1

I was bothered in knowing with whatcms.org a version can be given for drupal 8, even a minor version - no minor version, instead, when I tried with a drupal 7. Curiously enough in my case, I got a version slightly newer (just one minor version ahead), but I'm concerned anyway, should I not?

I'm thinking of every situation where a security update cannot be performed right away. I don't even know how can the version be guessed from outside. I issued a tail -f on the access log while pressing the Detect CMS button on whatcms.org, but, mysteriously, I got no log entry from there. Perhaps they cache the previous results on the same site not to perform a fetch each time the button is pressed with the same domain string input?

Improve this question
6
  • 3
    This question comes up over and over again, and over and over it is the same answer: There is no security through obscurity. Why should an evil bot waste ressouces with an additional version check request, if he can right away hit the vulnerable URL?
    – Hudri
    Sep 27, 2020 at 17:51
  • If they were doing those checks, they would not even try to access a URL that is available from a site implemented in .NET in a Drupal site, or a WordPress URL in a Drupal site. As @Hudri said, they just try to gain access using a vulnerability; if they aren't able, they just pass to the next site.
    – apaderno ♦
    Sep 27, 2020 at 18:25
  • I'm sorry for the nth question on the same subject. Before posting I tried to find an answer, but I couldn't. I'm not knowledgeable about attacking practices, so I couldn't tell whether knowing a version number could be relevant to an attacker or not. Besides I'd be however curious about how version can be read from outside, even disregarding in my case I read a version slightly different from the real one. In the HTTP headers I read just, it's a drupal CMS. So I wonder where the other piece of information can be read withouth accessing the file system or the administration interface.
    – AppLEaDaY
    Sep 27, 2020 at 18:26
  • This topic is not really specific to Drupal or PHP or any CMS, this is a general principle in IT. For version guessing, there are a few of metadata (readme's, YMLs, package files...) files with versions numbers and years in it that allow version guessing.
    – Hudri
    Sep 27, 2020 at 18:39
  • 2
    You can know the exact version Drupal.org is using by looking at drupal.org/CHANGELOG.txt. For a Drupal 8 site, the relative path is slightly different: /core/CHANGELOG.txt. (Yes, the Drupal 8 version would not say anything about the exact version that is, but it still makes clear the installed version is Drupal 8. Only the Drupal 9 CHANGELOG.txt file is vague enough to make just understand the site is running Drupal.)
    – apaderno ♦
    Sep 27, 2020 at 19:57

1 Answer 1

Reset to default
0

If you want to hide the Drupal version then you can use the following module:

https://www.drupal.org/project/remove_http_headers

Improve this answer
1
  • 1
    I say don't try to hide it, be proud of running Drupal dang it!
    – No Sssweat
    Sep 28, 2020 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.