Have just enabled security review module and it's alerting to base url not being uncommented and set. This is a multi-site so do I need to set the base url in each settings file for each site? I set the base url in settings for the root site but the alert still came up for subdomain of multisite where have not changed its settings file.

1 Answer 1


To be more secure you should set the base url for each site, yes.

Setting this helps protect against a phishing attack where a malicious user manipulates Drupal's use of the host request header to make the site provide incorrect links.

  • I think it's actually only relevant for the "sites/default/settings.php" file, right? This should probably be turned into an issue for the module.
    – greggles
    Commented Jan 8, 2014 at 4:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.