By cmsdummy on
A friend's drupal site was hacked. I helped set up the drupal site 5 years ago and I don't think anyone else has done much to it since then. It was hosted on bluehost. Her web site has very low traffic. It's more like a prototype. The total number of people who visited the site is probably less than 200. I'm surprised the hacker knows about the site.
Is there a drupal specific hosting service that requires no installation of drupal, automatically updates drupal, and support https easily? I'm no security expert and no CMS expert, but I think this would make her site less likely to get hacked.
Kind of like wordpress.com for the wordpress platform -- alot of automation and restrictions.
Comments
Acquia, Pantheon and Platform
Acquia, Pantheon and Platform.sh are the trusted hosting partners for Drupal websites.
You can go with one of them.
Thanks,
Siteground
Siteground has https by default. Has Drush and Composer preinstalled so updates are easy and if it is a low bandwidth site. Hosting should be very inexpensive. This is where I host for my non profits. You did not mention your version of Drupal, but since it was 5 years ago I am assuming it was Drupal 7. If that is the case, now might be the time to upgrade to Drupal 8 since it is more secure and has a path from Drupal 7 now.
I haven't really heard anything good or bad with them
I haven't really heard any really good or bad things. But there is a small list of things I probe for now since I got ripped off by an ISP that doesn't allow me the basic security settings:
1. be able to turn on secure cookie always, rename cookie, and redefine session start path
2. be able to install a SSL cert for mysql connections.
3. be able to install keys for remote SSL SQL (client connects). I'm still able to do this dynamically with php, but installing it in the my.cnf the correct way reduces the size of the php file.
My suggestion
I've recently hosted my website with BGOcloud and i find their services very secure. The easy-to-use control panel is a great thing as well. They give SSL certificates, SSD storage, CageFS, CloudFlare CDN, etc.
I've recently hosted my
Would you care to share the domain you host with them? (I generally advise people not to trust any review for a hosting provider unless it can be verified. It's no reflection on you, but sadly there are many unscrupulous hosts out there who pose as a customer to recommend their own services.)
This signature is currently blank
Sitelock For Drupal
Did you tried Sitelock subscription for Drupal, Most of Hosting Providers are Providing this services, and it's Paid Service, They Are Good at stopping spammers.
you should secure your server, no matter where you go...
I think you should secure your server properly. None of the hosting services do this automatically. They might do some things, but not everything. I have ran websites for decades and those "extras" like sitelock is nothing out of what you can do for yourself.
1st thing to do is block all the search engines. you load a robots.txt file in the root and tell it to disallow all and just allow the index page. Put the robots meta tag in the index page with this argument: index, no follow
2nd, you lock down direct access to the drive. This is accomplished with the hot link icon in your cpanel. However, I do encourage for people to learn all about mod_rewrite.
3. move the php session cookie one directory back. I would even install this CMS back one directory, use a clean html page as the index. that away when you log out, your session cookie is cleanly deleted at your computer and server. Otherwise, the server will have to spend extra time during cron housekeeping if you got a lot of traffic.
4. I almost forgot: turning off error reporting in php options. This is important as some server/php combinations will reveal the application's user name and password for the mysql server in its error code. This issue here is what gets missed a lot everywhere out there. turning off the error reporting is just the display on the screen, and you should always look to see if an error log has been written in the directory first, before fixing anything.
I am getting my feet wet with drupal (no pun intended) on 8. I tried 6 years ago and ran away from it because it was full of security holes and it was easier for me to write a cms from scratch instead of fixing drupal. I'm going to run 8 through the wringer on a system just to see if its a viable platform yet to support.
1st thing to do is block all
Seriously?
That doesn't secure your server at all. Malicious bots pay no attention to robots.txt anyway.
But responsible bots do pay attention to it. Like googlebot.
So all you're doing is guaranteeing that nobody will ever find your site using a search engine.
This signature is currently blank
YMMV
I only allow them to index just the index page. Since they have no business in the other directories. Another reason to move any database back one directory is that php index pages scores lower in google's and lycos(bing) algorithm. As far as the misbehaving bots, .htaccess stops them in their tracks. I also incorporate ip blocking. There isn't a real intelligence yet with vpns you either block all of them or none. Its kinda sad that ISPs are using vpn type routing in parts of the EU because if I block all vpns the good ones will be blocked too.
MM Does V
I can't speak for your site, but the content people would search for is typically dotted across the site. There's specific info on particular pages that people find because they're looking for it, and keywords on those pages are what send the search engine traffic my way.
If I only indexed the homepage, I'd lose 99% of my traffic.
Up to you - each to their own ;-)
This signature is currently blank