I have Drupal CMS and I need to protect it from sensitive data leak, which are the customer names, addresses, the payments and order information.

I am new to Drupal, so my question is, is it possible to run each module in separate security context, so if one module gets exploited, the other data is not compromised? Is Drupal OOP based? Has drupal administration separated from the frontend? Would be these two achievable at all? I saw the LDAP module, which helps, but it doesnt help with the customer data...

  • Where are you storing the sensitive data you want to protect?
    – greggles
    Jun 23, 2012 at 13:33

1 Answer 1


You should read the official security thread, if you want to go further I advice you to take a look at the cracking Drupal book. In chapter 1, which is available for free download, you will get an idea of the places to look at.

According to this book, most common vulnerabilities found in Drupal sites are :

    Vulnerability   | occurences as a percentage of the total

     XSS            |      44  
     Access bypass  |      14
     CSRF           |      10
     SQL injection  |      10
     Code execution |      8

So you shouldn't be concerned by Drupal architecture but with the way you implement your website, like any other. For instance, requiring administrator approval for users registration, making sure forms are safe and applying Drupal's updates should be a good start.

Also, if you choose to use the LDAP module for Drupal 7, keep an eye on its security related issues.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.