Chapter 13: Security and Maintenance

Concept: Cron
What are cron tasks?
To ensure that your site and its modules continue to function well, a group
of administrative operations should be run periodically. These operations are
called cron tasks. Examples of cron tasks are: checking for module and theme
updates, indexing content for search, or cleaning up temporary files.
What is the relationship between the site's cron tasks and Unix cron?
Linux/Unix-based operating systems have a cron scheduler that can be used to run
periodic tasks. You can use the server’s cron scheduler to schedule runs of the
site’s cron tasks. Alternatively, you can use the core Automated Cron module to
run tasks. You can check the site’s cron tasks' status in the status report.
Related topics
Configuring Cron Maintenance Tasks
Concept: Status Report
Additional resources
Drupal.org community documentation page "Setting up cron"

Configuring Cron Maintenance Tasks
Goal
Check whether cron maintenance tasks are run regularly, and if not, either
install the core Automated Cron module or run cron maintenance tasks from
outside the website.
Prerequisite knowledge
Concept: Cron
Steps
Review the Status report (see Concept: Status Report) to see when cron
maintenance tasks were last run.
If you installed the website using the core Standard installation profile (or
similar), then cron maintenance tasks might already be running via the
core Automated Cron module.  By default, these tasks are run about every three
hours.
Choose whether to run cron maintenance tasks using the core Automated Cron
module, or by other means. The core Automated Cron module might not be suitable
for some websites because:
Each time someone accesses a page on the site, the module checks how long it
has been since cron maintenance tasks have last run, and then runs them if
necessary. If no one visits the website for a long time, cron maintenance
tasks will not be run.
Cron maintenance tasks are run after the page has been generated. This means
there is less time for the tasks to be run before various server timeouts are
reached (for example, PHP execution timeout). If this happens, the logs (see
Concept: Log) will show error messages that cron is unable to complete.
There is a small scalability cost
associated with the core Automated Cron module. This is because one of the web
server's processes is occupied (and can't serve other web pages) until the
cron maintenance tasks are complete.
If you want to use the core Automated Cron module, first make sure it is
installed (it is installed with the core Standard install profile; see
Installing a Module if it is not installed).
Next, configure the module to control how frequently cron maintenance tasks are
run. In the Manage administrative menu, navigate to Configuration >
System > Cron (admin/config/system/cron). Select the desired interval from
the Run cron every field under Cron settings, and click Save
configuration.
If you want to run cron maintenance tasks from outside the website, uninstall
the core Automated Cron module (see Uninstalling Unused Modules). Next, find the
cron URL. This URL is shown in the Status report (see Concept: Status Report), and
in the Cron administration page (see previous step). The URL looks
like this:
http://www.example.com/cron/0MgWtfB33FYbbQ5UAC3L0LL3RC0PT3RNUBZILLA0Nf1Re
Whenever this URL is visited, cron maintenance tasks will run. Set up one of
the following schedulers to access this URL regularly:
The Cron daemon (Linux, OS X, Solaris, BSD)
Scheduled Tasks (Windows)
A cron SASS provider (software as a service)
A cron manager provided by your web hosting provider (see the documentation
provided by your provider)
Related concepts
Concept: Security and Regular Updates
Videos
Configuring Cron Maintenance Tasks
Additional resources
Drush page "Running Drupal cron tasks from Drush"
Drupal.org community documentation page "Setting up cron"

Concept: Security and Regular Updates
Prerequisite knowledge
Concept: Drupal as a Content Management System
Concept: Modules
Concept: Themes
Concept: The Drupal Project
What are security updates?
Any software occasionally has bugs, and sometimes these bugs have security
implications. When security bugs are fixed in the core software, modules, or
themes that your site uses, they are released in a security update. When
critical security updates are announced, they will be shown in the
administration pages of your website. You will need to apply security updates in
order to keep your site secure. See Keeping Track of Updates to learn how to be
notified of security updates by email, and Updating the Core Software,
Updating a Module, and Updating a Theme to learn how to make
updates.
What is the security team?
The Drupal open-source project has a team of volunteers who track
security-related bugs and release security updates. They also help other
developers fix bugs, and maintain information for users on how to keep their
websites secure. You can learn more about the security team and their practices
and processes at the
Drupal.org Security Team page.
How are security bugs reported?
It is important that security problems be kept confidential until they are
fixed, so that sites are less likely to be compromised before they can be
secured. If you find a potential security problem in any of the software you
downloaded from the Drupal.org website, follow the procedures on the
Drupal.org Security Team page to report
it.
What are regular (non-security) updates?
The core software, modules, and themes also periodically have regular updates to
add new features and fix bugs. These updates are less critical than security
updates. As a general best practice, updates should be applied as long as they
do not cause problems with your site. Testing on a development copy of your site
is always a good idea before applying updates on a live site. This is because
some updates may include changes that are not compatible with the modules or
themes on your site, or that will break a particular functionality on your site.
Related topics
Keeping Track of Updates
Updating the Core Software
Updating a Module
Updating a Theme
Making a Development Site
Additional resources
Drupal.org community documentation page "Securing your site"
"Security advisories" on Drupal.org
Drupal.org Security team

Keeping Track of Updates
Goal
Keep your site safe and up-to-date by keeping up with the latest security
updates.
Prerequisite knowledge
Concept: Security and Regular Updates
Steps
There are a few different ways to receive notifications of security releases:
Highly critical security announcements will be displayed on the administration
pages of your website. A link will be shown to the announcement on Drupal.org
which explains when and how you can update your website.
In the Manage administrative menu, navigate to Reports > Available
updates > Settings. Enter the email addresses to be notified when updates are
available. You can also specify whether you want daily or weekly updates. Click
Save configuration.
Subscribe to the security announcements email list. To subscribe, log in to
Drupal.org, go to your user profile page and subscribe to the security
newsletter on the Edit > My newsletters tab.
Follow @drupalsecurity on X.
Subscribe to RSS feeds for
core security updates,
contributed project updates and
public service announcements.
Related concepts
Concept: Security and Regular Updates
Updating the Core Software
Updating a Module
Updating a Theme
Videos
Keeping Track of Updates
Additional resources
"Security advisories" on Drupal.org
Drupal.org Security Team
@drupalsecurity on X

Updating the Core Software
Goal
Update the core software, either through the administrative interface or by
using Drush.
Site prerequisites
If you want to use Drush, Drush must be installed. See Concept: Additional Tools.
If your site is live, you should test this process in a development
environment before running it on your production site. See
Making a Development Site.
Steps
Make a complete backup of your site. Refer to Concept: Data Backups.
Open settings.php (/sites/default/settings.php) in any plain text
editor. Find the line with the $settings['update_free_access'] variable. By
default, it is set to "FALSE" due to security reasons. Change the setting to
"TRUE":
$settings['update_free_access'] = TRUE;
Disable any caching technique (memcache, varnish, and so on) your application
might be using.
Put your site in maintenance mode. See Enabling and Disabling Maintenance Mode.
If you are using Composer to manage dependencies, skip the next six steps, and
instead see Using Composer to Download and Update Files for instructions on downloading updated
files. Continue with the update.php step.
Download the tar.gz or zip file archive for the latest version of Drupal core
for the branch you are currently using (such as 8.x or 9.x) from
Drupal.org Drupal Core Downloads.
See Preparing to Install for more details on how to find the latest version.
Upload the archive file to your web hosting server.
Extract the archive file to a temporary directory on your server (should be
outside the directory where the site is hosted). Your hosting control panel's
file manager should provide a way to extract the files. Or, if you have
terminal access to your hosting server (running Linux), you can use a command
like:
tar -xzf drupal-8.3.2.tar.gz
In your site hosting directory, delete the core and vendor directories,
and all files that are not in a subdirectory, including .htaccess,
composer.json, and autoload.php. Don't delete custom and customized files
because you may end up losing the custom functionality stored in them.
Copy the core and vendor directories and the non-custom/non-customized
files that you deleted in the preceding step from the temporary directory to
your site directory.
Run the update.php script using either of the following:
Visit http://www.example.com/update.php in your browser (where
www.example.com is your site's URL). Click Continue in the first screen
to run the updates and successfully complete the script.
Run the following Drush command: 
drush updatedb
If you get any error or warning, re-run the update.php script
again till all the updates have been completed successfully.
Open settings.php (/sites/default/settings.php) in a text editor. Find the
line with the $settings['update_free_access'] variable and update it to
"FALSE":
$settings['update_free_access'] = FALSE;
Click Administration pages to return to the administration section of your
site.
Take your site out of maintenance mode. See Enabling and Disabling Maintenance Mode.
Clear the cache. See Clearing the Cache.
Re-enable any caching technique you disabled at Step 3.
You should have the updated version running. You can verify the current
version of your software by checking the Status report (see
Concept: Status Report).
Expand your understanding
Concept: Additional Tools
Making a Development Site
Concept: Data Backups
Related concepts
Concept: Status Report
Videos
Updating the Core Software
Additional resources
"Drupal Core Downloads" page on Drupal.org
"Registry Rebuild" page on Drupal.org
The file /core/UPDATE.txt within your installation.

Updating a Module
Goal
Update a contributed module and run the Database updates script.
Prerequisite knowledge
Concept: Security and Regular Updates
Concept: Cron
Site prerequisites
A contributed module has been installed and there is an update available for
it. See Downloading and Installing a Module from Drupal.org and Keeping Track of Updates.
If your site is live, you should test this process in a development
environment before running it on your production site. See
Making a Development Site.
You have created a full-site backup. See Concept: Data Backups.
If you want to use the user interface to check for updates, the core Update
Manager module must be installed. See Installing a Module for instructions on
installing core modules.
Steps
Before you start, check for module-specific update instructions. Read and
understand all module-specific requirements before proceeding with the updates.
To find instructions, check the module's project page Read Documentation link.
To view further instructions, after downloading the updated files, look for
README.txt, INSTALL.txt, and UPGRADE.txt that come with the module. Also,
review the release notes on the project page by clicking the version number
you're downloading.
Updating a module requires first putting your site into maintenance mode, then
obtaining the new code files and applying any required database updates, then
finally taking the site out of maintenance mode.
You can update the code for a contributed module using Composer. If you are
updating a custom module rather than a contributed module, obtain the new module
files, then continue with instructions for running the database updates via the
administrative interface below.
This assumes that you are using Composer to manage the files in your site; see
Using Composer to Download and Update Files.
Update a contributed module with Composer
Put your site in maintenance mode. See Enabling and Disabling Maintenance Mode.
In the Manage administrative menu, navigate to Reports >
Available updates > Update (admin/reports/updates).
Find and check the module in the list. Click Download these updates for the
module.
Determine the short name of the project you want to update. For contributed
modules and themes, it is the last part of the URL of the project page; for
example, the Geofield module, at https://www.drupal.org/project/geofield, has
short name 
geofield.
If you want to update to the latest stable release, use the following
command, substituting the short name of the project to be updated for
geofield:
composer update drupal/geofield --with-dependencies
To learn how to download specific versions see Using Composer to Download and Update Files.
After obtaining the new module files run any database updates page by typing
the URL example.com/update.php in your browser.
Click Continue to run the updates. The database update scripts will be
executed.
Click Administration pages to return to the administration section of your
site.
Take your site out of maintenance mode. See Enabling and Disabling Maintenance Mode.
Clear the Drupal cache (refer to Clearing the Cache).
Expand your understanding
Review the site log (refer to Concept: Log) once the updates are complete
to check for errors.
Updating a Theme
Videos
Updating a Module

Updating a Theme
Goal
Update a contributed theme on your site and run the Database Updates script.
Prerequisite knowledge
Concept: Security and Regular Updates
Concept: Cron
Site prerequisites
A contributed theme has been installed and there is an update available for
it. See Downloading and Installing a Theme from Drupal.org and Keeping Track of Updates.
If your site is live, you should test this process in a development
environment before running it on your production site. See
Making a Development Site.
You have created a full site backup. See Concept: Data Backups.
If you want to use the user interface to check for updates, the core Update
Manager module must be installed. See Installing a Module for instructions on
installing core modules.
Steps
Updating a contributed theme requires first putting your site into maintenance
mode, then obtaining the new code files and applying any required database
updates, then finally taking the site out of maintenance mode.
You can update the code for a contributed theme using Composer. If you are
updating a custom theme rather than a contributed theme, obtain the new theme
files, then continue with instructions for running the database updates via the
administrative interface below.
This assumes that you are using Composer to manage the files in your site; see
Using Composer to Download and Update Files.
Update a contributed theme with Composer
Put your site in maintenance mode. See Enabling and Disabling Maintenance Mode.
In the Manage administrative menu, navigate to Reports >
Available updates > Update (admin/reports/updates).
Find any themes in the list that need updating.
Determine the short name of the project you want to update. For contributed
modules and themes, it is the last part of the URL of the project page; for
example, the Honey theme, at https://www.drupal.org/project/honey, has
short name 
honey.
If you want to update to the latest stable release, use the following
command, substituting the short name of the project to be updated for
honey:
composer update drupal/honey --with-dependencies
To learn how to download specific versions see Using Composer to Download and Update Files.
After obtaining the new theme files run any database updates page by typing
the URL example.com/update.php in your browser.
Click Continue to run the updates. The database update scripts will be
executed.
Click Administration pages to return to the administration section of your
site.
Take your site out of maintenance mode. See Enabling and Disabling Maintenance Mode.
Clear the Drupal cache (refer to Clearing the Cache).
Expand your understanding
Review the site log, see Concept: Log, once the updates are complete to
check for errors.
Updating a Module
Videos
Updating a Theme