Every one of those ~200,000 sites lands somewhere on this map. Migration to Drupal 10/11 is the default for institutional sites — the complexity that made Drupal the right choice in 2012 usually still holds. WordPress is the honest answer for a subset: sites that never needed Drupal’s machinery and will be cheaper and happier on something simpler. Extended support (commercial D7 patching) is a legitimate bridge for a large site mid-budget-cycle — a bridge with an annual toll, at the end of which the migration is still waiting, no cheaper than before. And doing nothing is the path chosen by not choosing — the one option whose cost compounds silently.
The deeper cause is architectural, and it’s worth being honest about because it explains why “just upgrade” was never the instruction. Drupal 8 shipped in 2015 as a ground-up rebuild — new object-oriented architecture, new theming layer, new module APIs. There was no in-place upgrade from 7; there was a re-platform. That decision bought Drupal its modern, continuously-upgradable architecture (8→9→10→11 are genuinely easy hops — the era of cliff-edge migrations ended with 7), but it priced a real project into every D7 site’s future. A lot of owners deferred that project until the price of deferring stopped being zero.
The numbers (August 2026)
- 29.7% of all Drupal websites still run Drupal 7 — nineteen months past final end of life (W3Techs, 22 Aug 2026)
- 50.3% of Drupal websites run an end-of-life version (7, 8, 9, or older) — half the Drupal web has no security support (W3Techs)
- Drupal 10 leads at 30.6%; Drupal 11 has reached 19.1% of live sites (W3Techs)
- 485,296 Drupal 8+ sites reported update pings to drupal.org in the week of Aug 9, 2026 — up 32% from 367,534 in August 2020: the modern-Drupal ecosystem is growing, not shrinking (drupal.org usage statistics)
- Within reporting sites: Drupal 10 = 225,887 · Drupal 11 = 165,229 · Drupal 9 = 51,847 (EOL) · Drupal 8 = 42,333 (EOL) (drupal.org, week of 9 Aug 2026)
- Combining both sources, we estimate on the order of 200,000 Drupal 7 sites are still live (method below)
- Drupal overall powers 1.0% of all websites with a known CMS (W3Techs)
Methodology — two lenses, honestly labeled
Drupal 7 reached its final, no-more-extensions end of life on January 5, 2025. Nineteen months later, it is still the second most-used version of Drupal on the web — behind Drupal 10 by less than one percentage point.
Nothing — until something. The site renders, editors log in, and the risk accrues invisibly: no more security advisories or patches from the Drupal security team, a contrib ecosystem whose maintainers have moved on, PHP versions aging out beneath the stack, and hosting platforms dropping support tier by tier. The history lesson is Drupalgeddon in 2014: when a critical core vulnerability drops, exploitation is measured in hours. The difference is that back then, a patch existed. For these sites, next time, it won’t.
Migrations, custom modules, integrations, and support with real SLAs — with a fixed-price quote from a senior engineer within 3 days.
Our absolute-count estimate: the reporting dataset shows 485,296 Drupal 8+ sites. W3Techs measures Drupal 7 at 29.7% of Drupal sites versus 70.3% for everything else. If those proportions hold across the wider population, the implied Drupal 7 fleet is roughly 485,296 × (29.7 ÷ 70.3) ≈ 205,000 sites — and since Drupal 7 sites are less likely than modern ones to report usage at all, that’s plausibly a floor. We say “on the order of 200,000” and resist false precision. If you have better data — a private crawl, a hosting-fleet census — I genuinely want to see it.
Fifteen years on borrowed time
For the sites choosing migration, the practical playbook — timelines, budget ranges, and how rankings survive the move — is in our Drupal 7 end-of-life migration guide and the companion piece on what migrations actually cost.
All three graphics and every number on this page are free to reuse with attribution and a link to this page. We refresh the census quarterly (next update: November 2026), so a link here stays accurate longer than a screenshot. Corrections and better datasets are welcome — the methodology section tells you exactly what we’d want to see.Get a free Drupal audit →
The quieter problem: the Drupal 8 and 9 zombie fleet
No single source sees the whole Drupal web, so this census triangulates two with opposite blind spots:
What actually happens to unsupported sites
For public institutions the risk is also administrative: “we run an unsupported CMS” is a failing answer on a security questionnaire, an insurance renewal, and increasingly a procurement requirement. Several of the migration inquiries we take aren’t triggered by fear of hackers at all — they’re triggered by an auditor’s checkbox.
I keep needing current numbers on this for client conversations, and every source I found was either stale or scattered. So this page is the census I wanted to exist: the current data, the method behind it, and what it means if one of these sites is yours. We update it quarterly — cite it freely, and the graphics below are free to reuse with attribution and a link.
The four exits
Lens 2: drupal.org usage statistics count sites that run the Update Status module and report their core version weekly. Strength: hard counts, not sampling. Weaknesses: only covers sites that report (many production sites disable it), and the public dataset covers Drupal 8+.
Lens 1: W3Techs crawls the public web and fingerprints the CMS and version of every site it can identify. Strength: it sees Drupal 7 sites, which mostly no longer phone home. Weakness: it’s a sample of the crawlable web, weighted toward sites with some traffic.
Reuse this data
Drupal 7 gets the headlines, but the reporting data holds a subtler warning: 94,180 sites are still reporting on Drupal 8 or 9 — versions that reached end of life in November 2021 and November 2023 respectively. These owners did the hard migration off 7 (or built fresh on 8/9) and then stopped, missing the entire point of the modern release model: staying current is now a maintenance task, not a project. An unpatched Drupal 9 site in 2026 carries the same category of risk as the D7 sites its owner probably feels superior to.
The timeline explains the number. Drupal 7 lived an extraordinary fourteen years as a supported release — longer than any Drupal before or since — because the Drupal Association extended its end of life three separate times. Each extension was rational in isolation: too much of the institutional web depended on it. But collectively, the extensions taught site owners a lesson that turned out to be false: the deadline always moves. In January 2025 it finally didn’t, and nearly a third of the Drupal web got caught still standing on the platform.
Put senior Drupal engineers on it
Gspikes is a Drupal development and SEO agency; Drupal 7 migrations without ranking losses are our flagship service. That’s both the disclosure and the reason we track these numbers.
