Drupal 7 is still running at 213 US colleges and universities, and on 4,646 higher education websites worldwide, spread across 813 institutions in 92 countries. We found them by researching thousands of websites, roughly 21 months after the Drupal community stopped shipping security fixes for Drupal 7.
The headline isn't the number. It's where these sites sit. Only about 1 in 9 is a main domain. The rest are subdomains: department pages, research labs, conference sites, and old program microsites that someone built, launched, and stopped watching.
If you own technology or risk at a university, this is a map of the part of your web estate that's easiest to forget and most likely to get you breached. If you already know this is you and your campus, let's start a conversation on how to get your site to a better place. If you own the website's budget, in marketing or at an agency, it's a map of where your next big, unplanned expense is hiding.
The global picture: 92 countries, one clear leader
Europe has the most institutions still on Drupal 7, but the US runs far more sites per institution. After the US, the countries with the most institution domains are India (43), France (35), the UK (34), Canada (31) and Italy (26).
How those institutions use Drupal 7 differs sharply. In India and France it's roughly one site per institution. In the UK, 34 institutions account for 472 sites. Brazil's 20 institutions run 224, and Taiwan's 15 run 180. Where the site count runs far ahead of the institution count, Drupal 7 has spread across departments and research groups rather than sitting on a single website.
The US: 213 institutions, 2,393 sites
Drupal 7 is alive and well in American higher education. It's running on 2,393 sites belonging to 213 US college and university domains: Ivy League schools, flagship state universities, medical schools, seminaries, and community and technical colleges.
The pattern is lopsided. Most institutions run just one or a handful of Drupal 7 sites, which is a manageable cleanup. But a small group of large research universities has hundreds each, scattered across departments, labs, centers, and events. One university alone accounts for more than 600. These are the estates where no single team can say for sure what's running.
Where Drupal 7 hides: the subdomains
Only about 12% of higher-ed Drupal 7 sites are a main domain. The other 88% are subdomains. In the US the split is even starker: fewer than 4% are main domains.
The main domains come in two kinds. Some are an institution's official homepage still running Drupal 7: 341 worldwide, 54 of them in the US. Others are standalone domains a university registered for a center, project or program. Those are often the most neglected sites of all, because they sit outside the main web team's view entirely.
The subdomains are the bigger problem: lab.university.edu, conference2017.university.edu, oldprogram.university.edu. A homepage migration gets a budget, a project plan, and a launch date. A department's subdomain built by a grad student in 2014 usually gets none of those. Yet it carries the university's name, often shares its login system, and to an attacker it's just as much a way in.
Why it matters: the vulnerabilities keep coming, the patches don't
Drupal 7 reached end of life on January 5, 2025, after a final extension. Since then, the Drupal Security Team provides no support or security advisories for Drupal 7 core, contributed modules, or themes (Drupal.org).
Drupal's own end-of-life notice spells out what that means. Security issues in Drupal 7 may be disclosed publicly with no fix, zero-day exploits may occur, and external vulnerability scanners will flag Drupal 7 as insecure. That last point matters to risk teams on its own: any auditor, insurer, or vendor-risk review that runs a scan of your domain will find these sites.
CVE-2025-9551 shows how this plays out. In August 2025, the Drupal Security Team disclosed a flaw in Protected Pages, a module that puts individual pages behind a shared password. The module set no limit on login attempts, so anyone who finds the URL can script guesses until the password falls. The advisory rates it moderately critical (CVSS 6.3) and ships a fix only for the modern version of the module (Drupal.org). Drupal 7 versions of the module fall outside the Security Team's coverage, so a Drupal 7 site owner gets no review, no advisory, and no patch, and has to work out alone whether they're exposed. On a campus, that pattern guards faculty resources, committee documents, and "internal only" program pages.
That's the real exposure. A single medium-severity bug on a forgotten lab subdomain doesn't sound like much. But a university with hundreds of unpatched subdomains on one shared parent domain gives an attacker hundreds of doors, and every one of them sits under your institution's name, your SSO, and often your network.
Putting a number on it
The average data breach in education costs $3.80 million, according to IBM's Cost of a Data Breach Report 2025 as compiled by IncidentCost.com. The averages hide a wide spread by institution type:
| Institution type | Typical incident cost |
|---|---|
| Community college | $0.5M – $5M |
| Small private college (under 3,000 students) | $0.5M – $5M |
| Mid-size four-year (3,000–15,000 students) | $2M – $15M |
| Large research university (15,000+ students) | $5M – $50M+ |
| University medical center | $10M – $100M+ |
The Drupal 7 footprint is heaviest exactly where those numbers are highest. The six US institutions with 100 or more Drupal 7 sites each are all research universities, the profile at the top of these ranges.
Run the arithmetic on the US list alone. If just one in ten of the 213 US institution domains running Drupal 7 suffered a single average breach, the bill would be about $80 million (21 × $3.80M). That's before the long-tail costs IncidentCost.com describes: a small college losing 15–25% of enrollment after an incident, or Lincoln College in Illinois, which closed in 2022 after a ransomware attack compounded pandemic losses. The University of California's 2021 breach through a legacy file-transfer appliance cost $25 million or more. It's a reminder that old, unloved software is a favorite way in.
It's a budget risk too, not just an IT one
Technology and risk leaders feel this first. Marketing teams, and the agencies that support them, should treat it as a budget problem, because that's where the bill tends to land.
There is no simple upgrade from Drupal 7. Drupal's own documentation is blunt: an update "can't simply be applied to an existing Drupal 6/7 site." Content has to be migrated into a brand-new Drupal 10 or 11 site, themes "must be rebuilt," and many contributed modules need manual or custom migration (Drupal.org). In practice, moving off Drupal 7 is a rebuild, and rebuilds take real money.
That money often comes before any building starts. A team that's been on Drupal 7 for a decade first has to answer a bigger question: is Drupal still the right platform? A discovery phase that weighs Drupal 11 against a headless CMS like Sanity, or another platform altogether, can be a significant budget line of its own. And it should happen before anyone commits to a rebuild.
The real risk is timing. If a breach, an audit finding, or a cyber-insurance renewal forces the issue, nobody gets to plan the budget. It gets pulled from wherever it can be found, and the website's owner, usually marketing, is the first place people look. Planned campaigns, the redesign on next year's roadmap, and the agency retainer can all be redirected to emergency remediation overnight.
For agencies, a client on Drupal 7 is a client whose budget is exposed. The agency that raises it first, with a plan and a price, is the one that gets to shape what comes next.
If this sounds like your school, you're far from alone
If you're reading this and thinking "yes, that's our school," the good news is that you are far from alone. More than 800 colleges and universities are in the same position, and the way out is well traveled.
For many institutions, the fastest win is simply decommissioning. A large share of these subdomains are old conference sites, finished grant projects, and retired programs that no longer need to be live. Archiving them as static pages or taking them down removes the risk outright.
It also pays to look past Drupal 7 itself. A site that's this far behind on its core platform usually has other cleanup waiting: outdated modules and libraries, abandoned forms, broken redirects, and leftover scripts and tracking tags. Clearing those out makes the site less vulnerable, and it often makes it noticeably faster for students and faculty too.
For the sites that still matter, the question becomes where they should live next.
Let's talk. Whether it's getting to the latest version of Drupal, finding a different CMS that fits how your teams actually work, or taking on an overall site cleanup, that's a discussion we'd love to have with you. Start the conversation.
Start the conversation
Share your school's website and a bit about where you are. We'll check your Drupal footprint, flag the sites most at risk, and talk through options: upgrading Drupal, choosing a different CMS, or a site cleanup. No obligation.
We'll email you back and may follow up if we spot significant issues worth fixing. No spam.
Methodology and sources
Data. Colleges and universities were identified by reviewing .edu and academic domains (.ac.uk, .edu.au and similar), matching against an open world-university domain list, and checking institution names one by one. K-12 schools, professional bodies, museums, and research institutes that don't grant degrees were excluded. Higher-ed system offices and consortia (36 sites) are excluded from the counts.
Definitions. A site is one detected domain or subdomain. An institution domain is the registered domain it belongs to, such as university.edu. A main domain is a site whose address is the registered domain itself. Country is inferred from the domain or the university list; 46 domains couldn't be placed.
Caveats. Technology detection reads a site's public pages, so a site can be flagged after partial migration, and some Drupal 7 sites may be missed. Treat the counts as a strong indicator, not an audit of any one institution.
Sources
- BuiltWith.com, technology detection data for websites running Drupal 7
- IncidentCost.com, Education incident cost statistics (updated July 2026; cites IBM Cost of a Data Breach Report 2025)
- Drupal.org, PSA-2023-06-07: Drupal 7 end of life
- Drupal.org, SA-CONTRIB-2025-101: Protected Pages (CVE-2025-9551) (August 2025)
- Drupal.org, Upgrading from Drupal 6 or 7: Overview