Maximum security with Drupal

Drupal: The secure CMS for customized digital solutions

The Drupal content management system and framework is based on the PHP programming language, has a modular design, is open source and license-free. The CMS is so popular with Drupal agencies because it has a comparatively lean core and over 40,000 different models that can be used to create a wide variety of highly flexible applications.

Thanks to a very large developer community that is involved in the further development of the application, Drupal is considered to be extremely secure compared to similar systems. Security vulnerabilities are quickly found and corrected. However, a Drupal website must be maintained regularly. In this context, a reliable update service that installs all necessary security updates is particularly recommended. There are also many other points that you should consider with regard to Drupal security.

How secure is Drupal?

Whether website, blog, online store or even platforms and forums - the security of the systems and applications used is a decisive success factor for running your own online business. Drupal offers a high security standard by default. You benefit from a very large community that has a comprehensive database of Drupal knowledge. As a large number of Drupal users have a direct insight into the structure and functionality of Drupal, weaknesses and security gaps can be identified and rectified very quickly.

There are also security features such as numerous security-relevant modules or an integrated access control system. There is also the responsive and fast-acting Drupal Security Team. This security team fixes self-identified or reported security vulnerabilities with prompt security fixes. The so-called "Drupalgeddon" in 2014 and 2018, for example, showed how well this works. At that time, the team discovered a very critical security vulnerability and eliminated it within a few hours.

What are security updates?

Like other systems, Drupal is not software that does not occasionally have bugs. The big danger here is that some of these bugs can cause security vulnerabilities in modules, themes and also in the Drupal core system. As soon as any security vulnerabilities are discovered by the Drupal Security Team or otherwise become known, the CMS publishes a corresponding security update. It is mandatory to perform the security updates provided by Drupal to ensure Drupal security at all times. The CMS offers various methods to find out about upcoming and newly published security updates. For example, you can be notified of newly released security updates via email. As a preferred Drupal agency, we know that compared to other systems such as WordPress, the update process with Drupal is much more secure and reliable, as updates to individual modules interact much better. With other systems, simple updates can quickly cause problems and errors. This works much better with Drupal.

Which factors are particularly important for Drupal security in the maintenance process?

If your system is in maintenance mode, the probability of security problems increases. To minimize these, you need to take countermeasures. You should focus on the following three main factors in particular:

1. secure the configuration through strict access control

Access rights play an important role in providing the best possible protection for your site configuration. Only trustworthy users should be granted influential access. Make sure you use protective two-factor authentication or appropriately secure passwords. On the other hand, restrict access rights for less trustworthy user roles. In this way, you ensure that you do not introduce any new security vulnerabilities with your site configuration.

2. secure the code of your Drupal core version and modules

Make sure that your Drupal Core version and all modules used are working reliably and that the known security flaws have already been eliminated. This also includes a careful check of user-defined modules or themes with regard to security flaws. Various tools offer you valuable support here. The Python-based security scanner Droopescan and the online Drupal vulnerability scanner Pentest-Tools, for example, are particularly popular and highly recommended. These tools can be used to comprehensively check versions, core files, themes, plugins, configurations and special URLs (admin, changelog, readme, etc.) for security vulnerabilities. Alternatively, you can also use the tools Drupwn, Acunetix, Sqreen or Detectify.

3. secure the server

The security features relating to the server used are also particularly important. Here it is important that you use HTTPS and that all security updates relating to the operating system are downloaded. Also make sure you have the correct access rights. For example, you should make sure that executable code files cannot be changed or written by web server users. You can prevent this by blocking the permission in the configuration settings. It is also advisable to use a professional hosting service. This facilitates the security of the server and therefore also the general Drupal security.

Improve Drupal security with these simple measures

If you want to improve the security of your Drupal website, there are various measures you can take. We have listed the most important best practice solutions for you below. These serve as a guide to help you optimize Drupal security.

Limit the registration and login process

Drupal's default settings allow spam posts to be written to the database. You can prevent or at least limit this by limiting the registration and login process. You also have the option of changing the paths. Alternatively, you can disable the option completely. It is also advisable to limit the number of login attempts via the same IP address for a certain period of time.

Carefully define the role system and access rights

You must also take particular care when granting access rights. For example, PHP code should only be allowed to be edited by experienced developers. If necessary, deactivate the PHP filter completely for your website. Always keep an eye on the publishing rights for registration, user view and comments. You can restrict unwanted access to files in .htaccess. In this way, you prevent an attacker from gaining access to important files such as authorize.php, install.php, upgrade.php or cron.php, for example.

Targeted database backup

SQL attacks are almost standard. However, you can make certain forms of attack much more difficult. For example, you can replace table names with a prefix of your choice. This can be done both directly during installation and later as part of the Advanced Options. If you assign a prefix such as mr0765f_ instead of the default name, for example, you significantly reduce the likelihood of an attacker guessing this name. To implement additional protection, you should always use strong database encryption. Strong passwords can be encrypted with Drupal in conjunction with certain parameters (expiration, length, etc.).

Deactivating the error messages

Under Configuration/ Development/ Logging and Errors you can deactivate error messages via the Drupal admin interface. To do this, you must set Error Reports to None. This is important to avoid giving away important information about your system to potential attackers. Errors of type 500 in particular can otherwise potentially be used for denial of service attacks. You can also install modules such as Disable Messages. These give you the option of filtering error messages. You can select specific user groups or error types as parameters for this.

More information about our services as a Drupal agency.