Use strong Drupal passwords
Like any website, Drupal depends on strong passwords to ensure every account is resistant to brute force attacks. Passwords that are easy to remember or speak might be more convenient, but they’re exponentially more vulnerable to automated scripts designed to crack passwords.
Make sure every password used to access your Drupal site includes these characteristics:
- At least 1 uppercase character
- At least 1 lowercase character
- At least 1 digit
- At least 1 special character
- At least 10 characters (no more than two identical characters in a row)
A word about password keepers
These characteristics make passwords harder to guess, and also harder to remember. To help you keep track of and manage your passwords, use a password keeper to store and automatically enter passwords. There are a number of reputable free apps available, including LastPass, KeePass, and Myki.
Limit number of Drupal login attempts
Limiting login attempts to your admin interfaces helps prevent brute force attacks, where automated scripts attempt combinations of user name and password until one grants access.
By default, versions Drupal 7 and above limits logins to five failed attempts per user within six hours, and 50 per IP within one hour. If those are exceeded, further logins are blocked for six hours.
For versions prior to Drupal 7, you can add a security module that includes a feature for limiting login attempts. Download one, such as Login Security, from the Drupal module repository.
Restrict Drupal access to authenticated URLs
Use a Drupal security module or website firewall to allowlist IPs that can access your login page. This ensures only people you know and trust are able to bypass security and log in, effectively cutting off this attack vector used by bad actors.
Set up two-factor authentication (2FA)
Two-factor authentication is a security measure that relies on a device in your physical possession. Login credentials can be stolen or guessed, but 2FA requires access to a device like your desktop computer or mobile device. With 2FA in place, you must also enter a code sent to that device in order to log in to your Drupal user account.
You can set up two factor authentication via Drupal admin or by adding the module Two-Factor Authentication (2FA).
To set up two-factor authentication via Drupal admin:
- Log in to Drupal admin.
- Click Logged in as (your username). Your account page displays.
- Go to Security, click Setup Application, and then enter your password.
- Download the 2FA client for your device, and then open the 2FA client on your device.
- On your device, enter the verification code from your Drupal admin session or scan the QR code. An application verification code displays.
- In your Drupal admin session, go to Application verification code, enter the verification code from your device, and then click Verify and save.
Look for an email confirming you set up 2FA. Future logins will require you to enter a temporary code sent to your mobile device in addition to your Drupal username and password.
Monitor & detect Drupal hacks
Out of the box, Drupal comes with relatively strong security measures. However, there are numerous modules and other third-party technology you can employ to strengthen your Drupal website security.
Drupal security modules
Go to the Drupal module repository, and then search using the term security. You’ll find that over 1,500 modules come up. Here are five that merit immediate consideration:
- CAPTCHA — Implements a challenge-response test when users attempt to submit data.
- reCAPTCHA — Improves upon the CAPTCHA system.
- Backup and Migrate — Backs up and restores MySQL databases and code, and enables simpler site migration.
- Automated Logout — Logs out users after a specified period of inactivity.
- Two-Factor Authentication (TFA) — Adds a second login step beyond username/password, such as a code sent to a mobile device.
Drupal hosting security
The least secure types of hosting are typically easier to use, with plans often featuring an easy-to-understand interface and automated tasks like updating core files. A good rule of thumb is to select a plan requiring the greatest amount of manual interaction you can handle.
Less costly plans also tend to use shared environments. While these cost far less, your website risks infection should another site on the shared server get compromised. As you evaluate hosting providers, you’re likely to see these plans:
- Managed hosting (beginner) — With automated functions and a shared environment, these plans are for people who have little hosting experience.
- Shared hosting (intermediate) — Cost effectiveness comes with less security, as these plans use shared hosting. Site owners must install admin software like cPanel or Plesk.
- Virtual private servers (advanced) — Featuring an isolated environment, these plans feature super-user permission and the ability to install any admin software.
- Dedicated servers (pro) — With one website hosted on one server, mitigating risks such as cross-site contamination comes with a higher price and level of experience.
Drupal site owners with less experience should consider the first two options, while those with more knowledge and resources would benefit from the last two options. It’s also worth contacting hosting providers to see what kind of technical support they offer, as well as security services like malware scanning and removal.
Drupal backups
It would be unwise to assume a website will never encounter a problem that requires restoring a previous, healthy version. It’s essential to have a solution that regularly backs up versions of your website, and then lets you restore any of those backups as needed.
Some Drupal modules, such as Backup and Migrate, handle this function. Other third-party applications like our Website Security Platform offer a more robust solution. With either route you choose, make sure backups have these characteristics:
- Offsite — Backups shouldn’t be stored on the website’s server because they often contain unpatched software with vulnerabilities. Their publicly-accessible location lets anyone exploit them to attack your live website. Off-site backups also help protect against hardware failure.
- Automatic — Backups should be completely automated so they’re made on a regular basis. If a manual solution is your only option, make sure you schedule the backups regularly.
- Redundant — According to Schofield’s Second Law of Computing, data doesn’t exist unless there are at least two copies. Your backup strategy has to include redundancy: backups of your backups.
- Validated — Make sure the process actually works. Start with an empty web directory, and then verify backups will get all your data and the website back online with a test domain, using only the backup file.
To the inexperienced, maintaining volumes of backups might seem like overkill. But for the website owner who’s gone through the ordeal of recovering a hacked site, reliable backups are nothing short of a life-saver.
Drupal scanners
The longer a hack remains in place, the more damage it does and the more difficult recovery becomes. Regularly scan your Drupal website for issues or changes to file structures and extensions to stay on top of indicators of compromise.
When it comes to scanners, you’ll find they fall into two categories:
- Remote — These scanners, including SiteCheck and UnmaskParasites, examine the public-facing components of your Drupal site, such as nodes and modules. They’re typically free and simple to use.
- Server-side — Server-side scanners, such as the one included in our Website Security Platform, look not only at public-facing components, but deep into your website files and databases for a comprehensive wellness check.
Because remote scanners are typically free and easy to use, it’s safe to plan on scanning manually on an ad hoc basis. However, if you use a paid service for remote scans, be sure to configure automated functions like scan intervals and alerts.
