Drupal 7 End of Life: What Utility Organizations Need to Do Now

Drupal 7 stopped getting security updates on January 5, 2025. If your site still runs on it, your ratepayers pay bills, report outages, and check service status on unsupported software. You don't have to fix everything at once. You do need a plan. Start with four decisions.

What Drupal 7 end of life means for your site today

Your site still works. The difference is who's watching for problems. The Drupal Security Team stopped publishing security advisories for Drupal 7 core and modules. Drupal.org now marks those modules as unsupported. Vulnerabilities may be posted publicly with no fix, and third-party scans can flag your site as insecure.

Utilities face more risk than most. Your site likely connects accounts, takes payments, and runs the outage map your ratepayers check during storms. Unsupported Drupal 7 sites can fall out of compliance with PCI or SOC 2. If you process payments, check with your payment provider and IT team about what that means for you.

Decision 1: Inventory what your site connects to

Start with a list. Many utility sites connect to systems outside the CMS. Those connections set the scope, schedule, and risk for any change. Write down:

• Your customer information system (CIS) and billing connections, including any authenticated ratepayer portal
• The outage management system (OMS) feeds behind your outage map
• Payment processors and third-party data feeds
• Custom modules and themes, and who wrote them
• Vendor API documentation for each connection, and whether it is current

The last item matters most. Integrations built years ago sometimes rely on undocumented middleware. It's cheaper to find that during an audit than during development.

Decision 2: Decide how to bridge the gap

You have two ways to reduce risk while you plan. Migration is the goal. Paid extended security support is a bridge. The Drupal Association certifies vendors who sell extended support for Drupal 7. That buys you time, but keeps you on a platform that's no longer developed.

If your integrations are complex or your budget cycle is months out, weigh the cost of a bridge against the cost of waiting. If you use extended support, treat it as a temporary step with a clear end date.

Decision 3: Set Drupal 11 as the target

Build for Drupal 11. Drupal 10 reaches end of life on December 9, 2026. Migrating to Drupal 10 puts you close to being unsupported from day one. Drupal 7 and Drupal 11 have sharply different architectures, so the move is a migration with extensive changes to APIs and the content model, not an in-place upgrade. Going straight to Drupal 11 avoids a second upgrade soon after launch.

Decision 4: Plan for the team that inherits the site

Many utility communications teams are small. The people updating news, outages, and forms aren't developers. Budget for training, documentation, and a maintenance agreement that covers security and module updates, plus post-launch compatibility testing. A secure platform your team can't manage doesn't solve the problem.

Check your accessibility deadline while you plan

The Department of Justice's ADA Title II rule sets WCAG 2.1 AA as the standard for state and local government websites and mobile apps. In April 2026, DOJ extended the compliance dates. Entities serving 50,000 or more people now have until April 26, 2027. Smaller entities and special district governments have until April 26, 2028. The requirements themselves didn't change.

Title II covers state and local government, including special districts. If that's your utility, build accessibility into design from the start. Outage maps, account portals, and payment forms cost more to fix after launch than to plan for up front.

What a utility migration involves

Inclind runs migrations using our ICBM method: Investigate, Create, Build, Measure. Investigate gives you a site audit, project plan, and technical strategy. Create turns that plan into design and specs, with accessibility planned from the start. Build covers the theme, integrations, content migration, and DevOps workflow. We run quality assurance and multiple rounds of user acceptance testing before launch. Measure starts after launch, with monitoring, a 90-day analysis, and the training and documentation your team needs to run the site.

Where Inclind fits

Inclind has built and supported Drupal sites for utilities for over ten years. Delaware Electric Cooperative has partnered with us through four website evolutions and ongoing support for the Beat the Peak app. That experience shapes how we approach every utility project.

If your Drupal 7 site is still running, start with a technical audit. Contact us to schedule one. You'll get a clear view of your site before you commit to anything.