All posts
Legacy Modernization

Drupal 7, Magento 1 and WordPress on Old PHP: Upgrading the Websites Nobody Owns

By

October 25, 2026

6 min read

Drupal 7 reached end of life on January 5, 2025, and Magento 1 in 2020. WordPress 7.0 now requires PHP 7.4, which itself has been end-of-life since 2022. How to tell which upgrade path is realistic (in place, rebuild, or replace), and how to host the result on AWS without inheriting the same problem.

Drupal 7
Magento
WordPress
PHP
CMS
Legacy Modernization

Marketing sites and online stores are often the oldest software a company runs in public. They were built by an agency years ago, they work, and nobody inside the company owns them. They are also some of the most attacked software on the internet.

Where things stand

Platform

Status

Path

Drupal 7

End of life January 5, 2025; paid extended support from certified vendors only

Rebuild on a current Drupal (a migration, not an upgrade), or move to another CMS

Magento 1

End of life June 2020

Rebuild on Adobe Commerce or Magento Open Source 2.4, or move to a hosted platform such as Shopify

WordPress

WordPress 7.0 requires PHP 7.4 and recommends PHP 8.3

Upgrade PHP and WordPress in place; replace abandoned plugins

Want a second opinion on this for your system?

Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.

Upgrade, rebuild or replace

  • Upgrade in place when the platform supports it (WordPress, Drupal 10 to 11) and the theme and plugins are maintained.

  • Rebuild when the jump is a different architecture (Drupal 7 to 11, Magento 1 to 2). Treat it as a new site with migrated content, not an upgrade.

  • Replace when the site is mostly pages and a contact form. A static site or a hosted CMS removes the server, the PHP version and the patching entirely.

Hosting it so this does not happen again

  • Static or prerendered sites on S3 and CloudFront have nothing to patch on the server side. This site runs that way.

  • Dynamic CMSs in containers on ECS, with the PHP version pinned in a Dockerfile that is rebuilt and redeployed monthly.

  • A WAF in front of anything with a login page, with rate limits on login and XML-RPC endpoints.

  • An owner, named, with a calendar reminder to review versions every quarter.

hoolco Monthly Review

Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.

As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.