Security checks for Drupal: settings, modules and permissions
Drupal's Status report flags some problems, but only to whoever opens it, one site at a time. The agent runs the same checks and a few more on every Drupal site.
Drupal settings get forgotten after launch.
Without trusted_host_patterns Drupal answers for any Host header, which allows cache poisoning and fake password reset links. Devel or the PHP module left on after development show the site's internals or let someone run code from the browser.
These settings take five minutes to fix, once someone tells you they are missing.
What we check.
settings.php
trusted_host_patternsmissing,hash_saltshort or empty ($drupal_hash_salton Drupal 7), settings file writable.Modules and permissions
Devel, Webprofiler, Kint and the PHP module on, "Give to trusted roles only" permissions given to anonymous or authenticated users, Full HTML for everyone.
Running order
Cron not running, page cache or CSS and JavaScript aggregation off, database updates waiting.
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
Does it work on Drupal 7?
Yes, with the Drupal 7 module. Some checks use Drupal 7 names, such as `$drupal_hash_salt`.
Goes well with
- Drupal site monitoring for web agenciesA native Drupal module, with insecure releases and core integrity from drupal.org.
- Alerts for Drupal core and modules on insecure releasesdrupal.org data: insecure releases and the version that fixes them.
- Drupal core file integrity checks, Composer projects includedEvery core file compared with the drupal.org archive, archives and Composer.
- Database user privileges: one hacked site shouldn't open the othersMySQL users with global rights, or that can see other databases.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.