Is this an authenticated Drupal penetration test?

No. The scan is a public, non-destructive security review for websites you own or manage. It does not log into the CMS, submit exploit payloads, or bypass access controls.

Can I download a Drupal security report?

After ownership verification, Audit My CMS prepares a web result and can unlock PDF and DOCX reports with evidence, remediation guidance, and owner-friendly summaries.

Free Drupal Security Scan - Audit My CMS (Content Management System)

Q: What does the Drupal security scan check?

Audit My CMS checks public Drupal fingerprints, visible component evidence, version-matched vulnerability records where available, public exposure, security headers, TLS, DNS and email posture, forms, third-party services, and report-ready findings.

Free Drupal Security Scan

Run a public Drupal security scan for Drupal fingerprints, module and theme signals, version evidence, exposure checks, headers, TLS, DNS, forms, and report-ready findings.

Start Free Audit What We Check

Public Drupal checks

What this Drupal security scan checks

Drupal generator tags, drupal-settings-json, core assets, and sites/default paths

Public contributed module and theme fingerprints where visible

Version-matched vulnerability evidence when public Drupal component versions are detected

Full audit coverage

CMS fingerprinting from public page source, headers, and assets
Version-matched vulnerability evidence when reliable public versions are visible
Security headers, HTTPS/TLS, DNS, email posture, SRI, forms, and exposure checks
Known third-party services separated from unknown integrations and review-only inventory

Report-ready output

The scan separates findings, inventory-only observations, limitations, and remediation guidance so owners can act without treating every passive signal as a vulnerability.

Public, non-destructive scope

This is not an authenticated penetration test. The scanner reviews public responses, page source, assets, DNS, TLS, and passive evidence for the verified website.

Built for owner review

The result helps site owners prioritize exposed CMS evidence, outdated component signals, weak browser-side protections, and operational gaps before they become harder to clean up.

What does the Drupal security scan check?

It checks public Drupal fingerprints, visible component evidence, vulnerability matches where version evidence exists, exposure signals, headers, TLS, DNS/email posture, forms, third-party services, and report-ready findings.

Is this an authenticated penetration test?

No. It is a public, passive scan for sites you own or manage. It does not log into Drupal, submit exploit payloads, or bypass access controls.

Can I download a report?

Yes. After ownership verification, the web result can be unlocked as PDF and DOCX report outputs with evidence, remediation guidance, and owner-friendly summaries.