19
votes
Accepted
How to enable a site to be in an iframe?
Since Drupal 7.50, core is now protected against clickjacking by default (X-Frame-Options: SAMEORIGIN).
So by default, your Drupal site can only be embedded into a site on the same domain.
To change ...
- 166k
17
votes
Accepted
Prevent SQL injection
Drupal 8 (like Drupal 7) uses PDO to communicate with databases.
With PDO, the DB API makes use of prepared statements, specifically to avoid SQL injection attacks.
Practically, this means that you ...
- 166k
13
votes
Accepted
Prevent Cross-site scripting
Sanitizing on output to avoid Cross Site Scripting (XSS) attacks
Use Twig templates The Twig theme engine now auto escapes everything by default. That means that every string printed from a
...
- 31.1k
12
votes
How critical is SA-CORE-2018-005?
The specific vulnerability seems to be the ability of a requester to send one request path to the webserver, but use an HTTP header to make Drupal see a different path.
The rewrite happens early, so ...
- 2,406
11
votes
Accepted
What do blocked IP addresses see?
They see a blank 403 page with this message specifying that their IP address has been banned:
The block is done at the application level. Drupal inserts a record into the blocked_ips table which is ...
- 26.8k
10
votes
How to tell if my Drupal site is comprised from the SA-CORE-2018-002 -- 2018 March exploit?
How can I tell if someone used this exploit to hack my site?
Your Drupal 7 or 8 site can experience loss or theft of data, data can be removed, deleted or changed, wreaking havoc on the site in many ...
- 1,637
8
votes
Accepted
How to tell if my Drupal site is comprised from the SA-CORE-2018-002 -- 2018 March exploit?
What could happen
I had a personal Drupal site hacked during Drupalgeddon, an exploit of similar severity (though of a different type). In terms of "what could happen," in that case the hacker put ...
- 404
6
votes
Accepted
Why is settings.php in the web folder?
You are absolutely correct. I know for a fact that many developers/sysadmins do not take the risk that the PHP interpreter might fail at some point, and include the db password (and other sensitive ...
- 14.9k
6
votes
Accepted
How to get accurate information about available security updates after End-of-Life?
Have a look at the myDropWizard module, a recently released module for Drupal 6. Some more details about it (from its project page, which also includes a screenprint about it):
Reports accurate ...
- 35.8k
6
votes
Accepted
Automatically block user that access /wp-login.php
You can use autoban ip
You have to at least enable Autoban and Autoban Core Ban Provider modules from this package.
Then go to configuration > people > automatic ip address bans
and add a rule ...
- 8,433
5
votes
Accepted
How do I handle third-party API credentials in settings?
The key module provides a framework for abstracting key storage from modules. The module provides 2 key providers (plugins) out of the box: config and file. It is possible to implement a key provider ...
- 5,897
5
votes
How do I redirect to www and https in settings.php?
The caveat to the settings.php approach is 2 issues:
Your redirect requires that Drupal be bootstrapped to work. If there's a resource that bypasses Drupal (e.g. any hosted files), you're not going ...
- 26.8k
5
votes
Remove the X-generator header from the response
The simplest method is to remove the header in a custom EventSubscriber:
$response->headers->remove('X-Generator');
See https://drupal.stackexchange.com/a/201297/47547 for an example.
- 98.2k
5
votes
How to prevent a site from ever using experimental core modules?
This is by far not as black and white as you make it in regards to experimental modules.
First, on a mission critical production site, you don't want to do anything directly on production. Completely ...
- 82.9k
5
votes
Accepted
Is there a way to send emails when someone logs in?
A possible solution is to use the Rules module and create a custom rule like so:
Rules Event = After a user logs in.
Rules Action = Send an eMail.
That's really it (a kind of Rules 101 also if you ...
- 35.8k
5
votes
Accepted
How to set content-security-policy header?
I may be a bit biased in thinking that the Content Security Policy module is the best solution for adding a policy to your site, but here are some of the reasons for using the module:
Integration ...
- 1,554
5
votes
Accepted
How is user input sanitized?
Drupal uses Twig's autoescape feature, which in turn uses escape, which itself uses htmlspecialchars to prepare markup safe for output.
SafeMarkup::checkPlain() preceded the autoescaping (deprecated ...
- 166k
5
votes
Accepted
Using modules "not covered by Drupal’s security advisory policy"
According to the Security advisory process and permissions policy, modules that have an alpha, beta, or rc (relase candidate) status are not covered by this policy, and security advisories will not be ...
- 126
5
votes
Accepted
Make a password security check for the register form
It seems like you might want to look into the Password Policy module which probably has a lot of the features you are trying to rebuild.
I also wonder whether it makes sense to build your own user ...
- 5,242
5
votes
Accepted
Error: Private files directory not fully protected
Submit the admin form @/admin/config/media/file-system will also create this .htaccess file if your folders are setup correct.
- 444
4
votes
Accepted
How can I exclude API keys, passwords, and so on from configuration management?
You can't exclude specific keys easily from being exported.
However, you simply can not store the real keys there in the first place, and rely on local overrides through settings.php only, e.g.
$...
- 82.9k
4
votes
How to remove malicious scripts from admin pages after being hacked?
If you suspect that your code has been altered, you should track any malicious code which could infect your webroot.
If you've access to the server terminal, try the following suggestions, otherwise ...
- 14.1k
4
votes
Accepted
How to delete first user (admin)
I doubt that's possible, or at least not without messing with a lot of core code.
User 1 is synonymous with the root user in linux. It can be disabled, hardened, made virtually impossible to access, ...
- 166k
4
votes
Accepted
Is it safe to allow domain.com/username?
On a site that is not using a mechanism like the one implemented from the Two-factor Authentication (TFA) module, letting visitors know usernames of existing accounts is giving out half of the ...
- 97k
4
votes
Accepted
MYSQL injections: Are they a threat?
Can somebody tell my, what these attacks are about?
They're requests from bots fishing for vulnerabilities in your website.
Was there a bug in Drupal making it vulnerable for those attacks?
...
- 166k
4
votes
Accepted
Is 8.6.18 insecure? Will there be 8.6.19 etc.?
According to the Drupal core release cycle documentation, the last month for security coverage for 8.6 was November 2019. There is no more planned security coverage for 8.6.
Security releases only ...
- 7,811
4
votes
Accepted
Understanding the Basic Context of Trusted Hosts
Trusted hosts refer to the domain that your Drupal site is hosting, not your remote PC's domain that is administering the site. For example, if your site running on Drupal was www.thedrupaldude.com, ...
- 575
4
votes
Does the login-link users receive upon registration actually expire?
Nope, new users' one-time-link do not expire. Only "forgot passwords"-links do.
Also, see this discussion. It might come in future Drupal 9 releases. https://www.drupal.org/project/drupal/...
- 3,313
4
votes
Do I need the trusted host setting?
Drupal 7 only limits the length of the host name to 1000 bytes to prevent DoS attacks, and it doesn't accepts host names containing slashes, but it doesn't restrict the allowed host names basing on a ...
- 97k
4
votes
Why does Drupal harden permissions of the /web/sites/default directory and files?
The settings.php file contains the database password and username in plain text and, once created, must be set so that only appropriate users can read it. That usually means removing read permissions ...
- 5,557
Only top scored, non community-wiki answers of a minimum length are eligible