Drupal 7 is still running 428 US government websites, across 208 federal, state and local government domains. That's as of October 2026, 21 months after Drupal 7 stopped receiving security fixes.

The federal courts account for 174 of them. The rest include the District of Columbia, the U.S. Department of State, NOAA, a national laboratory, the council of federal Inspectors General, the California Attorney General's office, Iowa's state CIO office, the Los Angeles County District Attorney, and more than 160 cities, counties and towns.

The US isn't alone. Worldwide, more than 1,600 government sites in 91 countries are still on Drupal 7. But the US list stands out for who's on it: some of the most visible institutions in public life.

If you're responsible for technology or risk in government, this is a list of public-facing systems running software the vendor community no longer patches. If you own the website's budget, in communications or at an agency, it's where your next unplanned project is waiting.

The names behind the 428 sites

The federal courts alone account for 4 in 10 of the 428 US sites. The rest are spread across DC, the states, federal agencies and more than 160 local governments.

The federal courts alone run 4 in 10 US government Drupal 7 sites. Of 428 US government sites: U.S. Courts 174; cities, counties, towns and tribes 166; state governments and agencies 30; District of Columbia 29; federal agencies and national labs 16; other courts and public authorities 13.
Drupal End of Life research, October 2026 · US government bodies (428 sites)

The federal courts: 174 sites. On uscourts.gov, Drupal 7 turns up across the federal judiciary: 62 bankruptcy courts, 52 district courts, 50 probation and pretrial services offices, and appellate sites including the Tenth Circuit Court of Appeals, the Court of Federal Claims and the Court of International Trade. Every court site we could check live, including the Tenth Circuit, the Southern District of New York Bankruptcy Court, the District of Arizona and the Court of Federal Claims, still reports Drupal 7. So does the Federal Judicial Center (fjc.gov).

The District of Columbia: 29 sites. DC is partway through moving its sites to Drupal 10, and the newer platform now runs much of dc.gov. But we confirmed Drupal 7 still running on 29 DC sites, including the Office of Special Education, the Metropolitan Police Department's recruiting site, the Rental Act site and the Mayor's Office of Community Affairs. Eighteen of the 29 are staging and development copies (more on those below).

State governments. Confirmed examples include the California Attorney General's office (oag.ca.gov), Washington's state HR site, salary database and Sentencing Guidelines Commission, the Texas Real Estate Commission and Funeral Service Commission, and the Iowa Office of the Chief Information Officer.

Federal agencies. The list includes three State Department sites (EducationUSA, Exchanges and Study Abroad), NOAA's Tsunami Program and its EcoFOCI research program, a Lawrence Berkeley National Laboratory site, and IGnet, the shared site of the federal Inspectors General.

Cities, counties and towns. 166 local government sites are on the list. Confirmed examples include the Los Angeles County District Attorney (da.lacounty.gov), Sussex County, Delaware, Pocomoke City, Maryland, and the Chitimacha Tribe of Louisiana.

Where it hides: subdomains and staging sites

In the US, 57% of government Drupal 7 sites are subdomains, not main websites. Worldwide it's 17%, because most local governments abroad run one site each on their own domain.

Every federal court and DC Drupal 7 site is a subdomain. Subdomain share: all government sites worldwide 17% (272 of 1,606); all US government sites 57% (242 of 428); U.S. Courts 100% (174 of 174); District of Columbia 100% (29 of 29); all other US government sites 17% (39 of 225).
Drupal End of Life research, October 2026 · government bodies only

Every federal court site and every DC site on the list is a subdomain. That's the pattern we saw in higher education. The main website gets a redesign budget, while the office, program and campaign sites underneath it keep running whatever they were built on years ago. DC shows it clearly: the main city site has moved to Drupal 10, but dozens of sites beneath it haven't.

Some of those subdomains were never meant to be public. We found 18 DC staging and development copies running Drupal 7 on the open internet: 16 preview- sites plus development and staging copies of an air-quality site. Staging copies tend to get the least attention of all, and they often mirror production content and configuration.

Why it matters: unsupported software on public infrastructure

Drupal 7 reached end of life on January 5, 2025. Since then, the Drupal Security Team provides no support or security advisories for Drupal 7 core, contributed modules or themes. Drupal's own notice warns that Drupal 7 security issues may be disclosed publicly with no fix, that zero-day exploits may occur, and that external vulnerability scanners will flag Drupal 7 as insecure (Drupal.org).

For government, that isn't a gray area. CISA puts it first on its list of cybersecurity bad practices: "Use of unsupported (or end-of-life) software in service of Critical Infrastructure and National Critical Functions is dangerous," and "especially egregious in technologies accessible from the Internet" (CISA). Public websites are, by definition, accessible from the internet.

The federal judiciary knows the threat firsthand. In August 2025 it disclosed "escalated cyberattacks of a sophisticated and persistent nature" on its electronic case management system, and it tightened access to sensitive filings (U.S. Courts). That attack targeted a different system, not these websites. But it shows the courts are an active target, and 174 unpatched public sites on the same parent domain are 174 more places to probe.

One recent example of what Drupal 7 owners now face alone is CVE-2025-9551. In August 2025, the Drupal Security Team disclosed that the Protected Pages module, which puts pages behind a shared password, set no limit on login attempts. The fix shipped only for the modern version of the module (Drupal.org). Drupal 7 versions fall outside the Security Team's coverage, so a Drupal 7 site owner gets no review, no advisory and no patch.

Putting a number on it

The average public-sector data breach costs $2.86 million, according to IBM's Cost of a Data Breach Report 2025 as compiled by IncidentCost.com. And that's only the average. When a city or county is hit hard, the bill runs far higher:

Incident Year Reported cost
Suffolk County, NY ransomware 2022 ~$25M+
Baltimore, MD ransomware 2019 ~$18M
Atlanta, GA ransomware 2018 ~$17M
Oakland, CA ransomware 2023 $17M+
Dallas, TX ransomware 2023 $8.5M+ direct

Attackers only need one way in, and the bill afterward doesn't depend much on which door they used. In each of these cases the city refused to pay the ransom and paid for recovery instead.

Run the arithmetic on the US list alone. If one in ten of the 208 US government domains running Drupal 7 had a single average breach, the bill would be about $60 million (21 × $2.86M), before counting the outliers above.

It's a budget risk, not just a security one

CIOs and CISOs feel this first. Communications offices, digital services teams and the agencies that support them should treat it as a budget problem, because in government a website project rarely moves fast or cheap.

There is no simple upgrade from Drupal 7. Drupal's documentation says an update "can't simply be applied to an existing Drupal 6/7 site." Content must be migrated into a brand-new Drupal 10 or 11 site, themes "must be rebuilt," and many contributed modules need custom migration work (Drupal.org). Before any of that comes discovery: is Drupal still the right platform, or is a headless CMS like Sanity, or another platform, a better fit? In government, discovery and the rebuild that follows usually mean a procurement, which means a budget cycle.

That timeline is the real exposure. If an incident or an audit finding forces the issue, nobody waits for next fiscal year. The money comes from wherever it can be found, often the communications and digital budgets that own the website. Agencies supporting these clients face the same problem from the other side: a retainer can turn into emergency remediation overnight. The agency that raises it first, with a plan and a price, gets to shape what comes next.

Beyond the US: 91 countries

The US and Nepal account for more than half of government Drupal 7 sites. Of 1,606 sites: Nepal 459, United States 428, Uganda 98, Argentina 76, Brazil 60, France 58, and 427 across 85 other countries and international bodies.
Drupal End of Life research, October 2026 · government bodies only (1,606 sites)

Outside the US, Nepal has the most government Drupal 7 sites, at 459, and the two countries together account for more than half of the worldwide total. After them come Uganda, Argentina, Brazil and France, followed by a long tail of 85 more countries and international bodies. Ten intergovernmental organizations appear, including the United Nations (6 sites) and the African Union. Moldova's central government domain, gov.md, has 19.

By level of government, local bodies dominate worldwide: 1,015 sites belong to cities, counties, municipalities and districts. Courts account for 187, national governments for 155 and state or provincial governments for 114.

Abroad, the template problem: one platform, hundreds of governments

The single largest cluster isn't in the US. 458 municipal governments in Nepal run Drupal 7 on near-identical websites that follow one naming pattern, such as balanbihulmun.gov.np and swargadwarimun.gov.np. Most were first detected in 2018 and 2019. Uganda shows the same pattern across 92 district local governments, such as namutumba.go.ug and kisoro.go.ug.

The pattern suggests a shared national template, rolled out once and inherited by every municipality. That was efficient to build, and it concentrates the risk. When every site runs the same unsupported code, one disclosed vulnerability is a vulnerability in all of them at once. Hundreds of local governments then wait on one central team to fix it, or on nobody.

If you see your agency here, you're far from alone

If you're reading this and thinking "that's us," the good news is that you are far from alone. Federal courts, state agencies, county offices and small towns across the US are in the same position, along with more than 1,300 government domains worldwide.

The fastest win is often decommissioning. Old campaign sites, archived administrations, finished programs and staging copies don't need to be live. Archiving them as static pages or taking them down removes the risk outright.

It also pays to look past Drupal 7 itself. A site this far behind on its core platform usually has other cleanup waiting: outdated modules and libraries, abandoned forms, broken redirects, and leftover scripts and tracking tags. Clearing those out makes the site less vulnerable, and usually faster and more accessible for the residents who depend on it.

For the sites that still matter, the question becomes where they should live next.

Let's talk. Whether it's getting to the latest version of Drupal, finding a different CMS that fits how your teams actually work, or taking on an overall site cleanup, that's a discussion we'd love to have with you. Start the conversation.

Start the conversation

Share your agency's website and a bit about where you are. We'll check your Drupal footprint, flag the sites most at risk, and talk through options: upgrading Drupal, choosing a different CMS, or a site cleanup. No obligation.

We'll email you back and may follow up if we spot significant issues worth fixing. No spam.

Methodology and sources

Data. This research started from tens of thousands of live websites identified as running Drupal 7 worldwide. Government sites were then identified by hand: every domain on a government extension (.gov, .mil, .int, .gov.xx, .gob.xx, .gouv.xx, US state and local .us and similar), and every domain whose name or owner suggested a public body, was reviewed one by one. Public universities, schools, hospitals, political parties, nonprofits and contractors were excluded. Sites showing signs of Drupal 8, 9, 10 or 11 were removed. Every DC site, plus a sample of other US sites, was then checked against its live site in October 2026, and any site confirmed to have moved off Drupal 7 was removed.

Definitions. A site is one detected domain or subdomain. A government domain is the registered domain it belongs to, such as dc.gov. A main domain is a site whose address is the registered domain itself.

Caveats. Every US agency named in this article was confirmed running Drupal 7 when we checked its live site in October 2026. The wider counts rest on technology detection, which reads a site's public pages and can lag a migration, so some sites counted here may have moved since. Treat the totals as a strong indicator, not an audit of any one agency.

Sources