Recommendations system

If people have webform installed (especially if they collect e-mails) it is good practice to delete old records that are no longer needed. People should ideally download the results table and clear out old results.

http://drupal.org/project/email_confirm seems like a good module

Drupal sites have suffered Denial Of Service attacks when an attacker repeatedly ran the site's cron.php from the URL address line. It would be worth checking for this vulnerability and recommending the simple .htacces restriction described here: http://drupal.org/node/41049#comment-122705

[Edit: 19-Mar-2011] An alternate solution is Cron Keys, which is in core in D7 and a contrib module for D6.

Another recommendation might be that anonymous users not be allowed to comment without administrative approval. Although this might not be right for all sites (perhaps set this check off by default?) for many sites it is appropriate. The attached patch adds this functionality for the 6.x version of the module.

A good recommendation I turn into a requirement in our environment is to ensure that certain security related modules are installed and enabled. Three modules I find are extremely useful are the Syslog, Password Strength, and Login Security module (although the Secure Pages module could probably also make the grade). The attached patch checks for these three modules and makes recommendations about why these might be helpful. Again, it may make sense to have these checks turned off by default, but available if a site admin was interested in a more comprehensive review that included context agnostic recommendations for system hardening.

I poked at this a lot today and came up with a system I think might work. I've attached a patch that includes a couple recommendations (using the modules covered in the patches previously attached). I tried to alter the base structure of the module as little as possible, so recommendations are just security checks that are tagged as recommendations. Also, by default recommendations are turned off (which involved some changes to several functions, most notably security_review_settings and the associated _security_review_settings_submit). I separated the report into two sections, with checks listed at the top, and recommendations listed below. The recommendations are listed in the exact same way as security checks in security_review.checks.inc and the only main designation is in security_review_security_checks by including a new key value pair to the $checks array for 'recommendation'. The patch is working, but I'm sure it is a little rough, so any comments or feedback are welcome.

Also changing status to 'Needs review' but I wasn't sure if it was appropriate to assign myself (feel free to do that though).

As Drupal6 has been EOL https://www.drupal.org/about/drupal6-eol closing as outdated