I'm asking a outsourcing developer to modify some part of my site and then he needs the copy of my site as a test site.
My site is already working site and has users registered. What comes in mind first is deleting user table from database to protect the personal information.

And the what else I should NOT give the developer? I trust the one who works on my site of course. But in generally is there any files or database table that can be harmful if the third party obtains?


There are two places I would look:

  1. Any credentials stored in places like the settings.php file which has database credentials and potentially other sensitive information. If it's not in settings.php (e.g. some sites use settings.local.php that is included into settings.php) then just be aware of that and who has access to it. There may be other credentials stored in other .php files.
  2. Your database has a lot of potentially sensitive information in it. See this article about sanitizing the Drupal database backup for advice on what you may want to remove.

Also, if you trust them to write module or tpl files then you should trust them with your data. After all: they could make a mistake or add a back-door to the site to steal this information if they want it. I see both of the above suggestions as "best practices" regardless of who is doing the work. Everyone should remove credentials and sensitive database information prior to giving out copies of the information.


Deleting the user table might break features that rely on node authors or some other user information. Try setting every user's email to email@mail.com and their password to 'password'. You shouldn't give the settings.php file, since it has your database credentials and the cryptographic salt Drupal uses to hash users' passwords.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.