14. Drupal Site Management Explained
Are you going to be responsible for maintaining your Drupal site? If so, this chapter is for you. This chapter shows you how to keep your site safe, secure, and updated.
You might have other people taking care of these tasks for you. You might have a web design company, colleagues in the IT department, or other experienced people to help you. If that’s your situation, you can happily skip this chapter.
However, if you are the person responsible for your site, you need to know how to keep your site safe and secure. Among other things, you need to know how to protect your site and update it to the latest version.
After reading this chapter, you should be able to
Update your site.
Update your modules and themes.
Disable or uninstall modules and themes.
Use additional measures to protect your site.
Back up your site.
Updating Your Site Explained
Treat your Drupal site as you treat your car.
All cars need regular maintenance, and so do all Drupal sites. With a car, you need to pump up the tires, change the oil, change the battery, or do other fixes. With a Drupal site, you also need to apply fixes. Fortunately, many of these important fixes can be applied automatically using Drupal’s update system.
Before seeing how to use Drupal’s update system, you need to understand what you’re updating to. Drupal’s updates are based on version numbers, as described in the following section.
An Overview of Drupal Version Numbers
Chapter 1, “Drupal Explained,” talked a little about Drupal’s version numbers. Some of the key points mentioned were
At the time of writing, there are three major versions of Drupal:
Drupal 6 was released September 2008. Millions of websites use it, and it will still be actively supported and updated by the Drupal team until Drupal 8 is released. However, there are no new plans for new features for this version.
Drupal 7 was released January 2011. It’s the version used throughout this book.
Drupal 8 will be released in late 2013 or early 2014.
Now, let’s get a little more specific about version numbers. There are two types of Drupal version: major versions and minor versions.
Major Versions
Major versions have large intervals between releases and always add important new features and changes to Drupal:
Numbering: 5, 6, and 7 have been released, and in the future you can expect 8, 9, 10, and so on.
Reason for new major versions: To add new features and improve the underlying code.
Importance: Is it important to use the latest major version? It’s useful but not essential. Because new major versions are released to add new features, there are no security problems if you don’t upgrade. However, each major version is supported only by the Drupal team for so long; so yes, it’s generally best to use the latest major version if possible.
Release dates. There are no fixed release dates for major versions. However, Drupal’s track record can give you an idea of how often major versions are released. After the release of Drupal 5, there have been three major versions in approximately 80 months. So, you could say that major versions arrive approximately every 26 months:
Drupal 5: January 2007
Drupal 6: February 2008
Drupal 8: Late 2013 or early 2014
Updating: Unfortunately, updating between major versions is difficult. Each new Drupal version is substantially different from the last. The more complicated the site, the more difficult it is to update. After you choose a version, it will probably be the version that your site uses for several years. A useful blog post on understanding Drupal’s philosophy on updates is http://www.buytaert.net/backward-compatibility, written by Dries Buytaert. In that post, he explains that the priority for each major Drupal version is to get the technology right, and that is more important than backward compatibility. Other website software has the opposite priority and values backward compatibility over the latest technology. There isn’t a right or wrong answer when discussing which should be the higher priority, but you need to know what Drupal’s priorities are.
Minor Versions
Minor versions are released irregularly but often and provide small fixes to existing features:
Numbering: Each major version has minor versions, such as 7.1, 7.2, 7.3, 7.4, and so on. For major versions that are out for a long time, these can add up so that the final version of 5 was 5.23, and the current version of 6 is 6.27. The current version of 7 is 7.18.
Reason for new minor versions: To fix security problems and bugs.
Importance: Is it important to use the latest minor version? Yes, absolutely. Because new minor versions are often released to fix security problems, it is vital to make sure you use the latest version.
Release dates: These versions are released approximately every 1 to 2 months or as needed.
Updating: In Drupal, you need to download the files for the new version and carefully upload them to replace your current files.
What Version Do I Have?
Now that you understand what the numbers mean, you need to see how to apply updates.
Log in to your site as administrator, and go to Reports and then Status Report. You can see what version number you currently have. In Figure 14.1, the site is at version 7.16.
How Do I Get Notified About Updates?
Drupal gives you plenty of warning notices about updates. If there is an update and you’re logged in as administrator, you see a red message across the top of all admin screens, as shown in Figure 14.2.
You can have Drupal automatically send you emails whenever there’s an update. Go to Reports, Available updates, and click the Settings tab. You see a screen, as shown in Figure 14.3. Enter an email address here, and Drupal can send you daily emails whenever it finds an update.
How Do I Update?
The site shown in Figure 14.1 uses 7.16, which is out-of-date. Here’s the process you can use to update the core Drupal files on your site:
1. Take your Drupal site offline briefly so that visitors don’t see any error messages as you update. To do this, go to Configuration, Maintenance mode, and check the box marked Put Site into Maintenance Mode. Click Save Configuration.
2. Back up your site, as explained in the section, “Backing Up Your Site Explained,” later in this chapter.
3. Go to Reports and Available Updates.
4. Click Download in the red warning area, as shown in Figure 14.4.
5. Save the files to your desktop.
6. Extract the files that you just downloaded. The folder should look like Figure 14.5.
7. Delete the /sites/ folder from the folders in the new version shown in Figure 14.5. IMPORTANT! Please do not ignore this step. The /sites/ folder contains everything that is unique to your site: all the uploaded modules, themes, and files. If you don’t delete the /sites/ folder in the new version now, you’ll upload this empty folder and replace all your modules, themes, and files.
8. Open your FTP program as you did in Chapter 3, “Drupal Installations Explained.” Browse to find your existing site files.
9. One more time: Make sure that you have a backup of your site!
10. Upload the files that you downloaded and extracted. Simply upload the new files over the top of the existing ones. This may take anywhere from a few seconds to a few minutes to complete, depending on the speed of your connection.
11. When the upload is complete, go to Reports, Available Updates again. Drupal now shows that the Drupal core is up to date, as shown in Figure 14.6.
12. Go to Configuration, Maintenance mode, uncheck the box marked Put Site into Maintenance Mode, and click Save Configuration.
Updating Your Modules and Themes Explained
To keep your site safe, you need to update your modules and themes as well as the main Drupal version.
Fortunately, Drupal 7 makes updating modules and themes much easier than updating the core files. Here’s how to do it:
1. Back up your site.
2. Go to Reports, Available Updates. Look for any modules or themes that are marked in red, as shown with the Zero Point theme in Figure 14.7.
3. Click the Update tab in the top-right corner.
4. Check the box next to the updates you want to make, as shown in Figure 14.8.
5. Click Download These Updates. You’ll see a progress bar as your sites are updated, as shown in Figure 14.9.
6. When the update finishes, you see a message saying Updates Downloaded Successfully, as shown in Figure 14.10.
7. Click Continue. Drupal automatically puts the site in maintenance mode during this process. Drupal then completes the update and checks for any problems. If there are no problems, it takes the site out of maintenance mode again, as shown in Figure 14.11.
8. Click Run Database Updates. This is the final step in the update. You see the screen shown in Figure 14.11.
9. Click Continue.
10. Click Apply Pending Updates if any updates are found, as shown in Figure 14.12.
If all goes well, you won’t see any error messages. You just see a screen like Figure 14.13. Click the Front Page or Administration Pages links to return to your site.
If you see error messages, do your best to follow the instructions given. If the instructions aren’t clear, enter the error message into Google or the search box at Drupal.org to see if anyone has encountered similar problems and found a solution.
Uninstalling Modules or Themes Explained
For security reasons, you must uninstall any modules or themes that you’re not using. If modules or themes are unused, you’re more likely to forget about updating them. Older software that hasn’t been regularly updated is more likely to suffer from security holes. Here’s how you can remove unused modules:
1. Go to Modules on the Administration menu.
2. Uncheck the box next to the module you want to uninstall, and then click Save Configuration. If you can’t uncheck it, it is because another module is relying on it. Look next to the module you want to uninstall and see what is listed in the Required By area. For example, in Figure 14.14, you can’t disable the Devel module, because it is required by the Devel generate module. First, you need to disable Devel generate.
3. Click the Uninstall tab in the top-right corner.
4. You’ll see a list of modules that you can uninstall. As with the disabling, they sometimes must be done in a particular order. Check the boxes next to the modules you want to uninstall, as shown in Figure 14.15.
5. Click Uninstall.
6. Drupal warns you that all data from these modules will be lost. Click Uninstall and the process finishes.
The process of uninstalling a theme is different:
1. Go the Appearance tab on the Administration menu, and click Disable next to the theme you want to uninstall.
2. Log in to your site via FTP.
3. Browse to the /sites/all/themes/ or sites/default/themes/ folder to find your theme.
4. Find the folder for the theme you want to uninstall. It will probably have exactly the same name as the theme.
5. Either remove or delete the theme folder, and you will have successfully uninstalled the theme.
Backing Up Your Site Explained
You need to keep your site secure and up to date, but even the best sites can run into problems, and even the best site administrators can make mistakes. To recover from serious problems and errors, you need to have backups. There are two main ways to make backups: Your hosting company can do it, and you can do it yourself. I recommend that you set up both options.
Backups Made by Your Hosting Company
Many of the best hosting companies make backups for their clients. Some of the best hosting companies not only make the backups, but also give you the ability to restore a backup in place of the current site. Some others make the backups but require that you contact them and ask for the backup to be restored. Finally, some hosts won’t make any backups available to you because they create backups to recover from server failure and not your mistakes.
You need to know the backup policy of your host, whether it’s good, mediocre, or bad.
Backups Made by You
The module recommended for backing up your Drupal site is called Backup and Migrate. As the name suggests, you can also use this module for moving your site from one server to another. Here’s how to use Backup and Migrate:
1. Install Backup and Migrate from http://drupal.org/project/backup_migrate.
2. Install the Backup and Migrate Files module from http://drupal.org/project/backup_migrate_files.
3. Enable both modules.
4. Go to Configuration and then File System.
5. Enter a private file system path. This is a folder at a higher directory than the public files on your website. If you can access this folder via an http:// URL, it’s not a private path. The reason for doing this is that your database might contain sensitive information, and it’s a good security precaution to store database backups where they cannot be easily accessed. If you’re stuck on finding this path, ask the people in charge of your server or click the link labeled More Information About Securing Private Files.
6. Go to Configuration and then Backup and Migrate.
You can easily make a backup of your database and files from this screen, as shown in Figure 14.16. You can simply click Backup Now to download a copy of your database.
To download a copy of your files, simply change the Database drop-down to Public Files Directory, and click Backup Now. This can take longer than downloading your database.
You need to make a backup before you update your core files, modules, and themes. You also must make regular, scheduled backups. Here’s how to do that:
1. Go to Configuration, Backup, Migrate.
2. Click the Schedules tab.
3. Click Add schedule.
Schedule Name: Give the schedule a name such as Daily Database Backup.
Backup source: Default Database.
4. Click Save Schedule.
5. Repeat this to set up a backup for your files. The only difference is that files can take up more space and probably change less often. So, it’s not uncommon to back up your database daily and back up your files weekly.
Additional Measures to Protect Your Site
The previous two chapters covered four of the most important security processes for your Drupal site: permissions, regular updates, deleting unused software, and taking regular backups. To further enhance the security of your site, use the Security Review module. This module won’t actually secure your site, but it can give you great advice on how to do it.
Here’s how to use the Security Review module:
1. Install and enable the module from http://drupal.org/project/security_review.
2. Go to Reports and then Security Review.
3. Click Run Checklist. It gives you some suggestions on problems to fix, as shown in Figure 14.17. Click Details to get information on fixing the problems.
So, what’s next?
Practice: The only way to get better at Drupal is to build Drupal sites. Decide on your first Drupal project and start practicing.
Practice now: You will forget most of what you’ve read in this book. That’s human nature and doesn’t make me a bad teacher or you a bad learner. The longer you wait to practice Drupal, the more you’ll forget. Why not start right away?
Learn more: I guarantee that there are things you will come across while using Drupal that haven’t been included in this book. This book has only a limited number of pages, and we focused on only the most important things about Drupal. We also tried to avoid any code so that the barrier to entry for using Drupal is as low as possible. However, one of the great things about Drupal being so popular is that almost every problem you run into has been encountered by other people. Many of those people have asked for or posted a solution to their problem online. If you ever get stuck, here are the first two places you should go to for help:
http://www.google.com: If you get an error message or encounter a problem, type it directly into a search engine, and there’s a good chance you’ll find a solution.
http://drupal.org/forum: The Drupal forums have more than a million posts at the time of writing, so you can find a lot of solutions. Search for a solution to your question: if you don’t find it, write a new post. There’s sure to be someone who can help you.
Join the Drupal community: Drupal doesn’t rely on money; it relies on people like you. Whether you attend a local Drupal event, post solutions you find on the forum, or even say thank you to someone who’s helped you, there are many easy ways to become part of the Drupal community. The more you rely on Drupal for your website or your business, the more it can benefit you to become part of the community.
I hope to see you around in the Drupal community, and I wish you all the best in your use of Drupal!