How secure is Drupal?

Drupal is open-source, which some people believe makes it less secure than proprietary software – after all, anyone can read the code and take advantage of the bugs!

Alas, it doesn’t quite work like that. If you study how people break software, you’ll find they commonly use IDA Pro rather than the source code.

According to Dr. Ian Levy, technical director with the CESG, a department of the UK’s GCHQ intelligence agency, good open-source is just as secure as any good proprietary software.

Drupal, like other popular open-source software, has a highly active community that’s always on the lookout for bugs.

Drupal also has a dedicated Security Team that issues patches, notifies users of vulnerabilities, and provides advice and support to developers around writing secure code and building safe sites.

But you can’t rely on others. To stay secure, you have to continuously update code both within Drupal and across your hosting infrastructure. You can’t set up a secure Drupal web application server and leave it to do its job.

Security updates are released every Wednesday, and users have to stay on top of them. It’s a big responsibility for whoever’s in charge.

It’s worth bearing in mind too that Drupal does have a somewhat chequered past when it comes to security, having experienced two breaches of legendary proportions.

In 2014, hackers compromised 12 million websites in an event comically coined ‘Drupalgeddon.’ The attackers took control of servers and seeded sites with malware.

Then in 2018, we bore witness to Drupalgeddon2, where hackers took complete control of Drupal 6, 7, and 8 sites.

This is why most people opt for a SaaS content and commerce platform. With a SaaS content and commerce platform, there is nothing to install, update or maintain. The vendor takes care of all technical issues so you can focus on creating and managing content