Jakub Woźniak

Have you ever shaken your head in disapproval while reading code when you were working on a project? Have you at least once thought to yourself: "This isn't optimal code – it's possible to write it better and more efficiently"? Does adding or changing a theoretically small functionality on your page cause countless problems and require introducing changes to many other areas?

Only 36.4% of web content is in all known languages except English. As much as 63.6% of all content is in English. If you want to open up to new audiences and until now, the texts on your website have been written in a language other than English, consider whether your website needs support for multilingualism. However, if you already create content in English and want to enter the French market, for example, a multi language website will also be helpful.

A blog is the part of a website where authors publish posts on a specific topic. It may be a separate part of a web page or actually cover the entire content of a particular site. Both private and corporate portals often have blogs. Due to their popularity, we've prepared a simple way to place your blog in Droopler, our Drupal distribution.

Pentesters use various tools during an audit to save time and find as many security errors as possible. Some activities can’t be done manually within a reasonable time. An example is the detection of all subpages of a website. There are paid and free tools that allow this to be done. Vulnerability scanners are also created and actively developed. They include solutions that support pentesting.

Even the best security audit of a website or application will be of little use if we don't document the detected threats, steps for reproduction, potential threats resulting from their use, and recommendations for fixing the bug. We'll show you how to prepare a detailed report step by step.

For laying out content on a website, Drupal standardly uses a single body field that takes advantage of the WYSIWYG capabilities and is available immediately after installation of the CKEditor. This solution is easy to use but not flexible enough to be suitable in every case. For more advanced layouts, we can use the functionality prepared by the community in the Paragraphs module.

Website reconnaissance is one of the elements of a security audit. This task can be automated to some extent by choosing one of the free, open-source programs available on the web. One of such tools is Droopescan.

When creating content for a website, it is sometimes necessary to plan its publication later down the line. However, taking care of it manually can be both time-consuming and inconvenient. This is when Scheduler comes in handy – a Drupal module that will help you automate this process. Using it will allow us, among other things, to schedule the publication of content for a specific date and time.

The security of the solutions we provide is a very important factor for us. Due to this and the fact that Drupal is the safest CMS, in this article, we'll present the list of recommendations that'll take the security of your Drupal website to an even higher level.

In the previous parts, we focused on Drupal configuration and the overview of modules and libraries. In the third part of the series on conducting a security audit, we'll focus on the overview of custom modules and themes. We'll perform an audit of the project repository, identify and analyze the elements worth paying attention to during the auditing process.