I'm working on a Drupal community site and I want to ask about these things:
How do I make a Drupal site more secure?
How do I make my site work as fast as possible when there is a lot of visitors and users on the site, and there is a lot of interaction with the database at the same time? How do I maintain the database consistent in this situation?
How do I configure Drupal to work during high server load? How do I configure my server's hardware to work during high load moments?
1 - Use captchas and spam filtering; Mollom is a good place to start. There is also info on hardening Drupal in the drupal handbook, ie. http://drupal.org/writing-secure-code.
2 - For starters, turn on the performance module that comes with Drupal.
3 - This is a big question. I have heard good things about Context HTTP Headers, a module contributed by the White House Drupal team. You can find a comparison table on Caching: Moduls that make Drupal scale.
You've asked a massive question here, which could never be fully answered in the space I have on this text box. The answer is that performance tuning is always specific to your workload and has to be customised as such. Security is also a massive topic in itself. I think the best way to answer this is to point you to some resources, because a lot of people ask these questions.
Sign up to the Drupal security mailing list. You can see the list here and you can sign up to be informed by e-mail whenever a vulnerability is discovered. You can do this by logging in at drupal.org, clicking Edit on your profile, then going to My Newsletters and checking Security announcements. Also, if you're doing any development Writing Secure Code is a must-read. You should also keep an eye on whats going on with your server's security - most Linux distributions will have an e-mail list to keep you informed about the latest security situation. I'm not even going to mention securing your server to begin with, as that's a massive discussion, not relevant to Drupal.
& 3. Obviously, turn on all of the caching options Drupal gives you in the performance section of the admin pages. The Drupal page Server tuning considerations is really excellent and will give you a lot of practical information. Also, APC is installed by a lot of Drupal developers almost immediately and can significantly improve PHP execution time. Finally, to optimise the database a good place to start is by looking at the queries your site is executing and using the MySQL describe command to see what's going on and adding index's in slow spots. More information on this here.
For a highly trafficked Drupal site, you should tune MySQL for the content that is in stored now. Whatever the version of Drupal, the MySQL layer can have its configuration computed.
You should want to convert all Drupal tables to the InnoDB Storage Engine. It eliminates table locking from all SQL statements affecting your data.
If you already have InnoDB data, and innodb_file_per_table is not enabled, you need to cleanup InnoDB by segmenting each table into its own physical tablespace. It is imperative to do decent MySQL tuning, even if you have a limited hardware. There are many scenarios for doing such InnoDB optimizations.
IMHO, you cannot plan good settings for my.cnf without knowing the amount of data to configure for. You would have to periodically load a current dataset from production into a staging environment, perform optimizations and come away with the numbers to configure in the my.cnf of the production server.
Taking all the standard precautions for web server security as read, Drupal should be very secure out of the box. The basic gist is never ever trust user input - if you stick to active contrib modules and drupal core functionality, you shouldn't need to worry about this really, but if you are coding something custom make sure any user input goes through check plain and db_query.
Massive question. Drupal has some good things out of the box, such as CSS and JS aggregation, page caching, etc. Move watchdog to use syslog instead of writing to the database. Use caching wherever appropriate. Look at Boost, Varnish, memcached, block cache. Optimise your pages using yslow recommendations . If you are getting really serious, you may want to look at moving your database server onto a different machine. This list can get really long really fast, but Khalid Bahayeldin at 2bits is an authority - in particular read this presentation for an idea of quick wins.
See number 2!
2 & 3 You can have a look at Drupalize.me video: Drupal Performance & Scalability or others Lullabots articles like Configuring Varnish for High-Availability with Multiple Web Servers
