Drupal Security Services: Permissions, Custom Code Audits, and Update Discipline
Most compromised Drupal sites were running a known, published, already-patched vulnerability. This page covers the security work that actually matters — update discipline, permission audits, the checks custom code skips, and what to do if you think you have been compromised.