I set up a rule that blocks access to a specific piece of content. In fact, for simplicity's sake, I made a rule that blocks everything:

function namhost_node_access($node, $op, $account)
    return NODE_ACCESS_DENY;

The problem is, if I go to:


And browse through all the content, I still see data that I deliberately blocked. Why are these showing? Is /node some kind of view with full access to anonymous users? Is my access rule not being enforced for some other reason? Am I not understanding what the point of /node is and if I just block that path will I be fine?

Also, are there any other ways that people can access content types I've blocked? It's making me worried that I am able to access content that has been deliberately blocked.

2 Answers 2


Look at the documentation for hook_node_access, here:


The key is where it says:

Also note that this function isn't called for node listings (e.g., RSS feeds, the default home page at path 'node', a recent content block, etc.)

You probably want to check the link following that comment, i.e. the node access rights description, which got more complicated in D7 from D6.

Another thing to pay attention to is: if you're logged in as user id 1, then you won't be affected by those node access grants.

  • "RSS feeds, the default home page at path 'node', a recent content block, etc.)" is a bit vague. How can I be sure I'm not leaving anything exposed? Feb 11, 2015 at 19:09
  • 1
    You probably can't be positive, other than some testing. That's what happens with a complex, flexible system like Drupal ... [i.e. there will always be ways to expose your data].
    – Alan Dixon
    Feb 12, 2015 at 14:20
  • I understand that, but it would be nice to track those somewhere. Think I'll blog about it once I have a list of all the "holes" that need to be closed. Feb 12, 2015 at 16:52

The /node path is a default setting that was created to allow for an easy feed of content to users.

You will most likely want to set your default homepage to something other then /node

This will allow you to use a static page, a generated view or a panel.

You can update that setting at:


If you do want to leave it as the default /node but not have any items show up, you can put something like this in a custom module or your theme.

function MYTHEME_preprocess_page(&$vars) {
  if (drupal_is_front_page()) {
    // Removes message "no front page content is created".
    // Removes welcome message page title.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.