Drupal 8/9 Security best practices

Reviewed 230531

1. Keep Drupal core and modules up to date

Always keep Drupal core and modules up to date with the latest critical updates.

It is also recommended to use only custom modules and themes from a well-known company or from Drupal.org.

2. Specify the trusted host patterns

Drupal supports trusted host patterns, where a set of regular expressions that the domain on incoming request should match. This configuration is in settings.php

$settings['trusted_host_patterns'] = [
  '^www\.example\.com$',
];

3. Backup the website

Always make backups of the website. Database and files from the host, and keep the codebase in a git repository. It’s also recommended to backup the website before updating Drupal core and modules.

4. Usernames and passwords

Do not use the conventional admin username for the site administrator. Be smart with the usernames and choose a complex password. Kalamuna has special email address that needs to be used as user 1 email.

When possible, inactivate the user 1, as this is the user with the greatest privileges and very often bypasses all Drupal security layers. Use regular users with administrator role instead, especially on already launched websites.

5. Use Drupal security modules

Login Security: improves the security options in the login operation of a Drupal site. By default, Drupal introduces only basic access control denying IP access to the full content of the site.
Flood Control: protect the login form against brute force attacks, limiting the number of failed login attempts allowed within a time period.
Password Policy: provides a way to enforce restrictions on user passwords by defining password policies.
Captcha: a challenge-response test most often placed within web forms to determine whether the user is human.
Automated Logout: provides the ability to log users out after a specified time of inactivity.
Session Limit: this allows to limit the number of simultaneous sessions per user.
Security Kit: provides Drupal with various security-hardening options. This lets you mitigate the risks of exploitation of different web application vulnerabilities.
Security Review: automates testing for many of the easy-to-make mistakes that render your site insecure.

6. Use an SSL certificate

If you are not running over an HTTPS connection, all your data, including username and passwords are sent in clear text over the internet.

7. Check file permissions

This article includes a fix-permissions.sh script that you can run that configure all files and folder permissions according to Drupal best practices.

8. Remove all unused modules

There is no reason to have unused code on your website.

9. Block access to sensitive files

Restrict the access to some important files like authorize.php, cron.php, install.php, update.php using the .htaccess for sites served via Apache.

<FilesMatch "(authorize|cron|install|upgrade)\.php">
    Order deny, allow
    deny from all
    Allow from 127.0.0.1
</FilesMatch>

10. Review all user roles and grant the minimum necessary permissions

It’s always easier to add a new permission to a user role than remove them after users are used to having access.

11. Protect Pantheon multidev environments

Setup a password for Pantheon multidev environments with password protection at all times as well as dev and test environments.

Review History

Who	When	Status

Who	When	Status

Bob	20230531	Current

Kalawiki