Subscribing to the Security Email List

Then go back to drupal.org/security. Sign in to the site if you’re not signed in already.

So what you need to do is to go to your profile page. Feel free to click on the “your user profile page” link shown next:

So if you’re not logged in yet, then enter your info and click Log in (see Figure 6.5).

Then click the “Edit” link. What you are doing is editing your subscription preferences (see Figure 6.6).

Figure 6.6. Profile > Edit.

[View full size image]

Next, look for the “My newsletters” link and click it:

Then click the checkboxes next to Security announcements, and any others you are interested in:

Then click the Save button:

And you’re done! So what the security mailing list does is provide you with a way of being alerted as to when there are issues. And what you’ll want to look for are updates to modules that you may have installed on your site. So part of what you’ll want to do is make a list of modules you’ve installed, as you try different things out, and be aware of what version you’re installing.

Drupal has different versions: 6 and 7. At the present time, the security announcements are not set up for specific Drupal versions. So if you use Drupal version 7, the list might announce something that applies to Drupal version 6, or it might be a version of a module that is for Drupal 6.

Generally speaking, I just suggest keeping an eye on the list. Or . . . you could log in regularly.

It’s true that a (nice) feature of Drupal is that when you sign in, it will tell you if there’s an update that you should install. So technically, you could just log in, but the problem is, there may be significant periods of time that go by when you don’t log into your site, either now or in the future. And it may be during one of those times that a security update is released, and if you miss it, your site could get hacked. That’s why I recommend still keeping an eye on the security mailing list.

But it is helpful to be aware of how Drupal itself can tell you when something is up. When you log in as an administrator, it may give you a message if there’s an update you need to be aware of.