Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Give away signs that a site is Drupal? [closed]

Tags:

drupal

I'm trying to alter my site in such a way so that when people view it, they don't know it's powered by Drupal. So, was wondering if there are any signs that give this away that I should know about?

Some of the giveaways I know of, are:

  1. When adding content, it will say "node/add".
  2. If the following file exists: misc/favicon.ico

etc

I'm looking for similar stuff?

like image 418
coderama Avatar asked Oct 04 '09 14:10

coderama


1 Answers

Let's look at a fairly customized page based on Drupal: http://gemini-lights.com/ (a random page from the Drupal sites repository). There are many giveaways:

  • if you change www.example.com/link/link2 to www.example.com/?q=link/link2 and it still works and points to the right page
  • www.example.com/user/1 gives you a profile page
  • resources (imgs, css, etc) are in /sites/all|example.com/themes/ or sth similar
  • there are CSS classes applied to many key elements of the site (like body) that do not change appearance - Drupal uses them to provide some info about the state of the page (like <body class="front not-logged-in page-front-page two-sidebars">)
  • probably many others

My advice is: don't try too hard with hiding the CMS of your website, if a hacker wants to find out what CMS you are running, he/she will find out. I'd focus on keeping the CMS up-to-date (Drupal makes this easy) and also watching out which modules you are installing - they are the most likely attack vectors.


Since this question is still getting many hits, let me update it with an example of a website of a major company (one of the biggest telephone companies in Poland), that, to my (pleasant) surprise ,is using Drupal for its main site, http://dialog.pl/:

  • The usual giveaway pages like /user/1, /login, etc. redirect to main page, so you can see the creators of the site have done their homework ;)
  • ...but the source of the page contains my favourite give away: the usage of the zen theme: urls like /sites/all/themes/zen-dialog-main-page/../zen/css/page-strona_glowna.php or CSS styles applied: <body class="front not-logged-in node-type-page two-sidebars">
  • One more give away is the update.php page that has the familiar Garland theme (props to Kevin for this one).

As you can see, it's still possible to tell that the website is using Drupal - and this is a website of a major corporation. So the above advice still holds: don't waste your resources on trying to hide the CMS you used, keep it up to date (that's why the update.php file is probably still in place), monitor security vulnerabilities, use strong passwords, etc.

like image 194
Igor Klimer Avatar answered Nov 05 '22 15:11

Igor Klimer