Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*"
Favorites infavorites:mine
Status closed:yes
Types is:question
Exclude -[tag]
For more details on advanced search visit our help page
Results tagged with Search options answers only user 10729

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

to consider aside from the security of your website is the security of your server. If all your files have to be edited by root does that possibly mean you are regularly using the root account or sudo … to do things? If so that is bad for server security. You shouldn't really need to be root to edit website files like that. Instead of using root maybe use a non-root account with a strong password …
answered Nov 3 '14 by rooby
I've seen this happen with no node access modules enabled. The cause was as mentioned by the Gregs, a user is deleted and all their content was then assigned to anonymous. Anonymous had incorrectly …
answered Mar 24 '14 by rooby
work on the FTP Yes. Also, use SFTP or SSH to connect to the server. Search for any security issue before installing a module This is generally not something you can do. If you have the latest … stable release of a module you should have the most secure. There is no way to see security issues for a module that have not been fixed yet (or it would be easier for people to exploit them). The …
answered Jun 23 '13 by rooby
One way to restrict access to specific paths is to use the Custom Permissions module. It allows you to create path based permissions at /admin/people/custom_permissions. Then you can configure which …
answered Apr 26 '17 by rooby
In my opinion, saving plain text credit card details to your website is absolutely out of the question. Also, emailing credit card details is out of the question. Just don't do it ever. It would he …
answered Jan 31 '13 by rooby
Some checks for common attacks are (this is not an exhaustive list, but are some of the attacks seen in the wild so far): Check your user 1 account to make sure its user name, email address or passw …
answered Oct 17 '14 by rooby
You need to do 3 things when you validate your password entry form: Use flood_is_allowed() to check that the user hasn't already breached their flood limit and set a form error with form_set_error() …
answered Aug 7 '15 by rooby
It depends somewhat on your server configuration but it doesn't have to be 777, and in fact it should not be 777 as that is a security issue. The web server user (on your server, not your drupal …
answered Feb 4 '13 by rooby