CMS Security
Drupal Admin Access Check
Access to Drupal administration must be restricted to prevent brute‑force attacks. Learn how to secure this critical area.
What this test checks
This test checks whether access to the Drupal administration interface (usually /admin) is restricted. Public access exposes your site to brute‑force attacks, where automated scripts try to guess administrator credentials. Protecting this area is essential to prevent site takeover.
Our recommendation
Protect access to /admin with strong authentication and limit login attempts via Drupal security modules (e.g., Login Security). Use a CAPTCHA on the login page, enable two‑factor authentication (2FA) with dedicated modules. Change the admin URL if possible to reduce automated attacks.
Security tests
Read more
Sensitive Files