I can't access my website. I guess it has been hacked. Some drupaldev user is already been created and is in admin list. I have blocked that user multiple times, but it reappears again and again in my admin panel list. My site has also faced spamming, which i stopped by disabling registration module. But i believe its too late now.
How can i prevent letting this user access my website? What have i missed in my security constraints? Please help.
Drupal Version : 7.17
What have i missed in my security constraints?
I looks like you're running an outdated version of Drupal (ver. 7.17) with many severe security issues including the one known as "Drupageddon" (fixed in ver. 7.32).
First, you must start reading up on the Drupal Security advisories, in particular SA-CORE-2014-005 - Drupal core - SQL injection, PSA-2014-003 and FAQ on SA-CORE-2014-005 - they will tell you what you've missed regarding Drupageddon. This flowchart is a great resource.
To get back the control over your site, you should simply delete it, and start recreating it from scratch on a different server, since the attacker may have a root kit on your present server. Change the password of the db-user that Drupal uses, and the passwords of all privileged accounts. If you want to keep your content, roll it back from a backup created before Oct. 15 (you have backups, don't you?).
If you don't have backups, there are some tools (including a Drush command named Drupalgeddon) that may be use for forensics and part clean-up of an compromised site. I do not recommend that you use these tools, as there is no guarantee that they'll able to find all infected areas on your site and web server. But they're the last resort, if scrapping the site and starting over is not an option.
You should also start reading up an all Drupal SAs. Or even better, subscribe to them: Log in on Drupal.org, go to your user profile page and subscribe to the Drupal security newsletter on the Edit » My newsletters tab.
Contributed modules frequently have security flaws. These are eventually fixed, but the fix also tells all the bad guys how to exploit unfixed sites. That means that to keep your site secure, you must make sure you install security updates in a timely manner. That's why subscribing to the security newsletter is so important.
Custom modules made by inexperienced programmers is a huge risk. If you use custom modules, make sure you have their code reviewed by someone experienced in security.
