State of Drupal 7 in 2026: How Many Sites Are Still Running It?

Drupal 7 reached its final, no-more-extensions end of life on January 5, 2025. Nineteen months later, it is still the second most-used version of Drupal on the web — behind Drupal 10 by less than one percentage point.

I keep needing current numbers on this for client conversations, and every source I found was either stale or scattered. So this page is the census I wanted to exist: the current data, the method behind it, and what it means if one of these sites is yours. We update it quarterly — cite it freely, and the graphics below are free to reuse with attribution and a link.

The numbers (August 2026)

• 29.7% of all Drupal websites still run Drupal 7 — nineteen months past final end of life (W3Techs, 22 Aug 2026)
• 50.3% of Drupal websites run an end-of-life version (7, 8, 9, or older) — half the Drupal web has no security support (W3Techs)
• Drupal 10 leads at 30.6%; Drupal 11 has reached 19.1% of live sites (W3Techs)
• 485,296 Drupal 8+ sites reported update pings to drupal.org in the week of Aug 9, 2026 — up 32% from 367,534 in August 2020: the modern-Drupal ecosystem is growing, not shrinking (drupal.org usage statistics)
• Within reporting sites: Drupal 10 = 225,887 · Drupal 11 = 165,229 · Drupal 9 = 51,847 (EOL) · Drupal 8 = 42,333 (EOL) (drupal.org, week of 9 Aug 2026)
• Combining both sources, we estimate on the order of 200,000 Drupal 7 sites are still live (method below)
• Drupal overall powers 1.0% of all websites with a known CMS (W3Techs)

Methodology — two lenses, honestly labeled

No single source sees the whole Drupal web, so this census triangulates two with opposite blind spots:

Lens 1: W3Techs crawls the public web and fingerprints the CMS and version of every site it can identify. Strength: it sees Drupal 7 sites, which mostly no longer phone home. Weakness: it’s a sample of the crawlable web, weighted toward sites with some traffic.

Lens 2: drupal.org usage statistics count sites that run the Update Status module and report their core version weekly. Strength: hard counts, not sampling. Weaknesses: only covers sites that report (many production sites disable it), and the public dataset covers Drupal 8+.

Our absolute-count estimate: the reporting dataset shows 485,296 Drupal 8+ sites. W3Techs measures Drupal 7 at 29.7% of Drupal sites versus 70.3% for everything else. If those proportions hold across the wider population, the implied Drupal 7 fleet is roughly 485,296 × (29.7 ÷ 70.3) ≈ 205,000 sites — and since Drupal 7 sites are less likely than modern ones to report usage at all, that’s plausibly a floor. We say “on the order of 200,000” and resist false precision. If you have better data — a private crawl, a hosting-fleet census — I genuinely want to see it.

Fifteen years on borrowed time

The timeline explains the number. Drupal 7 lived an extraordinary fourteen years as a supported release — longer than any Drupal before or since — because the Drupal Association extended its end of life three separate times. Each extension was rational in isolation: too much of the institutional web depended on it. But collectively, the extensions taught site owners a lesson that turned out to be false: the deadline always moves. In January 2025 it finally didn’t, and nearly a third of the Drupal web got caught still standing on the platform.

The deeper cause is architectural, and it’s worth being honest about because it explains why “just upgrade” was never the instruction. Drupal 8 shipped in 2015 as a ground-up rebuild — new object-oriented architecture, new theming layer, new module APIs. There was no in-place upgrade from 7; there was a re-platform. That decision bought Drupal its modern, continuously-upgradable architecture (8→9→10→11 are genuinely easy hops — the era of cliff-edge migrations ended with 7), but it priced a real project into every D7 site’s future. A lot of owners deferred that project until the price of deferring stopped being zero.

The quieter problem: the Drupal 8 and 9 zombie fleet

Drupal 7 gets the headlines, but the reporting data holds a subtler warning: 94,180 sites are still reporting on Drupal 8 or 9 — versions that reached end of life in November 2021 and November 2023 respectively. These owners did the hard migration off 7 (or built fresh on 8/9) and then stopped, missing the entire point of the modern release model: staying current is now a maintenance task, not a project. An unpatched Drupal 9 site in 2026 carries the same category of risk as the D7 sites its owner probably feels superior to.

What actually happens to unsupported sites

Nothing — until something. The site renders, editors log in, and the risk accrues invisibly: no more security advisories or patches from the Drupal security team, a contrib ecosystem whose maintainers have moved on, PHP versions aging out beneath the stack, and hosting platforms dropping support tier by tier. The history lesson is Drupalgeddon in 2014: when a critical core vulnerability drops, exploitation is measured in hours. The difference is that back then, a patch existed. For these sites, next time, it won’t.

For public institutions the risk is also administrative: “we run an unsupported CMS” is a failing answer on a security questionnaire, an insurance renewal, and increasingly a procurement requirement. Several of the migration inquiries we take aren’t triggered by fear of hackers at all — they’re triggered by an auditor’s checkbox.

The four exits

Every one of those ~200,000 sites lands somewhere on this map. Migration to Drupal 10/11 is the default for institutional sites — the complexity that made Drupal the right choice in 2012 usually still holds. WordPress is the honest answer for a subset: sites that never needed Drupal’s machinery and will be cheaper and happier on something simpler. Extended support (commercial D7 patching) is a legitimate bridge for a large site mid-budget-cycle — a bridge with an annual toll, at the end of which the migration is still waiting, no cheaper than before. And doing nothing is the path chosen by not choosing — the one option whose cost compounds silently.

For the sites choosing migration, the practical playbook — timelines, budget ranges, and how rankings survive the move — is in our Drupal 7 end-of-life migration guide and the companion piece on what migrations actually cost.

Reuse this data

All three graphics and every number on this page are free to reuse with attribution and a link to this page. We refresh the census quarterly (next update: November 2026), so a link here stays accurate longer than a screenshot. Corrections and better datasets are welcome — the methodology section tells you exactly what we’d want to see.

Gspikes is a Drupal development and SEO agency; Drupal 7 migrations without ranking losses are our flagship service. That’s both the disclosure and the reason we track these numbers.