Drupal is an Open Source CMS that powers around 3% websites online.

Though a little behind in terms of market share, it is generally praised for being relatively secure when compared with other major eCommerce CMS like WordPress, Magento, Joomla, etc. Statistics in 2018 revealed that only 11% of the total vulnerabilities reported that year came from Drupal. Far below WordPress and Joomla’s numbers.

Even though it’s safer than its competitors, Drupal falls prey to multiple vulnerabilities every year. In 2019, Drupal released advisories associated with 12 vulnerabilities. Almost 50% of these were labeled as highly critical by the platform. Mostly it has been observed that Drupal houses cross-site scripting, remote code execution, and SQL injection vulnerabilities.

In this guide, we will discuss all the best practices for Drupal security, so that you can shield your Drupal website from web security threats.

Table of Content:

1. The Most Critical Drupal Vulnerabilities you should be aware of
2. Fixes for Drupal Security and Vulnerabilities
   • Follow Basic Security Best Practices
   • Block Bad Bots
   • Add Drupal Security Models
   • Drupal Hosting Services
   • Prevent Indexing of the Login Page
   • Keep Everything Updated
   • Check File Permissions
   • Be on the Lookout for Vulnerabilities
3. Conclusion

The Most Critical Drupal Vulnerabilities you should be Aware of

1. Drupalgeddon

Dating back to 2014, the ‘Drupalgeddon’ was an SQL vulnerability that shook the entire platform. The Drupal 7 database API abstraction layer contained loopholes that rendered it vulnerable to SQL injection attacks. Versions prior to Drupal 7.3.2 were affected. The vulnerability paved the way for arbitrary SQL execution, and depending on the content of requests, it lead to privilege escalation, arbitrary PHP execution, and other attacks.

Drupal’s advisory labeled this vulnerability as highly critical, with a risk score of 25/25. In 2018, Drupalgeddon 1 and Drupalgeddon 2 also hit the platform, and both exposed a Remote Code Execution vulnerability. Versions 6,7, and 8 were affected. Drupal immediately released advisories and remedial methods.

2. Cross-Site Scripting Vulnerability

In an XSS attack, hackers misuse loopholes and gaps within an application to insert malicious codes/scripts in its web pages. These codes get activated when users load the website on their browsers. Typically, malicious JavaScript codes are implanted into your website.

While these codes will not affect your website itself, the end-users’ browsers will get infected once they visit and load your website. The hackers can then access session tokens, cookies, and other user information.

Versions prior to Drupal 8.1.10 allowed hackers to execute arbitrary HTML scripts into Drupal websites via vectors.

3. Code Execution Vulnerability

Drupal became vulnerable to remote code execution in 2017, exposing it to the threat of database credential theft. A 3rd party development library included in Drupal 8 development dependencies became vulnerable to remote code execution.

Hackers conducted man-in-the-middle attacks to exploit this vulnerability. Versions of Drupal 8.2.2 and below were affected.

4. Critical Access Bypass

A moderately critical vulnerability, this one affected Drupal 8 versions. Through this loophole, users could post comments using the REST API without correct permissions. Basically, they could post comments without needing authorization. This issue only affected sites with RESTful web services module, and the comment entity REST resource enabled.

The hacker needed to either post comments as an anonymous user, access an already registered account, or register a new account.

Fixes for Drupal Security and Vulnerabilities

1. Follow Basic Security Best Practices

The first and foremost step you need to take for Drupal security is to follow certain standard protocols all websites swear by for their security, regardless of the platform they’re functioning on. These include:

1.1 Strong Passwords

The more complex and unique your website password is, the harder it will be for hackers to crack it through dictionary attacks. Industry statistics suggest that 80% of dictionary attacks are successful because the user had set a weak password.

Make sure that your password is at least 15-20 characters long, and contains a mixture of numbers, alphabets, and symbols. This way, if a hacker is attempting a brute force attack, it will take time for bots to figure out the correct combination. This will give your developers or firewalls enough time to figure out that a brute attack is being conducted.

1.2 Two-Step verification

Through two-step verification (2SV), you can prevent a hacker from accessing your account even if he/she has gotten hold of your login credentials. Once you’ve filled in your password, a 2SV will generate an OTP and send it to your mobile phone or email.

There is a very low chance that a hacker has cracked your password and also has access to your mobile phone at the same time.

1.3 Limit Login Attempts

If you limit login attempts to your website, then brute force attacks will have a lesser chance of succeeding. You can temporarily or permanently block a user after they’ve exhausted the attempt limit set by you. You can also block the IP address of the user account exhibiting malicious intent.

1.4 Take Regular Backups

You might be aware that it is always recommended to take a backup of your store if you’re making any modifications to it. This is because in case something goes wrong, you can always return back to your store’s latest configuration.

From a security point of view, if a hacker infiltrates your website and deletes data or infects it, you can easily return to the previous setup of your store, without having to start from scratch. Keep in mind, that you should store multiple backups of your site, preferably in an offsite location. If your servers are hacked, then at least your backups will not get compromised.

1.5 SSL certificate

A Secure Socket Layer (SSL) certificate will encrypt the communication happening between client computers and your website. If you don’t operate in an HTTPS environment, then anyone can intercept the data being transmitted between you and your customers, and steal sensitive information.

Nowadays, it mandatory for all websites to procure an SSL certificate, otherwise search engines penalise them.

You can also read about security best practices in detail in the following article:

Basics of eCommerce Security & Best Practices you should Follow

2. Block Bad Bots

Bad bots and crawlers are designed by hackers to conduct malicious and fraudulent activities on your website pages. These malefactors can steal information (like your product reviews, pricing, etc) from your pages, and also be used to conduct DDoS attacks on your application servers. Bots can also scour your content and publish it somewhere else, affecting the ranking of your website.

It’s essential to block these bad actors from indexing or crawling your Drupal website pages. To block them at server level, you should limit the number of user strings. Add the following code to your .htaccess file:

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^.*(agent1|Wget|Catall Spider).*$ [NC]
RewriteRule .* - [F,L]

If you’re hosting your website with a hosting server, then check if they are taking appropriate measures to stop your web store from being crawled by bad bots.

3. Add Drupal Security Models

Modules help you extend your store’s functionality, and give it the features you want. Drupal security modules will add more layers to your website’s security and bring it closer to being impenetrable. Here are some modules you should unquestionably add to your store:

• Automated Logout: administrators can specify a time window of inactivity, and this module will log out users automatically after that time period is complete.

• Security Kit: this kit mainly provides security hardening measures for your Drupal store. You can prevent and mitigate risks of in-application vulnerabilities being exploited. It toughens your store up against threats like cross-site scripting attacks, clickjacking, cross-site request forgery, man-in-the-middle attacks, eavesdropping, etc.

• SpamSpan Filter: this module obfuscates email addresses to prevent spam bots from collecting them, by making them unreadable.

• Session Limit: this module prevents the same user from creating multiple sessions on your Drupal web store. To elucidate, if the limit of sessions set by the admin is one, then the same user will not be able to login to your website from 2 devices simultaneously. He/she will have to end the session from one browser, in order to access your website from another.

• Drupal Security Review: the security review will run tests and scans to identify small, mindless mistakes you can make to render your site unsafe. It runs checks for database errors, file system permissions, dangerous tags in text formats, safe upload of extensions, multiple failed login attempts, admin permissions, PHP execution, and more.

• Login Security: through this module, the admin can deny access to IP addresses permanently or temporarily, and limit the number of login attempts before blocking the account. This module also notifies you if any brute force attack is suspected on the login page, or unusual login behavior is detected.

4. Drupal Hosting Services

The entire database of your website will be located on your host’s server, so finding the perfect hosting service for your store is vital. The right hosting service will assume complete responsibility for your store’s security and work towards making it unbreachable.

You can look into shared hosting providers, dedicated hosting, cloud hosting, and managed hosting plans.

If you don’t want to make any compromises on your store’s security, then fully managed hosting services are usually preferred by website owners. From basic compliance protocols to advanced security measures and proactive monitoring, managed services will take the hassle of your store’s safety and performance completely off your shoulders.

At Webscoot, apart from following best security practices, our engineers proactively monitor our client stores 24×7 and immediately step in to fix issues or deal with threats. We also deploy web application firewalls to give a sturdy layer of security to our servers.

5. Prevent Indexing of the Login Page

Just like you, hackers can log in from your website’s login page too, provided they have the right credentials in hand. A straightforward method of preventing unauthorized access to your website is by barring search engines from indexing your page. This is not a full-proof method, but it will make it harder for an attacker to find your website’s login page.

In order to do this, add the following line of command in your Robots.txt file under the ‘Path’ section:

Disallow: /user/login

6. Keep Everything Updated

One of the most basic steps for stronger security is to keep all aspects of your website up-to-date. It’s critical to not take Drupal updates lightly, and install them as soon as they are rolled out. Most new versions contain fixes for the vulnerabilities that were present in the previous version.

Remember, hackers are constantly on the lookout for version-centric loopholes to exploit in CMS platforms. Once such a vulnerability comes to the fore, they target multiple sites running on that platform to extract sensitive information.

Apart from Drupal core versions, you need to keep upgrading your modules as well. Modules tend to be highly vulnerable, and are often targeted by hackers to infect websites with malicious codes.

To install new updates for your Drupal store:

1. Open ‘Reports‘
2. Click on Available updates and check manually
3. After finding the security updates you can click on Download.

7. Check File Permissions

File permissions allow you to control who is able to read, write, and edit information on your website. If you give extensive permissions to a number of people, then hackers can that many people to breach your website account. If an attacker gains access to your account, then secure file permissions will limit his/her ability to exploit your site further.

Drupal itself lays out a lot of guidelines and best practices for a secure file permission configuration. For starters, the webserver must be configured in a way that it isn’t allowed to modify or write the files which it executes. Permissions for core files and directories should be kept limited to the admin’s account only.

You can run the file permissions module to automate the setup of correct file permissions for your Drupal store.

8. Be on the Lookout for Vulnerabilities

Drupal’s advisory keeps releasing documentation on version vulnerabilities, explaining the issue, the risk score of the loophole, and remedial measures. Mostly these vulnerabilities are patched through new version releases. But in case you’re not able to download the new version, you can always take the help of the documentation to fix the issue.

You can also check out a website called CVEdetails. It is basically a directory of software vulnerabilities, and you’ll be able to find information on the latest Drupal core loopholes and remedial measures easily.

Conclusion

There is no 100% guarantee against a data breach in the internet world. However, If you follow the best practices for Drupal security outlined in this guide meticulously, then your website will come as close to bulletproof security as it can!

If you have any suggestions or feedback, do mention in the comments below.

Read next: 7 Must-Have Security Tools in eCommerce