19 votes
Accepted

How to enable a site to be in an iframe?

Since Drupal 7.50, core is now protected against clickjacking by default (X-Frame-Options: SAMEORIGIN). So by default, your Drupal site can only be embedded into a site on the same domain. To change ...
Clive's user avatar
  • 166k
17 votes
Accepted

Prevent SQL injection

Drupal 8 (like Drupal 7) uses PDO to communicate with databases. With PDO, the DB API makes use of prepared statements, specifically to avoid SQL injection attacks. Practically, this means that you ...
Clive's user avatar
  • 166k
13 votes
Accepted

Prevent Cross-site scripting

Sanitizing on output to avoid Cross Site Scripting (XSS) attacks Use Twig templates The Twig theme engine now auto escapes everything by default. That means that every string printed from a ...
No Sssweat's user avatar
  • 31.1k
12 votes

How critical is SA-CORE-2018-005?

The specific vulnerability seems to be the ability of a requester to send one request path to the webserver, but use an HTTP header to make Drupal see a different path. The rewrite happens early, so ...
Christoph Burschka's user avatar
11 votes
Accepted

What do blocked IP addresses see?

They see a blank 403 page with this message specifying that their IP address has been banned: The block is done at the application level. Drupal inserts a record into the blocked_ips table which is ...
Shawn Conn's user avatar
  • 26.8k
10 votes

How to tell if my Drupal site is comprised from the SA-CORE-2018-002 -- 2018 March exploit?

How can I tell if someone used this exploit to hack my site? Your Drupal 7 or 8 site can experience loss or theft of data, data can be removed, deleted or changed, wreaking havoc on the site in many ...
Christia's user avatar
  • 1,637
8 votes
Accepted

How to tell if my Drupal site is comprised from the SA-CORE-2018-002 -- 2018 March exploit?

What could happen I had a personal Drupal site hacked during Drupalgeddon, an exploit of similar severity (though of a different type). In terms of "what could happen," in that case the hacker put ...
Mike Nolan's user avatar
6 votes
Accepted

Why is settings.php in the web folder?

You are absolutely correct. I know for a fact that many developers/sysadmins do not take the risk that the PHP interpreter might fail at some point, and include the db password (and other sensitive ...
marcvangend's user avatar
  • 14.9k
6 votes
Accepted

How to get accurate information about available security updates after End-of-Life?

Have a look at the myDropWizard module, a recently released module for Drupal 6. Some more details about it (from its project page, which also includes a screenprint about it): Reports accurate ...
Pierre.Vriens's user avatar
6 votes
Accepted

Automatically block user that access /wp-login.php

You can use autoban ip You have to at least enable Autoban and Autoban Core Ban Provider modules from this package. Then go to configuration > people > automatic ip address bans and add a rule ...
GiorgosK's user avatar
  • 8,433
5 votes
Accepted

How do I handle third-party API credentials in settings?

The key module provides a framework for abstracting key storage from modules. The module provides 2 key providers (plugins) out of the box: config and file. It is possible to implement a key provider ...
mradcliffe's user avatar
  • 5,897
5 votes

How do I redirect to www and https in settings.php?

The caveat to the settings.php approach is 2 issues: Your redirect requires that Drupal be bootstrapped to work. If there's a resource that bypasses Drupal (e.g. any hosted files), you're not going ...
Shawn Conn's user avatar
  • 26.8k
5 votes

Remove the X-generator header from the response

The simplest method is to remove the header in a custom EventSubscriber: $response->headers->remove('X-Generator'); See https://drupal.stackexchange.com/a/201297/47547 for an example.
4uk4's user avatar
  • 98.2k
5 votes

How to prevent a site from ever using experimental core modules?

This is by far not as black and white as you make it in regards to experimental modules. First, on a mission critical production site, you don't want to do anything directly on production. Completely ...
Berdir's user avatar
  • 82.9k
5 votes
Accepted

Is there a way to send emails when someone logs in?

A possible solution is to use the Rules module and create a custom rule like so: Rules Event = After a user logs in. Rules Action = Send an eMail. That's really it (a kind of Rules 101 also if you ...
Pierre.Vriens's user avatar
5 votes
Accepted

How to set content-security-policy header?

I may be a bit biased in thinking that the Content Security Policy module is the best solution for adding a policy to your site, but here are some of the reasons for using the module: Integration ...
gapple's user avatar
  • 1,554
5 votes
Accepted

How is user input sanitized?

Drupal uses Twig's autoescape feature, which in turn uses escape, which itself uses htmlspecialchars to prepare markup safe for output. SafeMarkup::checkPlain() preceded the autoescaping (deprecated ...
Clive's user avatar
  • 166k
5 votes
Accepted

Using modules "not covered by Drupal’s security advisory policy"

According to the Security advisory process and permissions policy, modules that have an alpha, beta, or rc (relase candidate) status are not covered by this policy, and security advisories will not be ...
komlenic's user avatar
  • 126
5 votes
Accepted

Make a password security check for the register form

It seems like you might want to look into the Password Policy module which probably has a lot of the features you are trying to rebuild. I also wonder whether it makes sense to build your own user ...
greggles's user avatar
  • 5,242
5 votes
Accepted

Error: Private files directory not fully protected

Submit the admin form @/admin/config/media/file-system will also create this .htaccess file if your folders are setup correct.
Marcel's user avatar
  • 444
4 votes
Accepted

How can I exclude API keys, passwords, and so on from configuration management?

You can't exclude specific keys easily from being exported. However, you simply can not store the real keys there in the first place, and rely on local overrides through settings.php only, e.g. $...
Berdir's user avatar
  • 82.9k
4 votes

How to remove malicious scripts from admin pages after being hacked?

If you suspect that your code has been altered, you should track any malicious code which could infect your webroot. If you've access to the server terminal, try the following suggestions, otherwise ...
kenorb's user avatar
  • 14.1k
4 votes
Accepted

How to delete first user (admin)

I doubt that's possible, or at least not without messing with a lot of core code. User 1 is synonymous with the root user in linux. It can be disabled, hardened, made virtually impossible to access, ...
Clive's user avatar
  • 166k
4 votes
Accepted

Is it safe to allow domain.com/username?

On a site that is not using a mechanism like the one implemented from the Two-factor Authentication (TFA) module, letting visitors know usernames of existing accounts is giving out half of the ...
apaderno's user avatar
  • 97k
4 votes
Accepted

MYSQL injections: Are they a threat?

Can somebody tell my, what these attacks are about? They're requests from bots fishing for vulnerabilities in your website. Was there a bug in Drupal making it vulnerable for those attacks? ...
Clive's user avatar
  • 166k
4 votes
Accepted

Is 8.6.18 insecure? Will there be 8.6.19 etc.?

According to the Drupal core release cycle documentation, the last month for security coverage for 8.6 was November 2019. There is no more planned security coverage for 8.6. Security releases only ...
sonfd's user avatar
  • 7,811
4 votes
Accepted

Understanding the Basic Context of Trusted Hosts

Trusted hosts refer to the domain that your Drupal site is hosting, not your remote PC's domain that is administering the site. For example, if your site running on Drupal was www.thedrupaldude.com, ...
glenviewjeff's user avatar
4 votes

Does the login-link users receive upon registration actually expire?

Nope, new users' one-time-link do not expire. Only "forgot passwords"-links do. Also, see this discussion. It might come in future Drupal 9 releases. https://www.drupal.org/project/drupal/...
Stef Van Looveren's user avatar
4 votes

Do I need the trusted host setting?

Drupal 7 only limits the length of the host name to 1000 bytes to prevent DoS attacks, and it doesn't accepts host names containing slashes, but it doesn't restrict the allowed host names basing on a ...
apaderno's user avatar
  • 97k
4 votes

Why does Drupal harden permissions of the /web/sites/default directory and files?

The settings.php file contains the database password and username in plain text and, once created, must be set so that only appropriate users can read it. That usually means removing read permissions ...
cilefen's user avatar
  • 5,557

Only top scored, non community-wiki answers of a minimum length are eligible