I have few websites running Drupal 7 and i upgraded them all on 16th October 2014.

Since 3 days we are monitoring the websites and we haven't seen any problem or evidence of our system being compromised.

I am wondering if there is anyway to identify if a Drupal 7 sites has been compromised?

It will be really helpful if we all post our views, any evidence of system being compromised and any action that could be helpful to make sure we are secure.


Someone recently came out with a module that should help in this, assuming you have installed drush. It is called Drupalgeddon

Here is an example of its use:

$ drush -y @sites drupalgeddon-test
You are about to execute 'drupalgeddon-test' non-interactively (--yes forced) on all of the following targets:
sites.abcd-d6.example.org       >> Site is not Drupal 7.                     [ok]
sites.abcde.example.org         >> Site did not test positive. Good luck!    [ok]
sites.abcdef.example.org        >> Site did not test positive. Good luck!    [ok]
sites.abcdefg.example.org       >> Site did not test positive. Good luck!    [ok]

Also note:

Drupalgeddon cannot guarantee a website has not been compromised.


Not the answer you're looking for? Browse other questions tagged or ask your own question.