Drupal-check.org - Drupal 5.x

Check modules and themes directories

jchatard — Mon, 15 Jun 2009 10:18:37 +0000

There are some conventions when using contributed modules and/or themes. Most users would want to place them in modules and themes folders.

Don't ever do that! Never place modules or themes in these directories!

Everything added to a fresh Drupal install should go somewhere in the sites directory:

Contributed modules (from drupal.org) should go in sites/all/modules/contrib
Project custom modules should go in sites/all/modules/custom
Contributed themes (from drupal.org) should go in sites/all/themes/contrib
Project custom themes should go in sites/all/themes/custom

Note that if you have a multisite environment, you could place somes of the modules/themes:

in sites/default/..
or sites/example.com/..
or sites/anotherdomain.com/..
and so on..

... depending on your configuration.

Note that using a contrib and custom directory convention will help you find out which modules are contributed by the drupal community and which you have developped specifically for the website.

This will allow you to update more easily your websites as the only directory you will need to preserve will be sites/*.

Make your module translatable

jchatard — Mon, 15 Jun 2009 08:45:08 +0000

To let users translate your module strings, you must use the t() function. This allows the Drupal community to create translation files *.po. But this also allows user to tweak some strings to fit their needs, with the String Overrides module.

So everytime your write a sentence or a word in your module, surround your string with the t() function.

This is the bad way:

$foo = "Thank you for your submission";

This is the good way:

$foo = t("Thank you for your submission");

Note that you must always write your module strings in English as this is the default language in Drupal and is used as a base to provide the localization system.

You will need to insert values in your strings:

Don't write:

$points = 3;

$foo = t("You just won $points points");

This is the good way to insert placeholders values:

$points = 3;

$foo = t("You just won !points points", array('!points' => $points));

Check out the resources links to learn more about t() function use.

Note that starting with Drupal 6, you can also make your JavaScript files translatable.

In your code use Drupal.t() function. Example:

greetingMessage = Drupal.t("Your vote has been saved!");

Stop logins being remembered

Fonant — Mon, 28 Sep 2009 21:23:43 +0000

By default Drupal will keep people logged in for 23 days (2000000 seconds) by saving a cookie in their browser. This is nice, but a potential security problem if people are using the site from shared computers.

Consider editing the site's settings.php to have

ini_set('session.cookie_lifetime',  0);

instead of the default

ini_set('session.cookie_lifetime', 2000000);

With the former, the user's login will be forgotten when they close their browser window, even if they forget to log out explicitly.

Turn off error reporting display

jchatard — Fri, 12 Jun 2009 13:33:16 +0000

Go to Site configuration > Error reporting
Set Error reporting list box to Write errors to log
Save configuration

Use Drupal replacement functions

jchatard — Mon, 15 Jun 2009 08:56:58 +0000

When developping a module, we often use some commonly used PHP functions. As you may not know Drupal provides some overrides for these functions. They are often related to strings, they have the same name as their PHP native equivalent except that they are prefixed with drupal_. Here is a list of PHP functions you should replace with its Drupal equivalent:

Replace strlen() with drupal_strlen()
Replace strtoupper() with drupal_strtoupper()
Replace strtolower() with drupal_strtolower()
Replace ucfirst() with drupal_ucfirst()
Replace substr() with drupal_substr()
Replace eval() with drupal_eval()
Replace clone with drupal_clone()

For more on this, you should read includes/unicode.inc and includes/common.inc.

Install the Boost module

ghazlewood — Tue, 16 Jun 2009 09:17:23 +0000

Consider installing the Boost module to create static HTML versions of pages that are served anonymously. Cached pages don't even use PHP (they are served as .html files) let alone create or use queries in MySQL so caching is super fast. Cached pages can be cleared on a regular basis with cron. Works with multisites and provides speed improvements to almost any Drupal site. Requires modification of default .htaccess file.

Disallow odd usernames

jchatard — Fri, 12 Jun 2009 15:54:10 +0000

It is recommended that you prevent users from registering on your website with some odd usernames like:

root
admin
administrator
webmaster

To prevent this from happening:

Go to Administer > User management > Access rules > Add rule
Set Access type to Deny
Set Rule type to Username
In Mask type root
Click the Add rule button

Repeat this for every username you don't want to be created on your site.

Google Analytics

kwinters — Mon, 06 Jul 2009 14:09:29 +0000

Google analytics is a free and useful tool for getting information about your site visitors, and there is little reason not to set it up on your site before launch.

You will need a GA account, and know it's account number. Install the GA module linked, and enter the account number into /admin/settings/googleanalytics and customize if desired.

When using GA in Germany you have to publish "datenschutzrechtliche Hinweise" on your site to inform users, that some of their data - e.g. IP-adress - will be tracked. Normally you set up a text block in your imprint. Using GA is maybe not conform with contemporary requirements of protection of private data.

Move .htaccess content to Apache config

jchatard — Mon, 15 Jun 2009 13:10:28 +0000

Having an .htaccess file is a pain regarding performances. Apache needs to read it on every single request (the page, every image, CSS files, JS files, etc.).

It is strongly recommended to move rules defined in Drupal .htaccess file in your Apache global configuration or in your vhost configuration file. This way all rules are only loaded 1 time, during Apache start.

To achieve this, just copy/paste your .htaccess content in your Apache server configuration file and don't forget to surround it by the directory where your Drupal install resides.

<Directory /var/www/path/to/drupal/directory/>

  AllowOverride None

  ###      ALL YOUR .HTACCESS CONTENT GOES HERE    ###

</Directory>

Note that we added AllowOverride None to prevent Drupal .htaccess to be read by Apache.

Check for syntaxe error:

$ apachectl configtest

And restart Apache:

$ apachectl restart

Note that if you are on Plesk, you must use the following command before restarting Apache:

$ /usr/local/psa/admin/sbin/websrvmng -u --vhost-name=example.com

Remove TXT files

jchatard — Mon, 15 Jun 2009 07:47:08 +0000

Drupal comes with a set of TXT files at root level (things like install instructions, upgrade instructions, etc.). To avoid malicious users to have information on the Drupal version you are using, it is strongly recommended to remove those files.

From the root directory of your installation, remove the following files:

CHANGELOG.txt
COPYRIGHT.txt
INSTALL.mysql.txt
INSTALL.pgsql.txt
INSTALL.txt
LICENSE.txt
MAINTAINERS.txt
UPGRADE.txt

Whether or not these files contains security information (like Drupal version for example), the all contain a CVS header that gives a really precise version information on your Drupal installation.

Enable cache

jchatard — Thu, 11 Jun 2009 16:56:06 +0000

Go to Administer > Site configuration > Performance
Set Caching mode to Normal or Agressive
Set Block cache to Enabled
Save your settings

In regards to page compression, you will find on admin/settings/performance a description that looks like By default, Drupal compresses the pages it caches in order to save bandwidth and improve download times. This option should be disabled when using a webserver that performs compression. To find out whether your server already performs compression have a peek at /etc/httpd/conf/httpd.conf (CentOS/Redhat) or /etc/apache2/mods-enabled (Debian/Ubuntu) to find out if the module mod_deflate is called. If so, turn off page compression.

You're done!

Escape accents with Pathauto

jchatard — Mon, 15 Jun 2009 12:09:19 +0000

If you what Pathauto to transform caracters with accents into simple letters like:

éèêë to become e
àâï to become a

You must enable in Pathauto the option Transliterate prior to creating alias. But by default, you can't tick the checkbox.

You first need to rename a file. From within the Pathauto directory, rename i18n-ascii.example.txt to i18n-ascii.txt. Once renamed, you can enable the option from the Pathauto settings form.

Reduce HTTP requests

jchatard — Fri, 12 Jun 2009 15:14:05 +0000

Go to Site configuration > Performance, in Bandwidth optimizations section:

Set Optimize CSS files to Enabled
Set Optimize JavaScript files to Enabled
Save your settings

It is recommended to put JavaScript files at the bottom of your document (i.e. your theme page.tpl.php). Here is an example with Garland, but it should be the same with other themes. Search for the line <?php print $scripts ?>:

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="<?php print $language->language ?>" lang="<?php print $language->language ?>" dir="<?php print $language->dir ?>">

  <head>

    <?php print $head ?>

    <title><?php print $head_title ?></title>

    <?php print $styles ?>

    <?php print $scripts ?>

  </head>

Cut and paste it just before the <?php print $closure ?> statment and before the closing </body> tag, as shown below:

  <?php print $scripts ?>

  <?php print $closure ?>

  </body>

</html>

Setting up cron

fp — Fri, 19 Jun 2009 01:00:23 +0000

Cron is a deamon which triggers certain actions (cron jobs) at configured times. Windows has an equivalent system called Task Scheduler. Calling cron.php at regular intervals will allow, amongst others, the indexation of content the content and to check for updates.

Setting up a cron job under a *nix system is fairly easy.

Create or edit a crontab by typing in a terminal crontab -e
Assuming that you have one of the following programs on your system, add one of the following line to trigger a request to cron.php every hour:
- 0 * * * * /usr/bin/wget -O - -q -t 1 http://example.com/cron.php
- 0 * * * * /usr/bin/lynx -source http://example.com/cron.php
- 0 * * * * curl --silent --compressed http://example.com/cron.php
Save and exit your editor.

Setting up cron jobs on Windows is almost as easy! See Resources below.

Drupal logs information about cron jobs. Once you have configured it, you should see entries in your logs (Administer > Reports > Status report and Administer > Reports > Recent log entries) indicating the status of the related tasks.

Disable unecessary modules

jchatard — Mon, 15 Jun 2009 09:50:52 +0000

You can gain performances by disabling unecessary contributed modules from your live site. Here is a list of modules you can safely disable on a production site:

Devel
Devel generate
Devel node access
Performance Logging
Theme developer
Advanced help example
ImageCache UI
Views UI

Set your front page

jchatard — Mon, 15 Jun 2009 09:54:54 +0000

By default Drupal front page lists all nodes promoted to front page. We will often want the front page to display something different (a View, a panel, a node, etc.). To do so:

Go to Administer > Site configuration > Site Information
Set Default front page to the path of your View, Panel, node or anything.
Save your settings

Note that the default value for Default front page is node.

Contact Forms

kwinters — Mon, 06 Jul 2009 13:46:57 +0000

There are a number of settings for contact forms that are easy to miss, since they aren't readily visible on the site. After you are sure that all the settings are right, you should also submit a test contact on every unique contact form to make sure the email address actually works.

The Site Information settings page at /admin/settings/site-information contains the from address setting.

/admin/build/contact has "To:" addresses and auto-responders, etc.

If you use Webforms, there are similar settings at /admin/settings/webform and per-node at /admin/content/webform (minimally, check the to address in each webform node).

Customize your 404

jchatard — Mon, 15 Jun 2009 09:18:50 +0000

Create a node (a page content type for example) with some extra information so that your visitors don't ever fall on the default 404 page not found.

Once this node is created:

Remember its node ID,
Go to Administer > Site configuration > Error reporting
Set Default 404 (not found) page to the node ID you just created
Save your settings

You can alternatively use the Search 404 module.

PHP tags usage

jchatard — Mon, 22 Jun 2009 16:37:43 +0000

Use full PHP tags

Write:

<?php print $foo; ?>

Don't write:

<? print $foo; ?>

Semicolons
Write:

<?php print $foo; ?>

Don't write:

<?php print $foo ?>

No closing tags
When writing a module or customizing your theme template.php, don't use PHP closing tag ?>.

Notice that at the bottom of the following snippet, there is no PHP closing:

<?php

// Your file starts here

function phptemplate_foo() {

  return $bar;

}

// Your file ends here

// Don't add PHP closing tag

By doing this you prevent PHP interpreter to stop and restart on the next source code file. This mean better performance.

Protect email adresses

jchatard — Wed, 08 Jul 2009 14:35:05 +0000

Sometimes, you need to enter email adresses in your content. Good examples are your About page, or even your Contact page. But this the better way to get spammed!

It is strongly recommened to install a module such as SpamSan:

Download and activate SpamSan module
Go to Site configuration > Input formats

For each of your input format do the following:

Click on Edit
Check that Hide email addresses is enabled and save
Click the Rearrange tab and set Hide email adresses with a super high weight (10 for example)
Click Save configuration

All email adresses are now spam protected.