Nobody likes a slow site, and Drupal can be notoriously sluggish if you're not careful. With the right configuration and platform, any site can be blazingly fast - but where to start? Enter site_audit, a collection of drush commands for statically analyzing Drupal 7 sites for best practices and optimal configuration. Join the developer for an in-depth discussion of how to analyze and optimize your site, and discover how to extend the platform with your own checks! Site Audit reports include: - Best Practices - structural recommendations - Block - caching - Cache - optimal Drupal caching settings - Codebase - size of the site; size and count of managed files - Content - checks for unused content types, vocabularies - Cron - Drupal's built-in cron - Database - collation, engine, row counts, and size - Extensions - count, development modules, duplicates, missing - Insights - Analyze site with Google PageSpeed Insights - Status - check for failures in Drupal's built-in status report - Users - blocked user #1, number of normal and blocked users, list of roles - Views - caching settings - Watchdog - 404 error count, age, number of entries, enabled, PHP errors Site Audit is also used by Pantheon to power Launch Check from within site dashboards.

1. Auditing
Drupal
sites
for performance, content
and optimal configuration
drupal.org/project/site_audit
2015.02.27 - SANDcamp

2. Jon Peck
Senior Engineer at Four Kitchens
@FluxSauce - github.com/fluxsauce - drupal.org/u/fluxsauce

3. What is an audit?
• official inspection of
accounts
• validate the good things
you’re doing
• highlight areas of
improvement
Electrical inspector in Public Safety Building, 1957
Item 54948, Engineering Department Photographic Negatives
(Record Series 2613-07), Seattle Municipal Archives.

4. Why audit sites?
• Learn about contents and
structure
• Ensure optimal configuration
• Discover areas of improvement

5. Every site is unique, but…
• Built with the same
framework
• Similar architectural
requirements
• One size fits most
Construction of a housing development in Newport Beach, California, 1974.
Photo: National Geographic/Getty Images

6. Effective auditing
• Consistent
• Quantifiable
• Contextually aware
• Easy to understand
• Actionable recommendations

7. Static program analysis
• Performance & behavior
gathering
• Does not execute
• Non-intrusive
• Automated
Poltergeist (1982)

8. What is Site Audit?
• Drupal 7 site analyzer
• Installed on target
platform
• Provides reports in
multiple formats
• Powers Launch Check
on Pantheon

9. Requirements
• Bootstrappable Drupal site
• Drush 5.10 or higher, PHP 5.3
• Shell access to target

10. Installation
• Not a module
• Place in Drush
commands folder
• Within user profile for
just yourself
• Within Drush
installation folder http://forums.beyond.ca/showthread/t-188507-p-2.html

11. What does Site Audit check?
• Best Practices
• Block
• Cache
• Codebase
• Content
• Cron
• Database
• Extensions
• Google Insights
• Security
• System Status
• Users
• Views
• Watchdog

12. What doesn’t Site Audit analyze?
• DOM / front-end performance
• Usability and site experience
• Aesthetics
• Content

13. Usage
drush
help
-­‐-­‐filter=site_audit

14. drush audit_cache

15. drush ac --detail

16. HTML Output
drush audit_best_practices --html --detail

17. JSON output
drush audit_cron --json

18. Vendor support
drush ae --vendor=acquia
drush ae --vendor=pantheon

19. Audit All
drush aa --skip=insights --html --bootstrap

20. Reports
What and why.

21. • Drupal Fast 404 HTML pages
• Multisite - informational
• PHP Filter - should be disabled
• Settings and configuration - exists, not symbolic
• settings.php
• sites/all
• sites/default
• Unnecessary files in sites
Best Practices

22. Block
• Caching • Cache Report

23. Cache
• Anonymous page
caching
• Backends - list
• Bins - list any specified
• Default class
• Minimum cache lifetime
- should be never expire
• Lock - display default
locking mechanism
• Page Compression -
should be on
• Expiration of cached
pages - at least 15
minutes
• Aggregate and
compress CSS, JS

24. Codebase
• Size of entire site on disk
• Size of public files
• Managed file size, count

25. Content
• Available content types and node counts
• Unused content types - consider removing
• Available vocabularies and term counts
• Unused vocabularies - consider removing

26. Database
• Collation - check if
anything isn’t UTF-8
• Engine - checks if anything
isn’t using InnoDB
• Row count - reports tables
with more than X rows
• Size in MB - including
indexes and data

27. Security
• Scans menu_router for
malicious callbacks
• More coming…

28. Extensions
(modules and themes)
• Count - 150 as arbitrary warning
• Dev - reports development modules, provider aware of dev env
• Disabled but not uninstalled
• Duplicate - checks for duplicates
• Missing - enabled, but code is missing
• Unrecommended - Short list of bad modules
• Version - specific problems in widely used modules

29. Status
• Drupal status report
• Highlights errors and problems

30. Users
• Who is #1, blocked?
• Count of all users
• Count of blocked users
• Role list, counts by role

31. Views
• Count enabled
• Caching rendered output
• Caching query results

32. Watchdog
• Number of 404s
• How old the logs are
• Count of entries
• PHP errors
• Syslog

33. Development
Yes, it is extensible.

34. Structure
• Object-oriented, abstract classes
• Checks - individual checks; treat like unit tests
• Report - collection of checks, run in a specific order.
Can abort.

35. • Extend abstract SiteAuditReport, SiteAuditCheck
• Drush hooks
• Add callbacks
• Add to audit_all
• README.md
Custom Checks and Reports

36. Hacked! integration
https://www.drupal.org/node/2066371

37. Security Review integration
https://www.drupal.org/node/2279283

38. Share your checks!

39. Drupal 8 is now supported!
Under heavy development.

40. Google Summer of Code
https://www.drupal.org/node/2426727

41. Good configuration matters.
https://drupal.org/project/site_audit
@FluxSauce - github.com/fluxsauce - drupal.org/u/fluxsauce
Applied site_audit recommendations.