@suffdigital.com", "telephone": "+1-629-236-0099", "foundingDate": "2022", "founder": { "@type": "Person", "name": "Matt Suffoletto", "jobTitle": "Founder & CEO" }, "contactPoint": [ { "@type": "ContactPoint", "telephone": "+1-629-236-0099", "email": "hello@suffdigital.com", "contactType": "sales", "areaServed": "US", "availableLanguage": [ "en" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Nashville", "addressRegion": "TN", "postalCode": "37219", "addressCountry": "US" }, "areaServed": { "@type": "Country", "name": "United States" }, "sameAs": [ "https://www.linkedin.com/company/suff-digital/", "https://www.instagram.com/suffdigital/", "https://www.youtube.com/@suffdigitalmarketing", "https://www.tiktok.com/@suffdigital" ], "knowsAbout": [ "Search Engine Optimization", "Pay-Per-Click Advertising", "Paid Social Advertising", "Conversion Rate Optimization", "Web Design", "Digital PR", "Link Building", "Website Migration", "Website Maintenance and Support", "Technical SEO", "Local SEO", "AI Search Optimization" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Suff Digital Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Search Engine Optimization (SEO)", "url": "https://www.suffdigital.com/" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Pay-Per-Click (PPC) Advertising", "url": "https://www.suffdigital.com/services/ppc" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Paid Social Advertising", "url": "https://www.suffdigital.com/services/paid-social" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Conversion Rate Optimization (CRO)", "url": "https://www.suffdigital.com/services/cro" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Web Design", "url": "https://www.suffdigital.com/services/web-design" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Digital PR & Link Building", "url": "https://www.suffdigital.com/services/digital-pr" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Website Migration", "url": "https://www.suffdigital.com/services/website-migration" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Website Maintenance & Support", "url": "https://www.suffdigital.com/services/website-maintenance" } } ] } }, { "@type": "WebSite", "@id": "https://www.suffdigital.com/#website", "url": "https://www.suffdigital.com/", "name": "Suff Digital", "inLanguage": "en-US", "publisher": { "@id": "https://www.suffdigital.com/#organization" } } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "Article", "@id": "https://www.suffdigital.com/resources/data-studies/drupal-version-health#article", "headline": "27% of Drupal Websites Run a Version That No Longer Gets Security Fixes", "description": "26.6% of Drupal websites that show their version run Drupal 7, 8 or 9, releases that have reached end of life and no longer get security fixes. Drupal 7, retired in January 2025, is still the most common of the three.", "image": [ "https://www.suffdigital.com/images/suff-digital-share-16x9.jpg" ], "url": "https://www.suffdigital.com/resources/data-studies/drupal-version-health", "datePublished": "2026-09-24", "dateModified": "2026-09-24", "author": { "@type": "Person", "name": "Matt Suffoletto", "jobTitle": "Founder & CEO", "url": "https://www.suffdigital.com/who-we-are" }, "publisher": { "@id": "https://www.suffdigital.com/#organization" }, "mainEntityOfPage": { "@id": "https://www.suffdigital.com/resources/data-studies/drupal-version-health", "@type": "WebPage" }, "isPartOf": { "@id": "https://www.suffdigital.com/#website" } }, { "@type": "BreadcrumbList", "@id": "https://www.suffdigital.com/resources/data-studies/drupal-version-health#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://www.suffdigital.com/" }, { "@type": "ListItem", "position": 2, "name": "Resources", "item": "https://www.suffdigital.com/resources" }, { "@type": "ListItem", "position": 3, "name": "Data Studies", "item": "https://www.suffdigital.com/resources/data-studies" }, { "@type": "ListItem", "position": 4, "name": "27% of Drupal Websites Run a Version That No Longer Gets Security Fixes" } ] }, { "@type": "Dataset", "@id": "https://www.suffdigital.com/resources/data-studies/drupal-version-health#dataset", "name": "27% of Drupal Websites Run a Version That No Longer Gets Security Fixes", "description": "26.6% of Drupal websites that show their version run Drupal 7, 8 or 9, releases that have reached end of life and no longer get security fixes. Drupal 7, retired in January 2025, is still the most common of the three.", "url": "https://www.suffdigital.com/resources/data-studies/drupal-version-health", "creator": { "@id": "https://www.suffdigital.com/#organization" }, "datePublished": "2026-09-24", "dateModified": "2026-09-24", "license": "https://creativecommons.org/licenses/by/4.0/", "isAccessibleForFree": true, "measurementTechnique": "Public websites running Drupal, mostly in the US, compared with eight other website platforms" }, { "@type": "FAQPage", "@id": "https://www.suffdigital.com/resources/data-studies/drupal-version-health#faq", "mainEntity": [ { "@type": "Question", "name": "How many Drupal websites are out of date?", "acceptedAnswer": { "@type": "Answer", "text": "26.6% of Drupal websites that show their version run Drupal 7, 8 or 9, releases that no longer receive security fixes (September 2026)." } }, { "@type": "Question", "name": "How many websites still run Drupal 7?", "acceptedAnswer": { "@type": "Answer", "text": "13.8% of Drupal websites that show their version still run Drupal 7, which reached end of life in January 2025, more than Drupal 8 and 9 combined." } }, { "@type": "Question", "name": "Is Drupal 7 still safe to use?", "acceptedAnswer": { "@type": "Answer", "text": "It no longer gets security fixes from the Drupal project, so new weaknesses stay open. Drupal 7 websites should plan a move to a supported release." } }, { "@type": "Question", "name": "Which Drupal version is most common?", "acceptedAnswer": { "@type": "Answer", "text": "Drupal 10, on 40.3% of Drupal websites that show their version, followed by Drupal 11 on 33.1%." } } ] } ] } ] ```