Follow us on Twitter!
Syndicate content
Login - Register - Latests submissions

Check

To let users translate your module strings, you must use the t() function. This allows the Drupal community to create translation files *.po. But this also allows user to tweak some strings to fit their needs, with the String Overrides module.

So everytime your write a sentence or a word in your module, surround your string with the t() function.

This is the bad way:

$foo = "Thank you for your submission";

This is the good way:

$foo = t("Thank you for your submission");

Note that you must always write your module strings in English as this is the default language in Drupal and is used as a base to provide the localization system.

You will need to insert values in your strings:

Don't write:

$points = 3;
$foo = t("You just won $points points");

This is the good way to insert placeholders values:

$points = 3;
$foo = t("You just won !points points", array('!points' => $points));

Check out the resources links to learn more about t() function use.

Note that starting with Drupal 6, you can also make your JavaScript files translatable.

In your code use Drupal.t() function. Example:

greetingMessage = Drupal.t("Your vote has been saved!");

By default Drupal will keep people logged in for 23 days (2000000 seconds) by saving a cookie in their browser. This is nice, but a potential security problem if people are using the site from shared computers.

Consider editing the site's settings.php to have

ini_set('session.cookie_lifetime',  0);

instead of the default

ini_set('session.cookie_lifetime', 2000000);

With the former, the user's login will be forgotten when they close their browser window, even if they forget to log out explicitly.

  • Go to Site configuration > Error reporting
  • Set Error reporting list box to Write errors to log
  • Save configuration

When developping a module, we often use some commonly used PHP functions. As you may not know Drupal provides some overrides for these functions. They are often related to strings, they have the same name as their PHP native equivalent except that they are prefixed with drupal_. Here is a list of PHP functions you should replace with its Drupal equivalent:

  • Replace strlen() with drupal_strlen()
  • Replace strtoupper() with drupal_strtoupper()
  • Replace strtolower() with drupal_strtolower()
  • Replace ucfirst() with drupal_ucfirst()
  • Replace substr() with drupal_substr()
  • Replace eval() with drupal_eval()
  • Replace clone with drupal_clone()

For more on this, you should read includes/unicode.inc and includes/common.inc.

Consider installing the Boost module to create static HTML versions of pages that are served anonymously. Cached pages don't even use PHP (they are served as .html files) let alone create or use queries in MySQL so caching is super fast. Cached pages can be cleared on a regular basis with cron. Works with multisites and provides speed improvements to almost any Drupal site. Requires modification of default .htaccess file.

It is recommended that you prevent users from registering on your website with some odd usernames like:

  • root
  • admin
  • administrator
  • webmaster

To prevent this from happening:

  • Go to Administer > User management > Access rules > Add rule
  • Set Access type to Deny
  • Set Rule type to Username
  • In Mask type root
  • Click the Add rule button

Repeat this for every username you don't want to be created on your site.

Having an .htaccess file is a pain regarding performances. Apache needs to read it on every single request (the page, every image, CSS files, JS files, etc.).

It is strongly recommended to move rules defined in Drupal .htaccess file in your Apache global configuration or in your vhost configuration file. This way all rules are only loaded 1 time, during Apache start.

To achieve this, just copy/paste your .htaccess content in your Apache server configuration file and don't forget to surround it by the directory where your Drupal install resides.

<Directory /var/www/path/to/drupal/directory/>
  AllowOverride None
  ###      ALL YOUR .HTACCESS CONTENT GOES HERE    ###
</Directory>

Note that we added AllowOverride None to prevent Drupal .htaccess to be read by Apache.

Check for syntaxe error:

$ apachectl configtest

And restart Apache:

$ apachectl restart

Note that if you are on Plesk, you must use the following command before restarting Apache:

$ /usr/local/psa/admin/sbin/websrvmng -u --vhost-name=example.com

SEO SEO

Google analytics is a free and useful tool for getting information about your site visitors, and there is little reason not to set it up on your site before launch.

You will need a GA account, and know it's account number. Install the GA module linked, and enter the account number into /admin/settings/googleanalytics and customize if desired.

When using GA in Germany you have to publish "datenschutzrechtliche Hinweise" on your site to inform users, that some of their data - e.g. IP-adress - will be tracked. Normally you set up a text block in your imprint. Using GA is maybe not conform with contemporary requirements of protection of private data.

SEO SEO

If you what Pathauto to transform caracters with accents into simple letters like:

  • éèêë to become e
  • àâï to become a

You must enable in Pathauto the option Transliterate prior to creating alias. But by default, you can't tick the checkbox.

You first need to rename a file. From within the Pathauto directory, rename i18n-ascii.example.txt to i18n-ascii.txt. Once renamed, you can enable the option from the Pathauto settings form.

Drupal comes with a set of TXT files at root level (things like install instructions, upgrade instructions, etc.). To avoid malicious users to have information on the Drupal version you are using, it is strongly recommended to remove those files.

From the root directory of your installation, remove the following files:

  • CHANGELOG.txt
  • COPYRIGHT.txt
  • INSTALL.mysql.txt
  • INSTALL.pgsql.txt
  • INSTALL.txt
  • LICENSE.txt
  • MAINTAINERS.txt
  • UPGRADE.txt

Whether or not these files contains security information (like Drupal version for example), the all contain a CVS header that gives a really precise version information on your Drupal installation.

Create a node (a page content type for example) with some extra information so that your visitors don't ever fall on the default 403 page not found.

Once this node is created:

  • Remember its node ID,
  • Go to Administer > Site configuration > Error reporting
  • Set Default 403 (not found) page to the node ID you just created
  • Save your settings

You can alternatively use the Search 404 module.

Anonymous
  • Go to Administer > Site configuration > Performance
  • Set Caching mode to Normal or Agressive
  • Set Block cache to Enabled
  • Save your settings

In regards to page compression, you will find on admin/settings/performance a description that looks like By default, Drupal compresses the pages it caches in order to save bandwidth and improve download times. This option should be disabled when using a webserver that performs compression. To find out whether your server already performs compression have a peek at /etc/httpd/conf/httpd.conf (CentOS/Redhat) or /etc/apache2/mods-enabled (Debian/Ubuntu) to find out if the module mod_deflate is called. If so, turn off page compression.

You're done!

Cron is a deamon which triggers certain actions (cron jobs) at configured times. Windows has an equivalent system called Task Scheduler. Calling cron.php at regular intervals will allow, amongst others, the indexation of content the content and to check for updates.

Setting up a cron job under a *nix system is fairly easy.

  1. Create or edit a crontab by typing in a terminal crontab -e
  2. Assuming that you have one of the following programs on your system, add one of the following line to trigger a request to cron.php every hour:
    • 0 * * * * /usr/bin/wget -O - -q -t 1 http://example.com/cron.php
    • 0 * * * *  /usr/bin/lynx -source http://example.com/cron.php
    • 0 * * * * curl --silent --compressed http://example.com/cron.php
  3. Save and exit your editor.

Setting up cron jobs on Windows is almost as easy! See Resources below.

Drupal logs information about cron jobs. Once you have configured it, you should see entries in your logs (Administer > Reports > Status report and Administer > Reports > Recent log entries) indicating the status of the related tasks.

fp

Create a node (a page content type for example) with some extra information so that your visitors don't ever fall on the default 404 page not found.

Once this node is created:

  • Remember its node ID,
  • Go to Administer > Site configuration > Error reporting
  • Set Default 404 (not found) page to the node ID you just created
  • Save your settings

You can alternatively use the Search 404 module.

There are some conventions when using contributed modules and/or themes. Most users would want to place them in modules and themes folders.

Don't ever do that! Never place modules or themes in these directories!

Everything added to a fresh Drupal install should go somewhere in the sites directory:

  • Contributed modules (from drupal.org) should go in sites/all/modules/contrib
  • Project custom modules should go in sites/all/modules/custom
  • Contributed themes (from drupal.org) should go in sites/all/themes/contrib
  • Project custom themes should go in sites/all/themes/custom

Note that if you have a multisite environment, you could place somes of the modules/themes:

  • in sites/default/..
  • or sites/example.com/..
  • or sites/anotherdomain.com/..
  • and so on..

... depending on your configuration.

Note that using a contrib and custom directory convention will help you find out which modules are contributed by the drupal community and which you have developped specifically for the website.

This will allow you to update more easily your websites as the only directory you will need to preserve will be sites/*.

You can gain performances by disabling unecessary contributed modules from your live site. Here is a list of modules you can safely disable on a production site:

  • Devel
  • Devel generate
  • Devel node access
  • Performance Logging
  • Theme developer
  • Advanced help example
  • ImageCache UI
  • Views UI

There are a number of settings for contact forms that are easy to miss, since they aren't readily visible on the site. After you are sure that all the settings are right, you should also submit a test contact on every unique contact form to make sure the email address actually works.

The Site Information settings page at /admin/settings/site-information contains the from address setting.

/admin/build/contact has "To:" addresses and auto-responders, etc.

If you use Webforms, there are similar settings at /admin/settings/webform and per-node at /admin/content/webform (minimally, check the to address in each webform node).

Sometimes, you need to enter email adresses in your content. Good examples are your About page, or even your Contact page. But this the better way to get spammed!

It is strongly recommened to install a module such as SpamSan:

  • Download and activate SpamSan module
  • Go to Site configuration > Input formats

For each of your input format do the following:

  • Click on Edit
  • Check that Hide email addresses is enabled and save
  • Click the Rearrange tab and set Hide email adresses with a super high weight (10 for example)
  • Click Save configuration

All email adresses are now spam protected.

Check API keys (e.g. Google Maps API key) particular keys which assigned to a domain.

Use full PHP tags

Write:

<?php print $foo; ?>

Don't write:

<? print $foo; ?>

Semicolons
Write:

<?php print $foo; ?>

Don't write:

<?php print $foo ?>

No closing tags
When writing a module or customizing your theme template.php, don't use PHP closing tag ?>.

Notice that at the bottom of the following snippet, there is no PHP closing:

<?php
// Your file starts here
function phptemplate_foo() {
  return $bar;
}
// Your file ends here
// Don't add PHP closing tag

By doing this you prevent PHP interpreter to stop and restart on the next source code file. This mean better performance.