I've been using my D7 installation as a single-user blog, and operated assuming that would always be the case. In the process, I may have been sloppy with permissions in various places, such as viewing, authoring, input formats, etc.---I'm no longer sure.

Now, however, I am going to open my site to subscribers (for a mailchimp mailing list), and possibly allow another content author.

Before I undertake these, what should I go over to make sure I'm safe, and ensure my site stays secure and is well permissioned? Can someone help me construct a security checklist for all items I need to verify to move from single-user to multi-user?


Joao's suggestions are all good.

One other easy thing to do is install the security review module which can test a lot of things for you.

Read over the page at admin/people/permissions (d7) or admin/user/permissions (d6) and make sure the "authenticated" user doesn't have any surprising permissions.

  • Oh great, that does look useful. – Mittenchops Sep 21 '11 at 19:10

Mittenchops, here is a suggestion

  1. Create a role for the new users
  2. Guarantee that this role doesn`t have permission to use PHP Filter
  3. Check all the "administer " permissions to see if the new role is not having access to certain areas that it should not have
  4. Create a new user for you with this new role and test the site.
  5. During the process of creating the new user check if you are able to choose the role (you shouldn't be)
  6. You should also try to access pages like http://yousite.com/admin which a common user should'n have permission

I think you would be safe with this.

  • That is helpful. But it's the nitty gritty of what "access to certain areas that it should not have" that I am having trouble with. =) I take it though that PHP Filter is the most dangerous security-wise? Where is that located? Are there other pages like /admin I should also be on the lookout for? – Mittenchops Sep 21 '11 at 19:09
  • PHP filter is bad, but having an XSS hole is nearly as bad because someone can use XSS against you to gain more permissions and then use the PHP filter. – greggles Sep 23 '11 at 16:51
  • @greggles Any way to make sure you don't have an XSS hole? – Shawn Oct 18 '12 at 20:54
  • @Shawn - no guaranteed way, no. The Security Review module looks for some kinds of xss holes. You can use other kinds of automated scanners to look for them or hire someone to do a security audit of your site. – greggles Oct 29 '12 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.