First things first, I don't need a DDoS prevention mechanism in Drupal since that is my server's job.

In all my Drupal installs, I usually hide the identity of Drupal for security reasons. Image style token (itok) is also a Drupal identifier. I tried a hack to remove itok in 7.22, and found out itok is not a small implementation, which may need more work to get benefit from the community after hack.

I'm just wondering if there is a better way.

4 Answers 4


No need to hack, just add the following line to your settings.php file:

$conf['image_allow_insecure_derivatives'] = TRUE;    


That will stop the itok parameter from being used.

It's even been wrapped in a module if you don't fancy editing settings.php.

Image Allow Insecure Derivatives

Provides a user interface to allow Drupal to bypass the token security check when generating image derivatives.

As a side note, trying to hide your site's identity as being a 'Drupal' site is pointless. It's known in the field as 'Security through Obscurity', and it's a waste of resources that could be spent solving real security or performance issues.

See How can I obscure what I am using to run my site? for a more in-depth explanation.

  • itok is hardly a security issue, but it is huge caching and CDN issue.
    – Mołot
    Commented Jun 19, 2013 at 15:07

This problem is in the queue already. Good thing, it's marked critical. Bad thing, it got moved from 7.x to 8.x (with "needs backport" tag but anyway).

Between 7.19 there were many small, beneficial changes. If you can, just hack out itok and upgrade. And if you can make itok configurable, post your patch to the Issue queue I linked.


As far as I can tell $conf['image_allow_insecure_derivatives'] = TRUE; doesn't work. At least not on versions 7.26+

So yes, a hack seems like the solution. This worked for me: https://drupal.org/node/1934498


Using ImageMagick instead for GD solves the issue.

  • i use ImageMagik and still am required to provide the itok parameter. @W.M., what settings are you using to allow this?
    – E.A.T
    Commented Apr 29, 2015 at 23:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.