Drupal 8/9 Security best practices
Reviewed 230531
1. Keep Drupal core and modules up to date
Always keep Drupal core and modules up to date with the latest critical updates.
It is also recommended to use only custom modules and themes from a well-known company or from Drupal.org.
2. Specify the trusted host patterns
Drupal supports trusted host patterns, where a set of regular expressions that the domain on incoming request should match. This configuration is in settings.php
$settings['trusted_host_patterns'] = [
'^www\.example\.com$',
];3. Backup the website
Always make backups of the website. Database and files from the host, and keep the codebase in a git repository. It’s also recommended to backup the website before updating Drupal core and modules.
4. Usernames and passwords
Do not use the conventional admin username for the site administrator. Be smart with the usernames and choose a complex password. Kalamuna has special email address that needs to be used as user 1 email.
When possible, inactivate the user 1, as this is the user with the greatest privileges and very often bypasses all Drupal security layers. Use regular users with administrator role instead, especially on already launched websites.
5. Use Drupal security modules
Login Security: improves the security options in the login operation of a Drupal site. By default, Drupal introduces only basic access control denying IP access to the full content of the site.
Flood Control: protect the login form against brute force attacks, limiting the number of failed login attempts allowed within a time period.
Password Policy: provides a way to enforce restrictions on user passwords by defining password policies.
Captcha: a challenge-response test most often placed within web forms to determine whether the user is human.
Automated Logout: provides the ability to log users out after a specified time of inactivity.
Session Limit: this allows to limit the number of simultaneous sessions per user.
Security Kit: provides Drupal with various security-hardening options. This lets you mitigate the risks of exploitation of different web application vulnerabilities.
Security Review: automates testing for many of the easy-to-make mistakes that render your site insecure.
6. Use an SSL certificate
If you are not running over an HTTPS connection, all your data, including username and passwords are sent in clear text over the internet.
7. Check file permissions
This article includes a fix-permissions.sh script that you can run that configure all files and folder permissions according to Drupal best practices.
8. Remove all unused modules
There is no reason to have unused code on your website.
9. Block access to sensitive files
Restrict the access to some important files like authorize.php, cron.php, install.php, update.php using the .htaccess for sites served via Apache.
<FilesMatch "(authorize|cron|install|upgrade)\.php">
Order deny, allow
deny from all
Allow from 127.0.0.1
</FilesMatch>10. Review all user roles and grant the minimum necessary permissions
It’s always easier to add a new permission to a user role than remove them after users are used to having access.
11. Protect Pantheon multidev environments
Setup a password for Pantheon multidev environments with password protection at all times as well as dev and test environments.
Review History
Who | When | Status |
|---|---|---|
|
|
|
Bob | 20230531 | Current |