Research · October 2026

Drupal end of life in US colleges and local government

On 17–18 October 2026 we checked the public homepage of every active degree-granting US college (4,059) and every city, county and district on the federal .gov list (13,096 domains). Here is what they run, and how much of it is about to lose security support.

Key findings

59% of US colleges on Drupal run a version that is out of support or ends support on 9 December 2026: 282 of the 481 where the version is visible.
More colleges run Drupal 10 (254) than Drupal 11 (199). Drupal 10's security fixes end on 9 December 2026, the same week Drupal 12 is due.
28 colleges are already past end of life on Drupal 7, 8 or 9.
In local government, more websites run Drupal 7 (64) than Drupal 11 (60). Drupal 7's security support ended on 5 January 2025.
39% of city, county and district Drupal sites with a visible version are already out of support (72 of 186).
Colleges of every size are behind. In each size band, between 53% and 63% of Drupal colleges are not yet on Drupal 11; the highest share is among colleges with fewer than 1,000 students.

Colleges

Of 4,059 active degree-granting colleges in the federal college directory (IPEDS 2024), 3,420 homepages answered our check. 509 run Drupal (435 separate websites, because some campuses share one site). 1,404 run WordPress.

Colleges on Drupal, by version
Version	Colleges	Separate websites	Security fixes
Drupal 7	11	11	Ended
Drupal 8	6	6	Ended
Drupal 9	11	11	Ended
Drupal 10	254	206	End 9 Dec 2026
Drupal 11	199	174	Supported
Version hidden	28	–	Unknown

Colleges on Drupal with a visible version, by number of students
Students	Drupal 10 or older	Drupal 11	Share not yet on 11
<1,000	60	35	63%
1,000-4,999	112	85	57%
5,000-9,999	51	32	61%
10,000-19,999	25	22	53%
20,000+	24	20	55%

Colleges on Drupal with a visible version, by type
Type	Drupal 10 or older	Drupal 11
Private nonprofit 4-year	111	82
Public 4-year	87	63
Public 2-year	45	26
Private for-profit 4-year	19	6
Private for-profit 2-year	10	14
System or administrative offices	10	5
Private nonprofit 2-year	0	3

Cities, counties and districts

The federal .gov domain list (published by CISA) has 13,096 city, county, special-district and school-district domains. 8,083 answered; many of the rest are unused or redirect-only domains. 269 run Drupal (259 separate websites). 1,995 run WordPress.

Local-government websites on Drupal, by version and type (separate websites)
Version	City	County	Special district	All
Drupal 7	51	7	7	64
Drupal 8	2	1	1	4
Drupal 9	3	1	0	4
Drupal 10	32	24	2	54
Drupal 11	41	16	6	60
Version hidden	–			75

Counts by type are per domain; the "All" column counts separate websites, so the columns may not add up exactly.

How we measured

Lists: colleges from the U.S. Department of Education's IPEDS 2024 directory (active, degree-granting); local governments from CISA's public list of .gov domains (city, county, special district and school district).
One request per homepage, sent with a user agent that named itself as a version check. No logging in, no crawling beyond redirects, no vulnerability scanning.
Detection: the version Drupal announces in its page header (X-Generator) or generator tag, with Drupal 7's settings code as a fallback. Sites that hide the version are counted as "version hidden".
Accuracy check: we re-checked 24 randomly chosen results a second time; all 24 matched. One false result (a town domain that redirected to a third-party police site) was removed.

Limits

Homepages only. Many colleges run departmental sites on separate Drupal installations, so the real number of affected sites is higher.
639 colleges couldn't be checked: almost all of their homepages didn't answer, mostly because they block automated requests, and one lists no website. Governments that don't use a .gov domain aren't in the local-government list.
The header shows the major version only. A site on Drupal 10 may already have an upgrade planned.

What we don't publish, and why

We publish totals only. A list naming which institutions run unsupported software would help attackers more than it helps anyone else, so we won't publish one. If you'd like to know about your own site, use the checker below or ask for a free site check.

Drupal security support dates

Drupal security support end dates
Version	Security support
Drupal 7	Ended 5 January 2025
Drupal 8	Ended 2 November 2021
Drupal 9	Ended 1 November 2023
Drupal 10	Ends 9 December 2026
Drupal 11	Supported (Drupal 12 only upgrades from 11.3 or later)

Dates from the Drupal project's release schedule.