Pantheon and Tag1 Consulting Provides a Lifeline for Legacy Sites

As the Drupal 7 end-of-life (EOL) date approaches in January 2025, many organizations still running on this version face a significant challenge. Migrating to newer versions of Drupal, or other platforms, is not a simple upgrade but often requires a full rebuild. To provide extended support and give organizations the additional time they need, Pantheon, a leading WebOps platform, has partnered with Tag1 Consulting to offer a Long-Term Support (LTS) solution. This partnership ensures continued security updates for Drupal 7 core and contributed modules, giving customers the ability to maintain their websites safely without the pressure of an immediate migration.

"I can't emphasize this enough, but Drupal 7 was a really successful version of Drupal, and there are still hundreds of thousands of websites running on Drupal 7. One of the reasons we felt it was important to provide support is that, if you look at the data, there are still a lot of people using Drupal 7. With only three months until its end of life, it's objectively true that many of these users are going to need more time to figure out their next steps."

In a recent conversation, Pantheon’s co-founder and Chief Strategy Officer, Josh Koenig, delves into the details of this collaboration and why it's critical for organizations still reliant on Drupal 7. He outlines the scope of support, explains Pantheon’s decision to partner with Tag1, and discusses how this LTS solution will help customers navigate the complexities of migration, offering them crucial time to evaluate their long-term plans. Koenig emphasizes that the program reflects Pantheon’s commitment to its customers, allowing them to extend the life of their Drupal 7 sites with peace of mind.

Alka Elizabeth, sub-editor of The DropTimes, sat down with Josh to explore the specifics of this initiative and what it means for the broader Drupal community.

TDT [1]: Could you provide an overview of what this new Drupal 7 Long-Term Support (LTS) collaboration between Pantheon and Tag1 Consulting encompasses?

Josh Koenig: What we're doing is enabling all of our customers to access the security patches that will be part of Tag1's extended support agreement for sites on our platform. This includes updates to Drupal 7 core as well as updates to contributed modules throughout the ecosystem. It doesn’t include coverage for people's custom code, but we can provide continued security patches for all community-supported code for at least two years.

TDT [2]: Is this extended support offering exclusive to Pantheon customers, or is it available more broadly to the Drupal community?

Josh Koenig: Yes, this is something we offer to all of our customers at no additional cost through our partnership with Tag1. There is some work being done around Drupal core updates, which will be available to everyone, but that’s more of a question for the Drupal 7 extended support group. Updates to Drupal core will come through our Drupal 7 custom upstream, which is a public GitHub repository. The patches to contributed modules will come through Tag1's extended support module, and these will be available to our customers.

TDT [3]: Will the security patches and updates you are providing for Drupal 7 be made publicly available for the broader Drupal community, or will they be exclusive to Pantheon customers?

Josh Koenig: No, we won’t be doing that. The patches to Drupal core will go through a coordinated, responsible disclosure process, and there will probably be multiple sources from which people can get those. However, the overall service of extending the life of Drupal 7, particularly for contributed modules, will be a service available to Pantheon customers but not a free service to everyone.

TDT [4]: Several organizations in the Drupal community are offering extended support for Drupal 7. What made Pantheon choose to partner with Tag1 Consulting for this initiative?

Josh Koenig: Well, we've known Tag1 Consulting for a long time. When you're building a partnership around any kind of security product, trust is a big part of the decision-making process. We've known Tag1 and worked with them for over 10 years. They have a stellar reputation within the community, and we understand the mechanisms by which they operate their program. We have a high degree of confidence that they’re a good partner for us to deliver for our customers.

We also did something similar with them for Drupal 6, though it wasn’t as big of a program because there weren’t as many sites. That prior experience working with Tag1 in a similar capacity gave us the confidence that they were the right partner to deliver something that is really important to a lot of our customers.

TDT [5]: Why was a two-year support timeline, with an end date of January 5, 2027, selected? Could you elaborate on the factors that influenced this decision, particularly in relation to supporting customer migrations?

Josh Koenig: We have to set expectations somewhere. For some customers, frankly, one year isn’t enough time. They have a substantial Drupal 7 portfolio, and they need more than a year to figure out a long-term plan for those sites. Two years seemed like a commitment we could all agree on and honor without it being a question mark.

We’ll evaluate the situation around 2026 to see if an extension is warranted, but two years felt like a reasonable amount of time. This is for people who need time to figure out their next steps. Some people, especially those not deeply plugged into the Drupal community, are only now beginning to realize that the end of life for Drupal 7 is coming. They need more time to grapple with that and plan accordingly.

TDT [6]: You mentioned the possibility of extending support beyond two years. What criteria will Pantheon use to evaluate whether an extension beyond 2027 is necessary?

Josh Koenig: Yeah, I think we’re going to evaluate the life of the project based on the need for extended support to continue. But I’m not going to say it’s definitely going to be extended. What I can say is that the commitment right now is for at least two years, with the implication that if it’s necessary, we’ll consider extending it further.

TDT [7]: Drupal 7 has been around for over a decade, and official security updates will stop by January 2025. Given that newer versions like Drupal 10 or 11 are available, what value do you see in continuing support for Drupal 7? Are there specific challenges that are preventing organizations from migrating?

Josh Koenig: Yeah, I think there are several ways in which this is valuable to customers. One is that, to be honest, there are plenty of people who are happy with their Drupal 7 site. They've invested a lot in it, kept it up to date, and kept it fresh and modern. They don’t want to change. They would prefer to continue seeing that investment pay off for as long as possible. For customers who are happy with what they have on Drupal 7, this program gives them the ability to continue benefiting from that investment for at least another two years before they have to switch to something else.

The requirement to switch to something else being such a significant investment is also why extra time is needed for many groups. Drupal 7 was the last version of Drupal without backward compatibility — in other words, there’s no easy upgrade path. To move from Drupal 7 to anything else, you have to rebuild your website. Statistically speaking, more Drupal 7 sites have moved to WordPress than to a higher version of Drupal. I’ve got a blog post coming out about that later this week, or maybe next week, but the data shows that’s a fact.

It’s not surprising because Drupal 8, 9, 10, and 11 are much more complex and powerful CMSs than Drupal 7 was. There are plenty of folks who adopted Drupal 7 that aren’t necessarily a good fit for modern Drupal. So, it takes time for people on Drupal 7 to figure out what the right next step is for them. And since moving from Drupal 7 to anything else is essentially a complete rebuild, they need time to gather resources and complete the necessary work for that project.

That’s why the two years of breathing room is so important, especially for many of our customers who are institutional in nature. These aren’t startups that can pivot quickly with a three-week sprint hackathon. They have to request a budget, which can take months, and then go through planning with a lot of stakeholders. Once the budget is approved, they need to get the resources together. It’s a slow-moving process. The extra two years really gives these customers the time they need to figure out their next steps.

TDT [8]: How does Pantheon handle the fact that Drupal 7 doesn’t natively support the latest versions of PHP? Are there patches or other solutions to help ensure compatibility with more modern environments?

Josh Koenig: That’s a good question. So, we’ve talked about what Tag1 is doing to support Drupal, the application. The other really important part of the offering is that Pantheon, as a platform, is going to maintain the surrounding runtime environment necessary for that application to run.

What we’re doing with supporting services — like PHP, the database, etc., which are necessary for Drupal to operate — is working to provide long-term support for those versions as well. We always give our customers the choice of which version they run, and we’ll maintain legacy versions of PHP on our platform if they choose to use them. This is important because there are cases where custom code is written to work only with older versions of PHP. So, customers can decide whether they want to continue running an older version or move to a more modern, long-term supported version.

Our process is that we eventually stop letting new customers choose these older versions, but behind the scenes, customers who started out on those older versions many years ago can still select them. Our policy has never been to force people to upgrade. The way our infrastructure is built is very different from Acquia, Platform, or anyone else. We can securely enable individual customers to make decisions that are right for them regarding the type of environment they want to operate in without it becoming a risk to our platform or to others.

So, we’ve never had a policy of forcing anyone into a disruptive upgrade.

TDT [9]: Given the rapid evolution of Drupal and the web ecosystem, do you believe it is sustainable for organizations to stay on Drupal 7 for an extended period, especially considering the availability of newer Drupal versions?

Josh Koenig: Yeah, I think from a risk standpoint, the extended support is important because it gives you coverage should something new and novel emerge. But candidly, the risk is already relatively low. Your point is well taken — Drupal 7 has been out there for over a decade, meaning it’s been tested by the Internet for over 10 years. There were cases where significant vulnerabilities were uncovered and had to be patched, and the community rallied around that. But after 10 years of being thoroughly prodded, probed, and attacked by every botnet and scraper the Internet has to offer, it’s not very likely that a novel security vulnerability will be suddenly uncovered at the last minute.

For risk-averse organizations that maintain high compliance standards, the assurance that they will get a patch in the unlikely event of a security issue is critical, and that's what we’re able to provide. However, Drupal 7 remains a sustainable option for those who have continued to invest in it and keep their website fresh, modern, and up to date. It’s definitely feasible to keep running it for a few more years to get the most out of that investment.

The bigger factor pushing people to change will be the lack of new feature development for Drupal 7. No new modules or capabilities are coming, and as the Internet continues to evolve, Drupal 7 sites will increasingly become outdated — not just in look and feel, but also in functionality. Eventually, people will need to make a decision around that. I think that’s what will ultimately drive even the longest holdouts to make the change.

TDT [10]: There’s been ongoing discussion in the Drupal community about making Drupal more user-friendly, especially for non-technical users with Drupal CMS. What are your thoughts on the potential of these efforts?

Josh Koenig: That’s a good question. I think the challenge of complexity isn’t easily solved. The complexity isn’t just something that makes it harder to adopt; it’s also where the flexibility and capabilities come from. So, you can’t just wave a magic wand and keep all of Drupal’s powerful, differentiating features while making it less complex. It’s a hard problem to solve.

The potential for easier accessibility to Drupal’s complex and powerful configuration capabilities via an AI assistant is really interesting. In my opinion, that’s in the sweet spot of what the current generation of AI is good at — simplifying a complex user interface and presenting it through a prompt. That has tremendous potential. The ability to then go into the underlying interface and tweak whatever the assistant implements to get exactly what you want is a pattern that can work really well.

I think it’s very exciting. What was shown in Barcelona demonstrated a lot of progress in a short amount of time since DrupalCon Portland, and the direction they’re going in is extremely interesting. I still believe Drupal’s core target is larger organizations with more sophisticated teams working on ambitious projects, and that’s not a bad thing. In fact, it’s what makes Drupal special and different. But, by definition, that’s a smaller part of the market.

There are plenty of people who adopted Drupal 7 for very simple websites, and I’m not sure if those users will choose Drupal CMS again, because it might frankly be overkill for them.

TDT [11]: As Pantheon customers prepare for this long-term support, is there anything specific they need to do to ensure continued security and functionality for their Drupal 7 sites?

Josh Koenig: That’s the great thing — they don’t need to do much at all. The only caveat with the long-term support is that their Drupal 7 site needs to be up to date. Some sites haven’t been well-maintained or looked at for years, and if those users want to take advantage of the program, they’ll need to update their Drupal 7 site to the final release from the Drupal community in order to receive the ongoing support we provide through our partnership with Tag1.

For most customers, though, that’s the beauty of it — it doesn’t change their current workflow. They just keep doing what they’re doing and will continue to get that support. We’ll also be accepting new customers throughout 2025, but at a certain point, we’ll have to put a stop to that, since this isn’t an indefinite commitment. However, for the next year, we’ll be bringing in new customers.

If they can migrate their site to Pantheon—which usually isn’t a difficult process from wherever they are now—and ensure it's up to date with the latest version of Drupal 7 released by the community, they’ll be able to receive ongoing support through our service at no additional cost.

TDT [12]: Will Pantheon automate the application of security patches and updates for contributed modules, or is there any manual intervention required on the customer side?

Josh Koenig: Tag1 provides the patches. They have a service that anyone can subscribe to, but we’ve partnered with them to offer it to all our customers at no additional cost.

TDT [13]: Finally, could you briefly touch on the migration support options Pantheon offers for customers looking to move from Drupal 7 to newer versions, or even other platforms?

Josh Koenig: We ourselves don’t directly offer those services. Pantheon doesn't provide much in the way of professional services because, again, migrating from Drupal 7 to a higher version is essentially a website rewrite. It’s not a simple migration. Anyone who claims it's an easy process is likely either thinking in a very limited context or overselling what they provide. It's a full rebuild of your website in a modern version of Drupal, followed by migrating your content over.

We have a large network of agency partners who specialize in these projects. Some of them have developed specialized solutions. For instance, some have a well-tested Drupal 10 “recipe” that’s very effective at migrating Drupal 7 sites. Others focus on migrating Drupal 7 sites to WordPress, which, for many customers, is often a better fit. Then there are clients who want their Drupal 7 site to stay as-is, so they migrate it to a static site, which is also a valid option.

We’re here to facilitate all of these pathways, though we don't do the actual work ourselves. It's our extended partner network that handles the heavy lifting. However, we’re happy to facilitate those introductions, which is something we really enjoy doing.

I just want to emphasize that Drupal 7 was a very successful version, and there are still hundreds of thousands of websites running on it. We thought it was important to provide an option for those who want more time or want to continue running Drupal 7 longer.

The DropTimes thanks Molly Gilbride, Senior Media Relations Specialist, for arranging an opportunity for this conversation.