I've been using my D7 installation as a single-user blog, and operated assuming that would always be the case. In the process, I may have been sloppy with permissions in various places, such as viewing, authoring, input formats, etc.---I'm no longer sure.

Now, however, I am going to open my site to subscribers (for a mailchimp mailing list), and possibly allow another content author.

Before I undertake these, what should I go over to make sure I'm safe, and ensure my site stays secure and is well permissioned? Can someone help me construct a security checklist for all items I need to verify to move from single-user to multi-user?

2 Answers 2


Joao's suggestions are all good.

One other easy thing to do is install the security review module which can test a lot of things for you.

Read over the page at admin/people/permissions (d7) or admin/user/permissions (d6) and make sure the "authenticated" user doesn't have any surprising permissions.

  • Oh great, that does look useful. Sep 21, 2011 at 19:10

Mittenchops, here is a suggestion

  1. Create a role for the new users
  2. Guarantee that this role doesn`t have permission to use PHP Filter
  3. Check all the "administer " permissions to see if the new role is not having access to certain areas that it should not have
  4. Create a new user for you with this new role and test the site.
  5. During the process of creating the new user check if you are able to choose the role (you shouldn't be)
  6. You should also try to access pages like http://yousite.com/admin which a common user should'n have permission

I think you would be safe with this.

  • That is helpful. But it's the nitty gritty of what "access to certain areas that it should not have" that I am having trouble with. =) I take it though that PHP Filter is the most dangerous security-wise? Where is that located? Are there other pages like /admin I should also be on the lookout for? Sep 21, 2011 at 19:09
  • PHP filter is bad, but having an XSS hole is nearly as bad because someone can use XSS against you to gain more permissions and then use the PHP filter.
    – greggles
    Sep 23, 2011 at 16:51
  • @greggles Any way to make sure you don't have an XSS hole?
    – Shawn
    Oct 18, 2012 at 20:54
  • @Shawn - no guaranteed way, no. The Security Review module looks for some kinds of xss holes. You can use other kinds of automated scanners to look for them or hire someone to do a security audit of your site.
    – greggles
    Oct 29, 2012 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.