Security

Drupal security overview

Aim

Ensure your Drupal website has been design, built and delivered with security in mind.

Approach

Engage a team who takes security seriously and understands the security landscape at each level of the stack.

Outcome

A website which has been build with security in mind, hosted on a secure platform and is regularly monitored and maintained.

Drupal security

Websites can be compromised on a number of levels. It is important to be aware of the threats at every level and to put into place practices which will mitigate the risks as far as reasonably possible. Morpht takes a number of steps to ensure that the sites it builds remain secure as far as possible.

Team knowledge: The development team is aware of their responsibilities around data privacy and security of user data, as well as the confidentiality around client know-how and data.

Secure code: The development team is trained in best practices round writing Drupal code in a secure manner and avoiding common mistakes around the sanitization and handling of data.

Strong passwords: We enforce strong passwords and TFA for user accounts and ensure that site credentials are not shared between developers for production machines.

Data sanitization: Our standard practice is to ensure that sensitive or private data does not reach developer machines. This is done through a sanitizing user data before it is exported from production systems.

Secrets: Secrets such as API keys and other sensitive data are not stored in the database or repository. We ensure that they are stored as either environment variables or in private files so that they are out of the reach of developers, as well as hackers.

Platform security: Morpht works with reputable platform providers such as Pantheon, Acquia and GovCMS who take security seriously and have measures in place at the platform level to ensure the security of their systems.

Secure applications: We harden our websites with a number of best practices and approaches. Our sites are able to pass penetration tests conducted by third parties.

Regular site maintenance: Drupal is constantly being updated and security holes are fixed. We monitor the security alerts coming through and proactively fix sites when they are covered by one of our support and maintenance plans.

Police checks and baseline clearance: All of our staff members must undertake a Federal Police check before commencing work on any of our projects. Many of our Australian team members have attained baseline security clearance to work on Federal Government projects.

We take security seriously at Morpht and take steps to ensure that your data and user information are treated with the respect it deserves.

Frequently asked questions

How secure is Drupal compared to other CMS platforms for government use?

Drupal has a long-standing security track record and a dedicated Security Team that manages vulnerability disclosure and patching, which is a significant reason it's the CMS of choice across governments globally (Australia's GovCMS, Government of Canada, and others). Security outcomes still depend heavily on keeping core and contributed modules patched and following secure coding practices for any custom development, the platform provides a strong foundation, not a guarantee independent of good operational practice.

What are the most common security risks on Drupal government sites?

Outdated core/module versions (unpatched known vulnerabilities), poorly reviewed custom code, misconfigured permissions, and weak monitoring/incident response processes; most publicly known Drupal security incidents trace back to sites that hadn't applied available security patches, not to undiscovered platform flaws.

How does GovCMS's security model differ from self-hosted Drupal?

GovCMS SaaS applies security patches and infrastructure hardening centrally across all sites on the shared platform, reducing the burden on individual agencies; GovCMS PaaS and self-hosted Drupal put more of that patching and hardening responsibility on the agency or its support provider, making an active support and maintenance arrangement essential in those models.

Insights

Article

Secure and quality content - Automating moderation tests with Cypress

Cypress is ideal for testing Drupal content moderation, but the learning curve is rather steep. Well, with the cypress-json-tests package, you can be done within a couple of hours.

17 June 2026

Article

DrupalCon Vienna 2025: GitHub Actions + Docker + Cypress = CI/CD Nirvana

At DrupalCon Vienna, Marji’s talk showcased a production-grade DevOps setup built specifically for Drupal teams that need reliability, repeatability and automation across multiple environments.

13 November 2025