Background
Our client — a regional government agency serving over 200,000 residents — had been running a Drupal 7 platform since 2013. Over a decade, the site had grown to more than 40,000 content nodes, 12 custom content types, and 6 custom modules handling everything from permit applications to public records requests.
With Drupal 7's end of life approaching, the agency faced a hard deadline: migrate or run unsupported software on a site handling sensitive citizen data. By the time they came to us, they had a 16-week window before their compliance team would require the old site to be decommissioned.
{ the constraints }
- Hard 16-week deadline driven by internal compliance policy
- Zero tolerance for content loss — all 40,000+ nodes had to survive the migration intact
- Site could not go down during business hours — peak traffic 8am–6pm weekdays
- 6 custom Drupal 7 modules with no Drupal 10 equivalents available
- WCAG 2.1 AA accessibility compliance required at launch
- Full security review required by agency IT before go-live
The challenge
The core technical challenge wasn't moving content — Drupal's migration framework handles most of that reliably. The real challenge was the custom module layer. Over ten years, three different internal developers had built six modules that were deeply entangled with each other and with contributed modules that had no Drupal 10 equivalent.
The second major challenge was the content model. Twelve content types had evolved organically, and the field configurations included deprecated field types, inconsistent taxonomy structures, and roughly 8,000 nodes with malformed metadata from a 2016 bulk import that had never been cleaned.
"We'd been told the migration would take 6–9 months and cost twice what Sympals quoted. They delivered in 14 weeks and the site ran faster than it ever had on day one."— Director of Digital Services, Regional Government Agency
Our approach
We structured the project in five phases, with a dedicated testing environment that mirrored production from day one. Every phase had a defined rollback plan before we moved to the next.
Technical audit & risk register
Two weeks of full-site audit: cataloguing every module, mapping field types, running data quality checks on all 40,000 nodes, and building a risk register with each issue ranked by severity and migration impact.
Weeks 1–2
Drupal 10 build & custom module rewrite
We built the new Drupal 10 platform in parallel with the live D7 site. All six custom modules were rewritten as proper D10 plugins with full test coverage.
Weeks 3–9
Content migration & data normalization
Custom migration scripts to normalize malformed metadata before running Drupal's migrate module. Migration ran against a full production clone — final migration run 3 times in staging before go-live.
Weeks 7–11
Security review & accessibility audit
Submitted to the agency's IT security team for full penetration test and security review. WCAG 2.1 AA audit via axe-core and manual keyboard/screen reader testing. 14 accessibility issues resolved before launch.
Weeks 11–13
Zero-downtime cutover
DNS cutover at 11pm Sunday with a final content sync running immediately before. Blue/green deployment on AWS with automated rollback triggers. Site live and verified within 22 minutes.
Week 14
Technology used
Results
The site launched on schedule in week 14 — two weeks inside the agency's 16-week compliance deadline. All 40,072 content nodes migrated successfully with zero content loss.
Key lessons
The audit is the project. Two weeks of rigorous auditing before we wrote a single line of migration code saved us from at least four late-stage surprises.
Run the migration early and often. By the time we did the final production migration, we'd run the scripts 11 times against full data clones. The final run was boring — which is exactly what you want.
Accessibility can't be retrofitted. We baked WCAG 2.1 AA checks into the build process from week 3, running axe-core on every component as it was developed.
{ working on something similar? }
Running Drupal 7 or facing
a similar migration?
We've done this across government, enterprise, and digital agency clients. Tell us what you're working with and we'll give you an honest assessment — no commitment required.