June 26, 2016
NEWS
February 24, 2025
- Services
Datasheet
Security is not a feature you add at the end of a project. It is a posture you maintain, and for any organization running a public website it is now a board-level concern. Intruders, credential thieves, and automated bots probe sites continuously, and the cost of a breach lands on reputation and revenue at the same time.
Drupal is one of the more secure content management systems available, which is a large part of why enterprises, governments, and universities choose it. That security comes from two things: a dedicated security team that ships coordinated advisories and consistent updates, and a contributed module ecosystem that lets you harden a site well beyond the defaults.
The catch is that a platform is only as secure as the way you run it. The modules below are the ones we reach for most often when hardening a Drupal site, all verified as actively maintained for current Drupal. We have kept the five that have anchored this list for years, updated where the landscape moved, and added the modern defenses that were missing.
Quick answer: The core Drupal security modules to install are Password Policy (with Password Policy Pwned), Security Kit, Security Review, Username Enumeration Prevention, and Generate Password. On top of those, add Two-factor Authentication, Content-Security-Policy, CAPTCHA, and Automated Logout. All are actively maintained for Drupal 10 and 11.
1. Password Policy: enforce strong credentials
Password Policy is actively maintained for Drupal 10 and 11, and it addresses the single biggest risk in the data above: weak and reused passwords. The module lets you define a set of constraints that a password must satisfy before Drupal accepts it, each configured as a plugin.
You control the structure of every password: minimum length, capitalization, numbers, special characters, and rules against reuse. You can also set password expiration, so a user is prompted to change a credential (or is blocked from logging in) once it ages out.
The addition worth making today is Password Policy Pwned, a companion that checks new passwords against the Have I Been Pwned database of known breached credentials and rejects any that have already leaked. Enforcing complexity is good; refusing a password that is already circulating on the open web is better.
2. Security Kit: harden your HTTP headers
Security Kit reduces the risk of several common web application attacks through configuration rather than code, and it remains actively maintained for current Drupal. It covers four areas: cross-site scripting, cross-site request forgery, clickjacking, and transport security.
In practice, Security Kit lets you set browser-enforced protections without touching your theme. It manages content and framing policies to blunt cross-site scripting and clickjacking, controls the Origin header to limit request forgery, and enables HTTP Strict Transport Security so browsers refuse to connect over unencrypted HTTP. These are the headers a security audit will ask about, exposed as checkboxes.
3. Security Review: catch configuration mistakes
Security Review automates the check for easy-to-make mistakes that quietly leave a site exposed, and it is maintained for Drupal 10 and 11 with use reported on more than 16,000 sites (Drupal.org).
The module runs a checklist against your configuration and reports what needs attention: unsafe file system permissions that could allow arbitrary code execution, dangerous tags allowed in text formats, error reporting that leaks information, the safety of private files, and which roles can upload or execute extensions. It does not change anything automatically. It gives you a prioritized list, and you decide what to fix.
4. Username Enumeration Prevention: hide who your users are
Username Enumeration Prevention stops attackers from discovering valid usernames, which is the reconnaissance step before a targeted brute-force or phishing attempt. It is maintained for Drupal 10 and 11.
Modern Drupal core has closed some of the gaps this module originally addressed, including the classic trick of probing the password reset form to learn whether an account exists. The module still adds hardening on top of core, most notably by blocking the canonical /user/[uid] URL that would otherwise expose an account. If your site handles sensitive user data, it is a low-cost layer worth keeping.
5. Generate Password: remove weak passwords at registration
Generate Password makes the password field optional on the registration form and generates a strong system password when a user does not set one, and it is maintained for current Drupal. This removes a whole category of weak, human-chosen passwords at the point of account creation.
As an administrator you configure the generated password to your requirements: length, entropy, character composition, the algorithm used, and whether the password is displayed to the user at creation. Combined with Password Policy, it gives you control over both the passwords people choose and the ones the system creates for them.
What security modules does a modern Drupal site still need?
The five above are the foundation. These are the defenses that have become standard since this list first ran, and leaving them out is now the more common mistake.
Two-factor Authentication (TFA)
The Two-factor Authentication module is the most important addition to this list. Given that stolen credentials drive the majority of web application breaches, a second factor is the difference between a leaked password being an inconvenience and being a compromise. TFA supports authenticator apps (TOTP) and integrates with services like Duo, and it is maintained for Drupal 10 and 11. Install the current stable release rather than a pre-release branch.
Content-Security-Policy
The Content-Security-Policy module sets CSP headers that tell the browser which sources of script, style, and media it is allowed to load, which is one of the strongest available defenses against cross-site scripting. It complements Security Kit and is maintained for Drupal 10 and 11.
CAPTCHA and Honeypot
The CAPTCHA module (often paired with reCAPTCHA) and the Honeypot module block automated form submissions that flood a site with spam and probe for weaknesses. Honeypot is the lighter, less intrusive option for most forms; CAPTCHA is the stronger challenge for high-value ones such as login and registration.
Automated Logout
The Automated Logout module ends inactive sessions after a defined period, which limits the exposure of an unattended, logged-in browser. For organizations with compliance requirements around session management, it is often a checkbox on the audit.
Beyond modules: The most important security practice is not a module at all. Keep Drupal core and every contributed module current, and subscribe to the Drupal security advisories. Note that Drupal 7 reached end of life in January 2025, so any site still on it no longer receives security coverage and should be migrated.
Get these configured out of the box with Varbase
Installing and configuring each of these modules correctly takes time, and a misconfigured security module can give a false sense of protection. This is where Varbase, the enhanced Drupal distribution built and maintained by Vardot, does the work for you.
Varbase bundles and pre-configures a security feature that includes several of the modules above, so a site starts from a hardened baseline rather than an empty one. It also standardizes configuration, speeds up development, and is kept current with Drupal, with recent releases supporting Drupal 11. For teams that want the security posture without assembling it by hand, it is the shortcut we recommend.
Not sure how exposed your Drupal site is?
Request a Vardot security review
FAQs
The foundation is five modules: Password Policy for strong credentials, Security Kit for HTTP header hardening, Security Review to catch configuration mistakes, Username Enumeration Prevention to hide valid usernames, and Generate Password to remove weak passwords at registration. Modern sites should add Two-factor Authentication, Content-Security-Policy, CAPTCHA or Honeypot, and Automated Logout. All are actively maintained for Drupal 10 and 11.
Yes. The Two-factor Authentication (TFA) module adds a second login factor using authenticator apps (TOTP) and services like Duo, and it is maintained for Drupal 10 and 11. Because stolen credentials drive most web application breaches, 2FA is now considered essential rather than optional. Install the current stable release rather than a pre-release branch.
Yes. Password Policy, Security Kit, Security Review, Username Enumeration Prevention, and Generate Password all have actively maintained releases compatible with Drupal 10 and 11. Note that modern Drupal core now handles some cases the Username Enumeration module originally addressed, such as the password reset form no longer revealing whether an account exists.
Combine three modules. Password Policy enforces length, complexity, reuse, and expiration rules. Password Policy Pwned rejects any password found in the Have I Been Pwned breach database. Generate Password creates strong system passwords at registration so users cannot choose weak ones. Together they control both chosen and system-generated credentials.
Drupal is among the more secure content management systems, backed by a dedicated security team and coordinated advisories. Staying secure depends on how you run it: keep core and all contributed modules patched, subscribe to Drupal security advisories, add the hardening modules above, and migrate off end-of-life versions. Drupal 7 reached end of life in January 2025.
Join the conversation +
People Also Viewed
August 23, 2020
