I have some old sites running "dead" versions of modules in my drupal (I made the upgrade to the last current Drupal core version).

But some of the modules used in this site are not longer supported or they need a "major" upgrade. This will break my site for sure, because some of them are used.

What do you think it's the best approach to fix this ? Because this represents a serious risk for the security of the website.

2 Answers 2


Major upgrades of modules should not be a problem if the module is still supported. Just do drush up moduleshortname in the CLI (or replace the old code in the module directory with the new if you don't have drush). Updating a module is integrated in Drupal. If you do this manually (drush will do it automatically) just make sure you run Update on your site after updating the module (Update is linked to on Reports->Status Report page if you need to run it). Update should take of all incremental updates of the module, its schema, and the data in the schema, automatically. Unless there are a bug in the code to update the module, there should be no data loss.

Modules that are no longer supported, especially if they're unsupported because they have security vulnerabilities the maintainer did not fix, are a problem.

The first thing to do is to review the unsupported module and the features it brings to your site. Is this features your site cannot live without? If the answer is "no", just disable and uninstall it.

If the unsupported module provides functionality you need, try to find some supported replacement for each unsupported module. If you find a replacement, you need to migrate all data from the old unsupported module to the new one. If you're not a developer, you may need to hire a consultant to help you with migration.

If you don't find a replacement, and you are a developer, you may consider fixing the insecure module. If you follow the process for dealing with unsupported projects, and work with the security team, you should be able to fix the problem. The security team is a helpful bunch and may provide some guidance.

As a last resort, you may hire a consultant to fix an insecure module you absolutely need, forking the result as a custom module for your site.

As already described by Darvanen, you need to do all this on a development server first and only repeat the procedure on your production server when you're sure the update did not damage anything. And make a backup before you start, just in case.


It sounds like you don't have a development copy of your site...

  1. Always have a development copy of your site where you can try things out. VirtualBox is a very good tool to generate your development environment, using Ubuntu and Lazy Dubuntu or a direct mirror of your production environment (for instance, the web host I use only supports CentOS instances).

  2. Before you start each upgrade procedure, take a snapshot of your virtual server, it can be rolled back quite easily and means you don't have to start from scratch if you break things.

  3. Upgrade the modules one by one, starting with the one you feel is least secure.

Note that a vulnerability in core won't necessarily be replicated in modules, so if they're relatively simple and no longer maintained, they could well be safe. If you're concerned, look at their code and think about what they do: if they require user input make sure any database writes are properly parsed; if they connect to an external service ensure that they're still following best practice.

I'm sure there's plenty more to be said on this topic but this is a start.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.