Free resources online for protecting your Drupal site

There are lots of great resources online about how to secure your Drupal site. The CrackingDrupal.com site is meant to be one of those resources, but there are also others available elsewhere. Here are some of the best resources available from around the internet with Drupal specific security information.

Drupal.org Handbooks

The Drupal.org handbooks are probably the most natural place to look and in fact they have three great areas of resources.

• Writing secure code provides advice about secure code. It can be a bit hard to understand the flow and examples, but this is still a great resource.
• Secure configuration looks at the non-code aspects of configuring your site.
• Security team provides insight into the policies and procedures of the Drupal Security Team. It's the policies which are most important to a typical user.

University of Pennsylvania School of Arts and Sciences Pages

The University of Pennsylvania is using Drupal for a lot of different sites. They have been actively reviewing and finding problems in Drupal's contributed modules for over a year now. They are also providing documentation (on their site) about how to secure Drupal.

Some examples:

• Drupal Security Configuration
• Drupal approved modules which means that they have reviewed the modules for security problems.
• Drupal security considerations provides some Penn specific and some general advice about Drupal sites.

Nadeau Software Consulting

The Nadeau Software Consulting company provides an extensive online resource in 3 parts. Their advice comes from a strong system administrator perspective about how to secure Drupal within the Context of Linux/Apache.

• Drupal and Apache Web Site Security Checklist, part 1
• Drupal and Apache Web Site Security Checklist, part 2

From CrackingDrupal.com

Aside from this blog there are a few other resources on this site:

• List of security focused contributed modules
• Text filtering cheat sheet for developers and themers
• A PDF version of Cracking Drupal Chapter 1 and the table of contents.

Other blog sites

Safe string theory for the web by Steven Wittens is a great resource. One final mention is Heine Deelstra's Blog which covers a lot of things but also frequently covers security.

Edited to include more resources from this site and Steven Wittens site.