First Things First - Securing a New Site

Events happening in the community are now at Drupal community events on www.drupal.org.
Posted by dilvish on April 20, 2010 at 9:18pm
Last updated by dilvish on Tue, 2010-04-20 21:18

Securing a new Drupal site is critical because Drupal installations are insecure by default (functionality is considering more important than security in a default install).

  1. Restrict user registration
  2. Remove error messages
  3. Enable SSL for logins (http://drupal.org/project/securepages)
  4. Enable private files and move the default file directory out of the webserver's document root path
  5. Enable a password policy (http://drupal.org/project/password_policy)
  6. Modify the theme to remove usernames from posts