What we keep finding on Drupal 7 sites — anyone else seeing this?
We've audited a lot of Drupal 7 sites this year.
Same things keep showing up.
Modules nobody uses but nobody removed either. They just sit there. Unmaintained. Invisible until they're not.
Integrations the original developer built in 2016 and never wrote down. Current team has no idea what connects to what. We've had to reverse-engineer CRM connections from database logs because there was no other record they existed.
Custom themes nobody wants to touch. PHPTemplate, built when the site launched, last modified when someone added a banner in 2020. The institutional knowledge of how it works left with whoever built it.
PageSpeed scores under 40 on mobile. Not because the hosting is bad. Because nobody has looked at performance since the site went live.
And no process for security advisories. Drupal published 30 in July 2026 alone. Most of these teams knew about zero of them.
The one thing the better-maintained sites have in common: someone actually runs Upgrade Status and does something with what it finds. That's it. Not complicated.
Curious what others are seeing out there. Same patterns or different?