Keep your Drupal 7 site running on a supported PHP version
Drupal 7 reached end of life in January 2025, but rebuilding a site on Drupal 10 or 11 is a big project, and plenty of Drupal 7 sites still do their job. When your host retires your PHP version, I upgrade Drupal 7 core, your contributed modules and your custom code to PHP 8.3 or 8.4 for a fixed price. Then I prove it works by clicking through your real site, before and after.
Book a $300 Upgrade Check-up See how it worksFixed prices. Work happens on a copy of your site, never on your live site.
Where Drupal 7 stands
Drupal.org says Drupal 7 security support ended on January 5, 2025, and that Drupal 7 "will no longer receive security updates or compatibility updates." The last official release is 7.103, from December 4, 2024.
Drupal.org's PHP requirements for Drupal 7 list PHP 8.1 as supported from 7.92, PHP 8.2 from 7.94 and PHP 8.3 from 7.103. For PHP 8.4 the answer is "No, will not get support."
Drupal.org lists two certified extended security support vendors for Drupal 7: HeroDevs and Tag1 Consulting. Tag1 has publicly released Drupal 7 core updates after 7.103 that add PHP 8.4 compatibility.
So there are two realistic targets. PHP 8.3 on the official 7.103 core, which gets PHP security fixes until December 31, 2027. Or PHP 8.4 on an extended-support core, covered until December 31, 2028. The Check-up recommends one, based on how long you plan to keep the site.
Sources: the Drupal 7 End of Life page and "PHP requirements for Drupal 7" on drupal.org, the Drupal 7 changelog, Tag1 Consulting's announcement of its Drupal 7 core release, and php.net's Supported Versions page. Checked October 31, 2026.
What breaks when a Drupal 7 site moves to PHP 8
These are the problems I look for in every Drupal 7 upgrade. Core is usually the easy part. Most of the work is in contributed modules that stopped getting releases, custom modules and the theme.
| What you see | Why it happens | From PHP |
|---|---|---|
| A white screen or a fatal error right after the PHP switch | Drupal 7 core only got initial PHP 8 support in 7.79, and needs 7.92 for PHP 8.1, 7.94 for 8.2 and 7.103 for 8.3. A site that skipped core updates breaks immediately. | 8.0+ |
| Fatal errors from contributed or custom modules | Older module code uses each(), create_function() or string offsets like $str{0}, all removed in PHP 8.0. Many modules fixed this in later Drupal 7 releases. Abandoned ones never will. | 8.0 |
| One page, form or View crashes with a TypeError | Built-in functions now throw a TypeError on the wrong argument type, like count(null) in a theme's preprocess function. These depend on your content, so scanners usually miss them. | 8.0 |
| Something quietly behaves differently, with no error | PHP 8 changed how strings are compared with numbers: "abc" == 0 used to be true and is now false. Code that relied on the old rule keeps running but takes a different path. | 8.0 |
| "Deprecated function" messages everywhere, and a database log that keeps growing | PHP 8.1 deprecates passing null to string functions, and 8.2 deprecates dynamic properties. Drupal can show these messages on screen and, with Database logging turned on, writes every one of them to the database. | 8.1 / 8.2 |
| Problems on PHP 8.4 that official core will never fix | PHP 8.4 deprecates implicitly nullable parameter types and moves a few extensions, such as IMAP, out of core. Official Drupal 7 won't support 8.4, so 8.4 needs an extended-support core plus module fixes. | 8.4 |
How I upgrade a Drupal 7 site
- Take inventory first. Your core version, every contributed module and its version, your custom modules and theme, and any patches someone applied to core or modules over the years, so none of them gets lost.
- Bring core up to date. To 7.103 for PHP 8.3, or to an extended-support core for PHP 8.4, whichever we picked in the Check-up.
- Update contributed modules before fixing them. Many modules shipped PHP 8 fixes in their last Drupal 7 releases, and updating is cheaper and safer than patching. Modules that never got a fix are patched, with every change documented, or replaced if we agree to.
- Fix your own modules and theme. Automated rewrites (Rector) where they are safe, hand-written fixes where tools fail on older code.
- Run the site and click through it. With error reporting at maximum and the database log watched, I walk through logging in, editing and publishing content, your Views and forms, search, file uploads, cron and the admin screens. I record every error and fix them until the tested flows show zero PHP errors.
- Hand over a deployment and rollback plan. You or your host deploy using my step-by-step plan, with a fresh backup taken first.
Stay on Drupal 7, or move on?
Stay on Drupal 7, on PHP 8.3 or 8.4
What the fixed-scope upgrade does. Your content, modules and theme stay the same, and the site runs on a PHP version that still gets security fixes.
Add extended security support
Upgrading PHP doesn't bring back Drupal 7 security advisories. If the site handles sensitive data, consider a subscription from HeroDevs or Tag1 Consulting. You buy it from them directly; I don't resell it.
Move to Drupal 10 or 11
Modern Drupal is a different codebase, so moving means rebuilding the theme and custom modules and migrating content. It is not part of the upgrade price. If you want it, it's quoted as its own project.
What a Drupal 7 upgrade with me looks like
I haven't published a Drupal 7 upgrade. What I have published are three practice upgrades of real open-source PHP projects: a CodeIgniter 3 booking app, a custom membership system and a WooCommerce plugin, each with before-and-after error counts. Every Drupal project follows the same method: a recorded click-through before the upgrade, the same click-through after it, and a list of what was tested and what wasn't.
See the practice upgradesPricing for Drupal 7 sites
Drupal 7 sites vary too much in modules and custom code for one fixed price, so every site upgrade gets a fixed quote after the Check-up.
Upgrade Check-up
- Inventory of core, contributed and custom modules, and applied patches
- Static scan of your custom modules and theme
- Dynamic property check (PHP 8.2+)
- One runtime smoke test of your key flows on the target PHP version
- Written issue list, a PHP 8.3 or 8.4 recommendation and a fixed-price quote
- Full $300 credited if you order the upgrade within 30 days
Requires a working copy you provide. No working copy? Add environment setup for $150 (adds 3 days).
Book the Check-upSite upgrade
- Drupal 7 core brought up to date
- Contributed modules updated, patched or replaced as agreed
- Custom modules and theme fixed for PHP 8.3 or 8.4
- Before-and-after smoke test report
- Deployment and rollback plan
- 14 days of free fixes on tested flows
No surprise invoices. Anything outside the agreed scope is quoted before I touch it.
Start with a Check-upMaintenance
- Monthly security update check for PHP and your dependencies
- Smoke test re-run after your host changes PHP versions
- Up to 2 hours of small fixes per month (unused hours don't roll over)
Quoted separately
These often come up during a Drupal 7 upgrade but are separate jobs, so they never hide inside a fixed price:
- Moving to Drupal 10, Drupal 11 or another CMS
- Rebuilding an abandoned module's features from scratch
- Front-end updates, such as newer jQuery versions or a theme redesign
- Writing new automated tests
- Hands-on deployment and go-live support
Extended security support for Drupal 7 is sold by its vendors directly. I'm not affiliated with them and don't resell it. Delivery times count from the day I receive your working copy and answers to the intake questions. Full details on the main pricing page.
Want a first look yourself?
Two pages in your Drupal admin already tell you a lot. Reports, then Status report shows your Drupal core version and the PHP version your site runs on. Modules lists every enabled module with its version. If core is older than 7.103, or most modules haven't been updated in years, expect the upgrade to start with updates rather than fixes.
My free scanner, Refit, doesn't read Drupal's .module and .install files yet, so on a Drupal site it would only see part of the code. For Drupal, the Check-up is the way to get the full picture.
Questions
Do I have to move to Drupal 10 or 11?
No. The fixed-scope upgrade keeps your site on Drupal 7 and gets it running cleanly on PHP 8.3 or 8.4. Moving to modern Drupal is a rebuild, and it's quoted separately if you want it.
Does upgrading PHP make Drupal 7 secure again?
Not by itself. It removes one problem: an unsupported PHP version under your site. Drupal 7 core and its modules no longer get official security advisories. If the site handles sensitive data, an extended security support subscription from HeroDevs or Tag1 Consulting covers that part.
PHP 8.3 or PHP 8.4?
PHP 8.3 runs on the official 7.103 core and gets security fixes until December 31, 2027. PHP 8.4 lasts a year longer, until December 31, 2028, but official Drupal 7 won't support it, so it needs an extended-support core. If you plan to replace the site within a year or two, 8.3 is often enough.
What about modules that nobody maintains anymore?
For each one, the Check-up says whether a later Drupal 7 release already fixes it, whether it can be patched, or whether it should be replaced. Every patch I write is documented so it isn't lost on the next update.
What do you need from me for the Check-up?
A working copy: a staging site, or your code, a database export and ideally the files folder (usually sites/default/files). It helps to tell me your current PHP version and the flows that matter most, such as member logins, forms, events or a shop.
Do you need access to my live site?
No. All work happens on a copy, and by default I don't deploy, so I never need production access. You get the upgraded code and a step-by-step deployment and rollback plan.
My database has member or customer data. How do you handle it?
Where possible, send a copy with personal data removed or replaced. Any copy I receive stays private and is deleted when the project ends. If your system holds health or payment card data, tell me before sending anything so we can agree on a safe approach.
Will the upgrade catch every bug?
No one can promise that. The smoke test covers the flows we agree on in the Check-up. I list what was tested and what wasn't, so you know exactly where the coverage stops.
Who are you?
I'm Bo Zeng, a PHP developer with 18 years of experience. I run QiYuan Labs LLC, a US company registered in Wyoming, and work remotely. Email hello@qiyuanlabs.ai with any question before you book.
Find out what your Drupal 7 site needs before your host decides for you
The Check-up costs $300 and tells you exactly what an upgrade involves and what it will cost.
Book a $300 Upgrade Check-up