Security Through Obscurity

Bryan Jones
Bryan Jones | Monarch Digital
Contact Author

While security through obscurity is often looked down upon, it can really help your site against newbie hackers. By default, Drupal shows files such as CHANGELOG.txt, INSTALL.txt, and README.txt. These files contain information about your current Drupal distribution that could potentially be used to wreak havoc on your site.

As a test, type your site name with CHANGELOG.txt as the path. For example www.site-name.com/CHANGELOG.txt. You will see that this brings up a text file with the current version of your site. A hacker can use this to see if you are on an older version. They can then look up security flaws for the version you are on and use this to start attacking your site.

Preventing these files from being shown is quite easy. In your .htaccess file found at your document root, just add these lines:

<FilesMatch "^(CHANGELOG|README|INSTALL|MAINTAINERS).*\.txt$">
  Deny from All
</FilesMatch>

The code will look for any file in the format of the names presented in the regular expression above. This will catch files such as CHANGELOG.txt and also INSTALL.*.txt. While hiding this files will not guarantee site safety, it does give you a little boost against would be hackers.

We would like to thank Greggles for contributing the following post: http://drupalscout.com/knowledge-base/hiding-fact-your-site-runs-drupal-or-fingerprinting-drupal-site which gives a much broader aspect to this type of "security".

Blog Type: 
Technical