Drupal Vulnerability Scanner
Detect installed Drupal core and contributed-module versions and check them against our own vulnerability database.
Monitor this automatically
NetTests can run this check on a schedule, preserve historical results, compare changes over time, and alert you the moment something breaks.
Start monitoring free → See all monitoring productsFrequently Asked Questions
What does this scanner check?
It detects the Drupal core version and installed contributed modules from a site's page source, then checks each against our own vulnerability database sourced from Drupal's own security team advisories.
How does it detect the Drupal core version?
It tries CHANGELOG.txt first, which ships with the exact patch version as its first line. If that's blocked (a common hardening practice on well-configured sites), it falls back to the <meta name="generator"> tag, which only gives the major version — in that case exact vulnerability matching isn't attempted, since we can't safely evaluate a patch-level range against a major version alone.
How does it detect installed modules and their versions?
Module slugs are read from asset paths in the page source. Unlike WordPress, Drupal doesn't include the version inline — a separate request for that module's .info.yml file is made to read its packaged version.
What does "Unsupported" mean on a finding?
It's a category Drupal's own security team uses for modules that have been abandoned by their maintainer and no longer receive security coverage — not a description of a specific exploitable flaw, just a signal the module itself is no longer safe to rely on.
Why does this require authentication?
This tool fetches and analyses a live target. Authentication and target-ownership verification ensure users only scan infrastructure they control.
Where does the vulnerability data come from?
We maintain our own vulnerability database, synced from Drupal's own security team advisories and refreshed automatically. Results are looked up against our own records, not fetched live from a third party at scan time.