What will you actually check on my Drupal?

Core and modules, settings.php, leftover installers, open registration, and whether user accounts can be listed. Subdomains and open ports are included.

Do I have to install an agent?

No. You enter the public URL. The audit runs from the outside against what the internet can already see.

When do I see the report?

You get the report in your account after signup. $49 covers the month, and this run is included.

What does the $49 include?

One month of Starter access: up to 10 runs and 3 domains, including this audit. The finished report stays in the account.

axeploit

Drupal security audit

How to audit a Drupal site in 2026

Which modules are outdated?

Deeper than a manual audit or a tool. At the scale AI agents attack.

The audit starts after signup. $49 for one month. Your report stays in your account.

Core and modules
Known CVEs
Installer leftovers
Users and files

Drupal templateyour-site.com

01 / 08·running

Public surface

Other hosts and open ports

Live audit preview$49 · 1 month

Signals

Core and modulesThe Drupal release and modules your site is actually serving, not a guess.
Known CVEsPublished holes in that core and in the modules we could see.
Installer leftoversupdate.php, authorize.php, and install.php still answering after go-live.
Users and filesOpen registration, user enumeration, and a files directory that lists itself.

How it runs

How the Drupal audit runs

What else is on this domain

Other hostnames on the same domain, then the ports those servers leave open, before anything Drupal-specific.

Subdomains
Staging, old admin hosts, and the other names on your domain.
Live hosts
Which of those names actually answer.
Open ports
What is listening, including the version when the server says it.

On your Drupal

Your Drupal core and modules, then the installer files, user accounts, and public files directory someone can still request.

Core and modules
The Drupal release and modules your site is actually serving, not a guess.
Known CVEs
Published holes in that core and in the modules we could see.
Installer leftovers
update.php, authorize.php, and install.php still answering after go-live.
Users and files
Open registration, user enumeration, and a files directory that lists itself.

A report you can act on

Each issue names the host, shows the evidence, and says what to fix. Anything we could not confirm stays marked that way.

Evidence
The URL or file that proved it.
CVE ids
Only when we saw the version the advisory is about.
Account
The report opens after the $49 month is paid.

FAQ

Questions about a Drupal audit

What the run covers, and when the report opens in the account.

Drupal audit

Audit Drupal from the outside.

Deeper than a manual audit or a tool. At the scale AI agents attack.

Start the Drupal audit See a sample report