Drupal and Joomla, like any CMS, need specific security hardening beyond generic VPS security practices. This guide covers the platform-specific measures that matter most for these two systems.
1. Keep Core and Extensions/Modules Updated
Both platforms publish regular security advisories — subscribe to official security mailing lists/RSS feeds and apply security updates promptly, especially anything marked as a critical or highly critical vulnerability.
2. Remove Unused Modules/Extensions
Every installed module or extension, even inactive ones, represents additional attack surface — regularly audit and remove anything not actively in use, rather than leaving disabled-but-installed components indefinitely.
3. Restrict File Permissions Correctly
# Drupal
sudo chmod 755 /var/www/drupal/web/sites/default
sudo chmod 644 /var/www/drupal/web/sites/default/settings.phpConfiguration files should be read-only after initial setup, not writable by the web server user once installation is complete.
4. Restrict Admin Login Access
location /user/login {
allow YOUR_TRUSTED_IP;
deny all;
}For Drupal; adapt the path for Joomla's /administrator equivalent.
5. Enable Two-Factor Authentication for Admin Accounts
Both platforms support 2FA via contributed modules/extensions — enable this for all administrator-level accounts, a significant additional barrier against credential-based attacks.
6. Use Strong, Unique Database Credentials
Never use default or weak database passwords, and ensure the database user has only the specific privileges the CMS actually requires, not broader administrative database access.
7. Disable Directory Listing
autoindex off;Prevents browsing the raw file structure directly, which could reveal information useful to an attacker.
8. Set Up a Web Application Firewall
See How to Set Up ModSecurity Web Application Firewall for Nginx/Apache — provides an additional protective layer against common attack patterns, including many targeting known CMS vulnerabilities specifically.
9. Regularly Back Up Before Updates
Always take a fresh backup immediately before applying core or extension updates — see How to Set Up Automated VPS Backups, since updates occasionally introduce compatibility issues requiring rollback.
10. Monitor for Unauthorized File Changes
File integrity monitoring can detect unauthorized modifications to core files, often an early indicator of compromise — see file integrity monitoring guidance in the Advanced Security & Compliance category.
11. Review User Roles and Permissions Periodically
Both platforms support granular permission systems — periodically audit who has administrative access and whether that access is still appropriate, removing accounts for departed team members promptly.
12. Secure the Installation/Update Directories
Ensure any installer or update-related directories that shouldn't be publicly accessible post-setup are properly restricted or removed, as covered in each platform's specific installation guide.
Common Errors
Site compromised despite "being updated" — verify ALL components (core, theme, every module/extension) are current, not just the core CMS itself; outdated extensions are a very common attack vector even on an otherwise updated site.
Continue Reading
Browse more articles in CMS Platforms Beyond WordPress.
