This project is not covered by Drupal’s security advisory policy.
Site Lens puts the question "is this site safe right now?" on one screen, and answers it with what drupal.org and your own configuration say.
Core's update report tells you when a release is out. It does not tell you that a module you rely on has no security coverage, that its maintainer has stepped away, or that nobody has released anything in three years. Site Lens shows those next to the security releases, then checks 19 permissions and settings on the same page.
What it checks
Drupal core and every installed project, against drupal.org
- Security releases you have not applied
- Versions and branches that are no longer supported
- Releases pulled from drupal.org
- Releases with no security coverage (alpha, beta and projects that have not opted in)
- Development versions
- Projects seeking a maintainer, abandoned or no longer developed
- Projects with no release in three years
19 permissions and settings
- Dangerous permissions held by anonymous or authenticated users
- Unfiltered HTML available to ordinary users
- Number of administrators, forgotten administrators, obvious usernames, no two-step login
- Open registration without email verification
- update.php access, settings.php permissions, trusted hosts, HTTPS
- Visible PHP errors, development modules left on, insecure uploads, risky upload fields
- Private file folder, login flood control, cron
How it works
Press Scan this site. The verdict is a single number on a field of colour, followed by what to fix first. You can ignore a finding you have accepted and bring it back later. The result also appears on the Status report.
Turn on email in the settings and cron will scan on a schedule. You get an email only when something new appears, never a weekly repeat of what you already know.
Requirements
- Drupal 10.3 or newer, Drupal 11 or Drupal 12
- PHP 8.1 or newer
- Outbound access to updates.drupal.org and www.php.net
No other modules are required. Update Manager does not need to be on.
Install and use
- Install it as you would any module.
- Give "Use Site Lens" to trusted roles only. The permission is marked as restricted.
- Open Reports, then Site Lens, and press Scan this site.
- To get alerts, open Configuration, System, Site Lens.
Privacy
Site Lens asks updates.drupal.org about each project by name and reads php.net's list of supported versions. It sends no site key and no information about your site. It makes no changes to your site.
Limits
The lists only cover problems that have been reported, so a clean result is not a guarantee. Site Lens does not scan files for malware.
Project information
- Project categories: Administration tools, Security
- Created by medamine.web@gmail.com on , updated
This project is not covered by the security advisory policy.
Use at your own risk! It may have publicly disclosed vulnerabilities.
