The Basics of Securing a Drupal Site - We need a GUIDE

Hi All,

I have only been playing with Drupal for a few months, but I am really confused regarding securing a Drupal site.

I have spent hours doing searches and reading forums and still have not come across a no-nonsense guide to securing a Drupal site post-installation.

In my opinion, there needs to be a guide which covers not only Drupal itself, but also common approaches to securing the web host it resides on.

For example, some topics I am interested in are:

* What the correct CHMOD settings for every file and folder in a standard Drupal install should be
* How to set-up .htaccess correctly to secure a standard install
* Security issues relating to shared hosting and what steps to take
* How to prevent browser access to critical files such as settings.php and cron.php e.t.c
* Cpanel based settings that should be applied to increase security of a standard Drupal install

I understand that a lot of this comes from loads of experience in managing websites and undergoing security training, but there are a lot of Drupal installs out there being put up by complete n00bs (like mysefl), and these people need a lot of hand holding to harden their site.

I would write such a guide myself, but I don't know the theory or practice.

From reading around, especially regarding sites which have been hacked, this appears to be a critical piece of documentation which is currently missing from the Drupal community - a step-by-step guide which is easy to follow on how to take a holisitc approach to Drupal security (including the security of the web host, or at least things to look out for which cause large security holes). This guide should also provide multiple ways to achieve the same outcome, for example if you don't have SSH access to your webhost and only Cpanel e.t.c

If this guide already exists, I apologise, and hope someone will post the link.

Hopefully something useful turns up.

Thanks very much