Security Drupal Maintenance

Drupal security incident plan — what to do when your site is compromised

During a security incident there is no time to start planning. Here is a step-by-step guide that every Drupal site owner should prepare in advance.

Why the plan must exist before the incident

When a site is compromised, you are stressed, clients are calling and every minute counts. That is not the moment to start figuring out what to do. A security incident plan is a document that answers questions before they are asked.

The plan does not have to be long. It has to be clear and accessible — ideally not stored on the server being attacked.

Signs of a security incident

Before responding, you need to recognise that an incident has occurred:

  • Google flags the site as "this site may be harmful"
  • Hosting sends a notification about suspicious activity
  • Unknown pages or redirects appear on the site
  • The admin account no longer works
  • index.php or .htaccess has been modified
  • Unexpected server load you cannot explain

Sometimes there are no signs at all — the attacker is quiet and collecting data.

Step-by-step response

1. Do not panic — document

Write down the first thing that happened and when you noticed it. Log files will be valuable later.

2. Take the site offline

Cut access before analysing. Put the site in maintenance mode via the hosting panel or block public access. Goal: the attacker cannot continue, visitors cannot be infected.

bash
# Drupal maintenance mode from command line
drush state:set system.maintenance_mode 1 --input-format=integer
drush cr

Or simply rename index.php temporarily.

3. Do not delete anything immediately

Deletion destroys evidence. Before cleaning, take a server snapshot if your hosting allows it.

4. Review the logs

Where logs are:

  • Apache: /var/log/apache2/access.log and error.log
  • Drupal: /admin/reports/dblog (if accessible)
  • PHP: php_error.log from the hosting environment

What to look for:

  • POST requests to unknown URLs
  • Access to xmlrpc.php, install.php, update.php
  • File uploads (.php files in the uploads directory)

5. Identify how the compromise happened

Common entry points:

  • Unpatched module — check which modules had known vulnerabilities
  • Weak password — brute force on the admin account
  • Malicious theme/module — nulled themes, untrusted sources
  • Server vulnerability — PHP, Apache, MySQL versions

6. Restore from a clean backup

Cleaning (removing malicious files) is risky — backdoors may be hidden in multiple places. Restoration is more reliable:

  1. Download the last clean backup
  2. Check the backup date — is it from before the compromise?
  3. Restore the file system and database
  4. Do not restore the compromised settings.php or database passwords

If no clean backup exists, manual cleaning is required — more labour-intensive and less certain.

7. Update before going back online

Before making the site public again:

bash
composer update drupal/core --with-dependencies
composer update
drush updb
drush cr

Change all passwords: admin account, database, FTP/SSH, hosting panel.

8. Bring the site back online and monitor

bash
drush state:set system.maintenance_mode 0 --input-format=integer
drush cr

First 24 hours — watch the logs. If suspicious activity continues, the cleanup was not complete.

What to put in the plan document

Keep a separate document (Google Docs, Notion, on paper):

  • Contacts: hosting support, developer phone, Drupal security team (security@drupal.org)
  • Hosting access: where is the control panel, SSH credentials (store securely)
  • Backup location: where is the last backup, how to restore
  • Critical URLs: admin URL, hosting panel, monitoring service
  • Response order: who does what (if there is a team)

Prevention is cheaper than response

A security incident plan is the last line of defence. Before it:

If you would like someone else to handle this, we offer Drupal maintenance services.

Subscribe via RSS
Kaido Toomingas Kaido Toomingas WebPro Company OÜ

Need Drupal help?

If the article describes your situation, you do not have to read everything first. A real person will help you choose the next step.

Contact us