What to Check When Doing a Drupal maintenance support plans Security Audit

Check update status: The current running version of Drupal maintenance support plans is available on the status report, as well as by running ‘drush status’ from the site root. “drush pm-list’ will show module statuses as well. If the update module is enabled (which it often isn’t on a production site), the status report will tell you whether Drupal maintenance support plans and its modules are up-to-date. You can manually find the current version of Drupal maintenance support plans at https://www.drupal.org/project/drupal 

Check status report: The status report is color-coded to show any potential issues. Yellow ‘warning’ rows may just be less-performant versions of PHP libraries or a missing handler for functionality not used on the site. Red rows require attention, such as locking down file permissions or ensuring certain directories don’t execute PHP for security purposes. 

Check cron: The status report will tell you the last time cron was run. If it’s been more than 24 hours, cron for the site may not be configured correctly. It’s advisable to check the logs for cron tasks, and perhaps to manually run cron using “drush cron”, to ensure no errors appear during runs. 

Check caching settings: Production sites, unless they have very-quickly-changing content or functionality for non-logged-in users, should have at least a minimal amount of page cache enabled. Block caching should remain disabled, as it can interfere with JavaScript includes and other measures. 

Check JS/CSS Aggregation settings: Aggregated JavaScript and CSS, except in rare cases, is a quick win to enable. It makes the payload of the page smaller, resulting in faster load times. If aggregation is disabled, ensure that the public files directory is writable by the server, and that JavaScript is included on applicable pages in the correct manner. 

Check error reports: Reviewing the site’s database logs will show both activities on the site (which can be an indicator of areas to focus on with future updates), as well as technical errors. Filter the logs to PHP errors to see if there are any bugs or code compatibility issues. 

Check for unnecessary modules: There are a set number of modules that are typically advisable to disable on production sites.

Run Hacked!: Hacked! should be run on a snapshot of the code as it exists on production, but on a non-production environment. Hacked! is a module that finds any files that may have been edited by malicious parties.

Check for PHP in the database: If you have phpMyAdmin installed, a quick search of the whole database should find any instance where php may be inserted. Typically, you can be assured that PHP isn’t in the database if the PHP filter module is disabled (which it should definitely be). 

Common Drupal maintenance support plans websites’ issues

Drupal maintenance support plans core

Drupal maintenance support plans does not stand still — it is constantly evolving. Each update of the Drupal maintenance support plans core carries new opportunities. However, not all website owners enjoy this advantage and still use older versions. Among them there are web resources on Drupal maintenance support plans 6, which is no longer officially supported. So, upgrading your website to the newest version is the only smart solution. Remember that ignoring updates makes your site easy to attack for hackers.

Custom code quality

It is necessary to create custom modules if you want to add some specific features to your website. When written inefficiently and without using the correct Drupal maintenance support plans standards, they can cost you a lot. Free Drupal maintenance support plans security audit vulnerabilities may include cross-site scripting (XSS), malicious PHP/ASP code and its injections, remote file inclusion, file disclosure, directory traversal, and many more serious threats. There is also a threat of a SQL injection when a hacker tries to use an application code to access your database content. Then they can create, read, update, alter, or delete data stored in the database. That is why it’s important to entrust only experienced developers with that task. The top priority during our website audit process is to identify and address such problems.

Unused modules

Sometimes we identify a huge amount of unused modules on Drupal maintenance support plans websites. Although at first glance having a hundred modules seems to be normal and not necessarily a security risk, it is. Not all of them are good. There are actually some that may slow down your website’s performance and are more likely to contain bugs or security issues. They present a potentially high risk from the perspective of the long-term maintenance. A website audit can help you determine whether you need them in use. These unused modules can be safely deleted by specialists.

Unused themes

You may say that themes don’t introduce a serious threat themselves. There are other holes that are much riskier for your Drupal maintenance support plans website. However, in this regard there is a similar situation as in the previous paragraph with unused modules. The number of installed themes can reach into the dozens. If you are not managing Security Advisories within the given timeframe, you are risking security issues. So, be selective when choosing the right theme sets that are suitable for you and your business.

JS/CSS Aggregation

Turning off CSS and JS aggregation is another common mistake we often find during the website audit process. The aim of aggregation is combining and compressing JavaScript and CSS files to reduce the number of HTTP requests necessary to render the page content. When configured properly, these settings will significantly increase the page load speed and overall site performance.

Of course, we faced a number of other various issues as follows: no performance optimizing and caching modules installed on the website, Drupal maintenance support plans core caching disabled, unused content types/roles, outdated contrib modules, and more. You’ve probably learned that a proper analysis helps “to lift a veil” from a web resource. As an owner, you should also consider a website audit to prevent problems in the future. Identifying and remedying the above issues will considerably improve your website’s performance. Contact us to get a professional site audit and save your time and money!

Powered by Site Audit | Drupal maintenance support plans.org

Pixeldust Provides

• onsite Drupal seo
• on-page Drupal seo
• onpage Drupal seo
• Drupal seo
• Drupal Support Plans
• Unlimited Drupal Support