I can't access my website. I guess it has been hacked. Some drupaldev user is already been created and is in admin list. I have blocked that user multiple times, but it reappears again and again in my admin panel list. My site has also faced spamming, which i stopped by disabling registration module. But i believe its too late now.

How can i prevent letting this user access my website? What have i missed in my security constraints? Please help.

Drupal Version : 7.17

  • "What have i missed in my security constraints?" No way to tell what you're missing, unless you tell us what tehy are. Also: What versions are you running, what contrib have you installed, and are you running any custom modules? Commented Nov 29, 2014 at 7:25
  • I wish i could answer that question, then certainly i would have started fixing them instead of wasting time in here to put that question. Yes i am using 2 custom modules to meet some of my requirements. There are many contrib modules installed which are successfully running on thousands of sites. Commented Nov 29, 2014 at 7:35
  • If you can guide me, what could i have done possibly wrong keeping in mind your experience, and security breaches you have seen..that will be helpful.. Commented Nov 29, 2014 at 7:37

1 Answer 1


What have i missed in my security constraints?

I looks like you're running an outdated version of Drupal (ver. 7.17) with many severe security issues including the one known as "Drupageddon" (fixed in ver. 7.32).

First, you must start reading up on the Drupal Security advisories, in particular SA-CORE-2014-005 - Drupal core - SQL injection, PSA-2014-003 and FAQ on SA-CORE-2014-005 - they will tell you what you've missed regarding Drupageddon. This flowchart is a great resource.

To get back the control over your site, you should simply delete it, and start recreating it from scratch on a different server, since the attacker may have a root kit on your present server. Change the password of the db-user that Drupal uses, and the passwords of all privileged accounts. If you want to keep your content, roll it back from a backup created before Oct. 15 (you have backups, don't you?).

If you don't have backups, there are some tools (including a Drush command named Drupalgeddon) that may be use for forensics and part clean-up of an compromised site. I do not recommend that you use these tools, as there is no guarantee that they'll able to find all infected areas on your site and web server. But they're the last resort, if scrapping the site and starting over is not an option.

You should also start reading up an all Drupal SAs. Or even better, subscribe to them: Log in on Drupal.org, go to your user profile page and subscribe to the Drupal security newsletter on the Edit » My newsletters tab.

Contributed modules frequently have security flaws. These are eventually fixed, but the fix also tells all the bad guys how to exploit unfixed sites. That means that to keep your site secure, you must make sure you install security updates in a timely manner. That's why subscribing to the security newsletter is so important.

Custom modules made by inexperienced programmers is a huge risk. If you use custom modules, make sure you have their code reviewed by someone experienced in security.

  • Yes there it is. My site encountered the same security issue. Bad news for me is i can't roll it back to Oct 15th back up, there has been lot of things done after this date. lots of enhancements, user engagements etc. I understand the security risk, but yes i missed newsletter part and this is what i have to pay for it now. For applying this patches i need to put my site down, which is a problem. Wondering what could be the best possible solution for me now. Commented Nov 29, 2014 at 8:15
  • My website is probably dead now. I believe all user data is stolen for sure. Commented Nov 29, 2014 at 8:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.