Something which I was wondering about with Drupal was the fact that both cron.php and update.php are public reachable files (Even though you only can reach update.php if you are logged in). Don't think this pose any really danger unless you do heavy tasks in your drupal cron jobs. Anyhow: I decided to change that. In my configuration for Apache I placed something like this:

This server is installed with mod_ssl, which means that you can use both https and http. That was just fine, until I discovered that google was duplicating my search results. So that each page was listed first as http://www.os-cms.net and then the exact same page, just as https://www.os-cms.net

The solution was to make two robots text. First the ordinary robots.txt and then make a robots_ssl.txt with this content:

User-agent: *
disallow: /

You need to have mod_rewrite enabled to use the solution: You add the following somewhere in your server setup:

Normally when you install a distribution of Linux server software (Apache with a PHP module enabled) there will be a signature in the headers sent to the browser. You can remove those headers quite easily so nobody know what exact versions of software your are using, which is a far more secure solution for your Apache server:

In your php.ini search for expose_php and set it to 'Off' e.g:

expose_php = Off

In your Apache configuration search for 'ServerTokens' (in my case it is located in): /etc/apache2/conf.d/security

Note (7/6-09): I have made a drush extension which you can find at http://www.os-cms.net/node/46 This extension does the same as this shell script but also a lot more. Your can use this extension to even more easily create virtual hosts.

The script does the following:

• Creates new site folder inside drupal sites/ eg. sites/dev.os-cms.net with files dir and settings.php
• Writes database url to sites/www.os-cms.net/settings.php
• Creates seperate folder for holding apache logs/ for your new domain