Security & Accessibility
Security requires disciplined maintenance, access control, configuration and operational practices — not a one-time check. Drupalify reviews the Drupal application and supporting environment, identifies gaps and implements agreed remediation actions. Accessibility assessment and remediation is also available for platforms with WCAG compliance requirements.
Inquiry or get a quote
Accessibility — What This Service Can Include
WCAG 2.1 / 2.2 assessment
Full audit against WCAG 2.1 or 2.2 AA standard — every page template and content type assessed, not just the homepage.
Keyboard navigation audit
All interactive elements tested without a mouse — tab order, focus indicators and keyboard traps identified and documented.
Semantic HTML structure review
Heading hierarchy, landmark regions, lists and link text reviewed — screen reader users depend on correct structure to navigate.
Accessible forms
Labels, error messages and required field indicators checked — forms that fail here are a barrier to users with assistive technology.
Colour contrast check
Text, icons and interactive elements checked against WCAG contrast ratios for both normal and large text sizes.
Screen reader compatibility testing
Tested with NVDA on Windows and VoiceOver on macOS — the two most widely used screen readers among users with visual impairments.
Accessible images and media
Alt text, captions and audio descriptions reviewed — images without alt text are invisible to screen reader users.
Remediation documentation
Prioritised issue list with recommended fixes — severity level, affected templates and suggested implementation approach for each issue.
Remediation implementation
Issues identified can be fixed by Drupalify as a follow-on engagement — full fix, not just a report to hand back.
Security — What This Service Can Include
Module version and advisory check
Every core and contributed module version checked against the Drupal Security Advisory database — outstanding vulnerabilities listed and prioritised.
User roles and permissions audit
Over-privileged accounts and incorrect content access rules flagged — access control verified against what users should actually be able to do.
SSL and HTTPS review
Certificate validity, HTTPS enforcement, HSTS headers and mixed content checked — common configuration gaps that leave data exposed.
GDPR compliance check
Cookie consent, data handling, third-party scripts and form data storage reviewed for common GDPR gaps.
Malware and backdoor scan
Injected code, hidden backdoors and unauthorised admin accounts identified — common after a past security incident on an outdated platform.
Secure deployment practices review
Secrets management, environment separation and deployment process reviewed — credentials and API keys confirmed not exposed in code or config.
Backup and recovery verification
Backup restore process tested end-to-end, not just scheduled — most organisations only discover broken backups when they need them.
Update process review
Security advisory response procedure assessed — confirmed patches are applied promptly, not held for quarterly maintenance cycles.
Fixes included
Issues identified during the audit are resolved — not handed back as a list of problems for your team to fix independently.
Best Suited For
Frequently Asked Questions
Discover insights about our offerings, processes, and more. Your answers are just a scroll away in our comprehensive FAQ section!
Yes. Even on a supported version, security depends on configuration, access control, deployment practices and update processes — not just the Drupal version number. We recommend a review every 6 to 12 months for active platforms.
Most sites take 3 to 5 business days for the audit. Larger or multisite setups take 5 to 10 days. You receive the full report before any remediation work begins.
No. The audit is read-only and the site stays live throughout. Remediation work is tested on staging and deployed during off-peak hours.
We fix them. The engagement includes remediation for all agreed issues — not just a list of problems to hand back to your team.
WCAG 2.1 AA as standard, which is the level required by most public-sector accessibility legislation. WCAG 2.2 AA assessment is also available on request.
No. We can run both as a combined engagement or separately depending on your priorities and budget.
Not sure where to start? Get a free audit first.
Our senior Drupal architects will evaluate your site's performance, security, and migration readiness at zero cost.
