Drupal 7 reached end of life in January 2025, and the sites still running it fall into two groups: the ones with a plan, and the ones where the plan is not thinking about it. This is the sequence for the second group, written from the side of the table that has run the trip — including one migration of a monolithic Drupal 7 application with millions of nodes that landed on modern Drupal with every data relationship intact.
What does “end of life” actually mean for my site?
It means no more security releases from the Drupal security team. Your site didn’t stop working in January 2025, and it won’t stop working next month — but every newly discovered vulnerability in core or contrib now stays open forever unless you patch it yourself. The risk isn’t a cliff; it’s a slope that only goes one direction.
The order of operations: stabilize, assess, migrate
The instinct is to jump straight to the migration quote. The correct first move is cheaper and faster:
Stabilize. Confirm the backups actually restore (an unrestored backup is a rumor). Turn on monitoring. Close the known holes. This buys you the thing D7 owners have least of — time to make the migration decision calmly instead of during an incident.
Assess. A module-by-module read of what you actually have: which contrib modules have Drupal 11 equivalents, which custom code calls dead APIs, what the content model looks like underneath. The output is a costed roadmap — a real number derived from your site, not a rebuild quote derived from a sales target.
Migrate. Drupal 7 to modern Drupal is a re-platforming wearing an update’s name: field storage changed, entity references changed, the render layer changed completely. What survives is the data — if the migration treats the data as the entire point.
The rule that makes migrations boring: counts are the contract
On the millions-of-nodes migration, every entity type was reconciled source-to-destination on every run. Not “it looks right” — the numbers match or the run isn’t done. Migrations ran against copies, in increments, while the live site kept publishing; the final cutover was measured in minutes because delta runs had been rehearsing it for weeks.
That’s the whole secret, and it isn’t glamorous: custom migration paths where the defaults would flatten relationships, count reconciliation as a gate, and tests (Behat, in that case) so the claim “nothing broke” is a test result rather than a feeling.
Do you have to rebuild from scratch?
Not always — and anyone who tells you so before an assessment is guessing with your money. Some D7 sites genuinely need a rethink; plenty need a faithful migration and a lighter theme. The assessment exists to separate those cases in writing before you commit to either.
Dead North runs Drupal upgrade assessments from $2,500 flat — module-by-module findings, honest risk calls, a costed roadmap that’s yours to keep whoever does the work. The rescue practice handles the stabilize step for sites we didn’t build. Whoever built them.