How to hide some html details like file locations, website structure, drupal settings, etc?

Hi,

I understand that you do need to show paths for both images, js and the like, just don't want to make it too obvious.

What I want to avoid is giving unnecessary info to hackers/attackers such as what platform I am using because the less they know about your site the more likely they will just move onto another one that is more easy to attack.

Drupal is great and has security and updates constantly. However, these malicious attackers are always finding new ways to and often for fraud...and most of the time before you know about an attack or vulnerability because it has already happened.

For example, having this on the page source is just too obvious

jQuery.extend(Drupal.settings, { "basePath": "/", "googleanalytics": { "...is very obvious

also
meta name="DC.title" ...is less obvious...and so forth.

try it on a test site. I don't know if doing so will interact properly with the GA module though.

Side note, removing that won't provide anonymity in any way shape or form. You would have to change the markup of every single module and core to even get close to providing anonymity. ie: just looking at block block code is a tip off in core as to which CMS is being used. Using firebug and checking out css is another method one can use to decipher which CMS is in use.

Thanks to you, I now know that it is very easy to detect my CMS however, that doesn't answer the question asked. Yet you refuse to stay gone! :)

Practice what you preach my friend--If you had read the entire thread, you'd have noticed i responded to the solution posted before coming back to make this middle post. Reading is fundamental dude! So many essays and only one person provided a solution to the question asked in this thread.

Maybe people should spend their time writing long essays to the people that need them. All the poster wanted was a solution, not your stories ottay?!

That is only present due to certain contrib modules that require it. It isn't seen in a default install of core without contrib modules which would plug into drupal javascript rather than reinvent the wheel.

for example looking at one of my sites, I note:
ctools, admin_menu, dhtml_menu, dialog, skinr are a few modules which add to CDATA. I'm sure there are others. That said, a way to remove it would be to disable the modules that are adding it. Reading the entire section should provide you with the clues to removing it.

If one rereads the original post, one would learn that isn't the OP's only concern. Paths to css files, files folders and the like "as well as" CDATA (drupal.settings) were mentioned.

I apologize for beating the horse I just killed, but it's all in the aim of trying to make a point clear for everyone.
It's not quite that "You don't need this functionality" (though I understand you feel that way) - it's that this approach to "security" is fundamentally flawed and therefore not supported by anyone who is willing to attack core and make it happen, even if it were sanely possible.

Sometimes the question is just not quite right. Like "How do I make the browser URL show https without setting up a security certificate?". The only answers to that question are "Why?" and "You shouldn't".

If you want to custom-structure your site (you already can) then that's a different question, and one which can happily be answered. On some hosts a request to /admin does cause conflict between Drupal and a control panel. That is a valid complaint, and has work-arounds for. If you want to do a total makeover of all your css classes with no drupalisms at all, you can do that too.

But if the question is "I want to make my site safe from script-kiddies by removing the word 'drupal' from the page source" - then the answer is "think again"

based on some research (10 mins tops) using google news.bbc.co.uk *may* be using a custom, internally built, content management system. Seems that many state it is drupal on forums and such with a google search but there are those who state it isn't. If the news.bbc.co.uk site is drupal, I'd figure it would have been front page news as all large outfits that have moved to drupal. It's important to note that not every site on the internet uses open source code.

If you take a look at some of the largest sites known to be using drupal, including whitehouse.gov you will find they aren't obfuscating anything and a view of the source code shows those sites using drupal. I guess I don't understand the idea that if so many high profile sites aren't worried about this, why others would be?

without this you cant even begin to plan any attack whatsoever which is my point.

That's entirely not true. One doesn't have to know which script is running to plan an attack or succeed in one. This has already been explained, you're just ignoring the explanation. Most attacks are "random" in nature using XSS techniques. Some research in this area may aid your understanding on how such attacks work.

drupals inbuilt security which is apparently bullet proof!

Noone has said that either. Fact is drupal is created by humans, working on top of other software created by humans, running on hardware built and configured by humans. That said, there is no single script that is now, nor do I believe will ever be in the future "bulletproof" with or without the human element.

Thus still only providing a sense of security through obscurity which doesn't really provide anything but a sense of false security. Gotcha.

Considering the recognizable markup beyond the .js stuff ind rupal and including in wp when wp- is stripped it still seems moot to me. :shruggs:

Thanks Fubar..I just tried it and it broke my slideshow ; (