Security and performance checks

A well-optimized site must also be secure and performant: search engines treat page speed and HTTPS as ranking signals. This page walks the security and performance group of the SEO checklist so your site stays fast, safe, and reliable.

Goal

Automated security checks running on your site, a page speed benchmark recorded, and the hosting-level items (HTTPS, caching, CDN) reviewed for the live site.

Prerequisites

• The SEO checklist opened and saved once; see Work through the SEO checklist.

Steps

Open the checklist at Configuration → Search and metadata → SEO Checklist/admin/config/search/seo-checklist and work down the security and performance group.

Install and run Security Review

The Security Review module automatically tests your site for common security vulnerabilities. It is not installed by default.

1. Download and install the Security Review module.
2. Use the item’s Configure permissions link to ensure the appropriate roles can access and run security review checks.
3. Use the item’s Configure link, or go to Configuration → System → Security Review/admin/config/security-review. The Help tab describes each security check.
4. Use the Settings tab to select and configure the checks to run.
5. Use the Run & review tab to run the security check.

Run a speed test

Search engines like Google consider page speed as a ranking factor. Run a speed test to establish a performance benchmark you can compare against after changes. Tools:

• Google PageSpeed Insights
• WebPageTest (webpagetest.org)

Serve your site over HTTPS

HTTPS encrypts the information sent between your site and a visitor’s browser, like passwords or personal information. Sites without HTTPS may show a “Not secure” warning to visitors, harming your site’s credibility, and search engines like Google prioritize secure websites: HTTPS is a confirmed ranking factor.

When you move your site to a hosting provider, ensure it has an SSL certificate. Choosing a provider that handles installing and renewing the certificate for you is highly recommended.

Verify caching and aggregation on the live site

Any page on your site can pull in many files that handle style and behavior. Drupal CMS aggregates these CSS and JavaScript files to make your site more performant, and aggregation is turned on by default. If you develop a custom theme, you may have turned caching or aggregation off in a local environment, so double-check the live site.

1. Use the item’s Configure link, or go to Configuration → Development → Performance/admin/config/development/performance.
2. Under Caching, ensure a reasonable value for Browser and proxy cache maximum age. The default is 15 minutes.
3. Under Bandwidth optimization, ensure both aggregation options are toggled on.

Consider a CDN

For sites with international or high-traffic audiences, a CDN such as Cloudflare improves global performance and security.

• Check with your hosting provider about any CDN integration they provide.
• Alternatively, install the Cloudflare module.

Evaluate your hosting

If your site shows slow response times or performance bottlenecks, upgrading your hosting can significantly improve performance and search rankings. Run a performance analysis to determine how your site could improve and whether changing providers is warranted.

Verify

• The Run & review tab of Security Review reports the results of your selected checks.
• The Performance page shows caching and both aggregation options on for the live site.
• Your speed test results are recorded somewhere you can find them for the next comparison.

Related

• Previous in the checklist: Optimize performance and mobile experience. This is the last checklist group; continue with Tags and analytics.
• The security checklist in the deployment docs covers the same ground at developer depth.
• Performance and caching explains what the caching and aggregation settings do.