Drupal Security - Best Practices Advisories

Drupal gives you control over who and what can do on your website. You can create different user roles and give them various permissions. This way, you make sure that everyone only sees and does what they need to. Drupal has a powerful system of roles and permissions to help you with that.

Drupal lets you encrypt your data in the database, so no one can snoop on it.

For example, you can use the Field Encryption module to encrypt specific fields in the database. You can also use encrypted connections to the database server, like SSL/TLS for MySQL and PostgreSQL.

This CMS has a dedicated security team that keeps an eye on the platform for any security issues and works with the community to fix them. They publish security advisories on various Drupal channels (in the tips section below you can find Drupal security advisories).

Drupal 8 brought in a cool feature called the Automatic Updates module, which updates your Drupal core and contrib modules automatically. When there are new security releases, the module checks for updates, downloads, and applies them. It works with GitHub to make sure that the packages are safe and verified before they go live on your website.

Drupal uses a mix of input data filtering and output data encoding to stop hackers from injecting harmful code into your website (like cross-site scripting attacks or XSS). Moreover, with Drupal 8 we got the Twig template engine, which encodes variables automatically to reduce the chance of XSS problems.

Drupal’s caching system can make your website faster and handle more traffic. Drupal has various built-in features that help you deal with DoS attacks. For example, the Flood Control module lets you set limits on login attempts and password reset requests, protecting your website from brute-force attacks.

The Drupal security team is always on the lookout for potential security weaknesses in the platform. When they find them, they work with module developers to create and release patches. They often update the platform before hackers even know about these weaknesses, minimizing the damage.

Updating your software regularly is the key to security for any software, and Drupal is no different. As the CMS makers say:

“Drupal has over 29,000 projects that are checked by users for possible issues. For more details, read about security risk levels.

The security advisory also tells you when a potential problem is found and fixed. It’s very rare for a security issue to be exploited before a security advisory is published.

So, the most important thing is to update Drupal whenever there is a security advisory for the Drupal core or any external software you use”.

To keep up with updates and security advisories, you need to know about them. To do that, it’s good to check some useful sources:

• Security Advisories: Official announcements and alerts from the Drupal Security Team.
• Drupal Security: Official announcements and alerts from the Drupal Security Team.
• Feed RSS: Core, contrib, public service announcements. If you have found a security issue and want to report it, you can find detailed instructions in this article.

While the Drupal CMS makers always care about security at the core level, they don’t have direct control over other modules.

As we said before, you can also learn from the same article that:

„Profesjonalne audyty bezpieczeństwa witryn Drupala ogólnie wykazały, że zdecydowana większość luk bezpieczeństwa (90% lub więcej) jest obecna w niestandardowych motywach lub modułach napisanych przez deweloperów analizowanej witryny. Kod ten nie został poddany takiemu samemu zakresowi publicznej kontroli, jak to wygląda w przypadku kodu drupal.org”.

So, if you use other modules or have made custom solutions, you need to keep them in mind.

If you want to secure your Drupal deployments, you have to get an SSL certificate. It should be one of the first steps. It's also important for SEO reasons, because Google points this out.

Of course, if you have an e-commerce site or a government/organizational website, you can't just pick any certificate. You should look for:

• 256-bit encryption
• Extended Validation (EV)
• Support for Perfect Forward Secrecy (PFS)

If you want to protect your Drupal deployments and other related projects, store your code in a version control system (VCS) like Git. This will allow you to:

• Track changes: When you apply security updates or make any changes to your Drupal website, VCS lets you see exactly what has changed. This way, you can quickly notice if an update has broken any functionality.
• Create backups and recover data: VCS keeps a history of your codebase, so you can go back to a previous version if something goes wrong.
• Detect unauthorized changes: Storing Drupal code in VCS will let you compare the live version of your website with the code stored in the version control system. If there are any differences that you didn't make, it might mean that someone hacked or accessed your website without permission.

There are many Drupal security modules that can make your life easier. Besides the ones we mentioned earlier in the article, you should also check out these ones:

• Two-factor Authentication: Two-factor verification is one of the easiest and most effective security measures for users.
• Password Policy: Since we're talking about users, you should make sure that the passwords they use are strong enough.
• CAPTCHA: CAPTCHA is an old but proven way of dealing with spambots.
• Content Access: Decide who can access and do what with different types of content in a detailed way.

Keeping up with updates, monitoring code, and using proper security modules for Drupal all take skills and time. If you feel like you can't handle these tasks, getting help from a reliable agency or software house is a good idea. They will take care of the security of your Drupal sites, so you can focus on other aspects of running your business.