(I just posted this under the book entry, then decided to make it a forum posting as well.)

I've just started working my way through the book and I am already confused. The publishing date says "First Printing: January, 2017" so I would have thought everything would have been verified by then.

One of the first modules being recommended to be installed is the Redirect module (Chapter 3 | Basic SEO Part 1, page 40). Yet when I go to Drupal to obtain it, the first thing that jumps out at me is the red box at the top of the page and the red badge later in the listing saying:

"This project is not covered by Drupal’s security advisory policy."
and
"Use at your own risk! It may have publicly disclosed vulnerabilities."

That's not good.

Next, none of the download versions are listed in green, meaning they are safe and ready to go: they're still pre-release for Drupal 8. The development version is 8.x-1.x-dev which came out 2017-May-19 and the "official" version is 8.x-1.0-alpha5 which came out 2017-Apr-14. (I find it odd that there does not seem to be any stable versions for Drupal 7 either.)

So why, five months after the book was released, is there still not an officially released version of this module? And why would the author encourage installing something that does not meet Drupal's own security policy?

How many other similar land mines are there in the rest of the book? I'm definitely not going to install anything that Drupal itself feels has security issues.

Comments

sprite’s picture

The following modules, in my opinion, are most important for SEO, along with website features like a modern responsive theme and social media links (both of which google and bing add onto SEO score).

Drupal (7 or 8) SEO modules (opinion):

https://www.drupal.org/project/metatag - (most important) (1.1 "green" version)
https://www.drupal.org/project/xmlsitemap - (2nd most important) (alpha2 reliabl version - I'm using it)
https://www.drupal.org/project/search404 - (very important)
https://www.drupal.org/project/pathologic - (very internally important)
https://www.drupal.org/project/redirect - (I don't really use this module much)

--

I wouldn't worry about the versioning of these modules much. I've been using them all with good reliability.

The security advisory you saw on the redirect module is about them signing on to an administrative process, but it doesn't mean it's a "bad" module. However, badgering the author to get setup with the security team review system for, is certainly something to badger the module builder about, since its an open source community.

With regard to the redirect module authors not signing onto the security team review, that is more of an administrative matter.

Keep in mind that all these modules are built by real life individual people who contribute their time and energy to them.

Since Drupal is an open source community, I would also suggest that you contact the module authors and offer to contrib to building and running tests and performing QA to help give the author confidence in releasing a version marked "full release".

-

I imagine an entire book on maximizing Drupal SEO might be interesting, but investing the time in a good theme, hand editing all the metatags using the metatags module, and using the xmlsitemap module, will likely get most websites most of the way toward decent search results visibility, IMO.

spritefully yours
Technical assistance provided to the Drupal community on my own time ...
Thank yous appreciated ...

ben finklea’s picture

@sprite
I agree, mostly. You addressed the security warnings pretty well. Thanks!

Your "basics" of SEO is fine. It's a good start and it's going to help. It's not enough, though, if you're in even a mildly competitive industry. I think someone buying the book is looking for the best possible optimization rather than just the basics. It's written for marketing people to be able to "do it yourself", not (necessarily) a developer/themer/programmer who probably just needs the SEO Checklist module for recommendations and can do everything already.

Hand editing all the meta tags may be unreasonably time-consuming except for the smallest of sites. The book goes through a lot of tokens and settings for Metatags so that you can maximize them on a site of any size, too.

And, it has sports quotes. You're not going to get that just by installing the metatags module. ;)

--Ben Finklea, CEO
Volacci

ben finklea’s picture

@Marrer
Thanks for buying the book. I hope it helps.

Writing Drupal 8 SEO was, in some ways, a struggle for the very reason that you point out in your post. That is, Drupal is more than simply software. It really is a community of people who use and contribute to the code in many ways. Contrib modules are one of the biggest values and biggest headaches for anyone using Drupal, much less the guy trying to put down on paper the "right" SEO module to use for everybody who might buy the book.

It's complicated because, as a tech author, I strive to find the balance between the cutting-edge and irrelevance. In other words, this book came out more than a year after Drupal 8 was released but before many of the modules were finalized. (ouch) Do I move forward with a cutting-edge book and trust that most of the modules will get full releases soon or wait and risk being outdated because Drupal 9 has shipped already? (It hasn't but nobody knows when it will.)

Will that popular module that was great in Drupal 7 and has a dev release for 8 be the right recommendation three months from now when the book hits the shelves or will some other module come along that does the same thing in a better way? There's no right answer, unfortunately. I made educated guesses based on how many sites use the new module, the developer working on it, and competing modules.

So far, I mostly got it right. With some exceptions, I'm pretty confident in the module recommendations. To address the Redirect module in particular, I think @sprite did an excellent job of explaining why the Drupal security team does not cover it and how you can help make that happen.

Are there other similar land mines in the rest of the book? Almost certainly. Drupal is dynamic. The modules that I recommend are constantly changing, and so is Core. That's a good thing! It means that new features, bug fixes, documentation, and stability releases continually improve your website. With the growth and evolution of all the pieces of Drupal, there is always a chance that something I recommended no longer works the way it is supposed to. If that happens, go to the module page, look on the right where it says "Issues for [module name]" and file a ticket. You'll find that many people want to help, including the module author.

If you think the module is no longer the right recommendation, go the SEO Checklist module and file a ticket. I'll update the module with your recommendation. In fact, there are two examples of changes I would make in a "2nd edition" if that ever happens: I prefer the Google Tag Manager to Google Analytics and now I would recommend the Schema Metatag module over RDF UI. 5 months; 2 not-minor changes. That's just the way it goes in high-tech!

Drupal happens because people like you and I help. Maybe you code and can contribute a module to addresses a need. Maybe you can write documentation or test other people's code. Maybe all you can do is support other users who have had problems that you already know how to solve! That's great! That's basically what this book is: I've solved a lot of SEO problems so here's what I did.

If you want some suggestions on how to contribute, look here: https://www.drupal.org/contribute

Here are a few tips to get you through the minefield:

1. If in doubt, get more information. Install the module in question on a dev version of your site. (Companies like Platform.sh and Pantheon have excellent systems for quickly making copies of your website.) Read what other people have done. How many people are using the module now? That number is near the bottom of the module page. How essential is the module? i.e. what does it do and do you need it? If the answer is no, maybe you hold off until you can find out more.
2. If the security team does not cover it and that bothers you, you don't have to install it. I think a module safe and useful but you may not. That's fine. But, don't throw the baby out with the bathwater!
3. Ask. As you just did. There's a lot of us and we're happy to help.

Sorry for being long-winded. I truly want you to enjoy and get maximum benefit from Drupal 8 SEO. Thanks again for buying it!

--Ben Finklea, CEO
Volacci

morten-h’s picture

Hello, 

Would you mind commenting on how the book holds up today in 2019? Does the above still apply roughly?

ben finklea’s picture

It holds up surprisingly well after 2.5 years. I haven't done a deep dive back into the book to look for problems but I do keep a list of stuff that I would add/change. I'll paste it below so you can see where my head is at on this topic. Is there a particular idea, module, or setting you have questions about?

Cron: Check with your developer or hosting company first!
Backup and Migrate module using Pantheon’s NodeSquirrel.
Turn on Alt and title tags for images.
Schema.org metatag module in lieu of other Schema modules.
Mark up Breadcrumbs with schema or Schema.org metatag?
Maybe call it structured data as a separate chapter? Would include Schema and site maps
Akismet or some other kind of Spam prevention

An Analytics chapter; 

Chapter : Analytics
The Google Analytics Module vs. GTM
Moz, ahrefs
Tracking goals
Adwords conversion tracking

Is there a D8 equiv to /admin/config/search/clean-urls ?

--Ben Finklea, CEO
Volacci