Xray Audit
A comprehensive site auditing module that generates detailed reports about various aspects of a Drupal installation including content, configuration, database, users, and modules.
xray_audit
Install
composer require 'drupal/xray_audit:^2.0'
composer require 'drupal/xray_audit:^1.6'
Overview
Xray Audit is a powerful auditing and reporting module designed for Drupal site administrators and developers. It provides a centralized dashboard to analyze and understand various aspects of a Drupal installation through organized report categories.
The module uses a plugin-based architecture with two main plugin types: XrayAuditGroupPlugin for organizing report categories and XrayAuditTaskPlugin for generating specific reports. This architecture makes the module extensible, allowing developers to create custom reports by implementing new plugins.
Reports are organized into logical groups covering content model architecture, content metrics, display configurations, access control, site structure (views and menus), installed packages (modules and themes), database information, block layouts, and webforms. Each report supports CSV download for external analysis and includes caching for improved performance.
The optional Xray Audit Insight submodule integrates with Drupal's Status Report to display warnings and recommendations based on the audit data, such as uncached views or excessive revision counts.
Features
- Comprehensive reporting dashboard with organized categories for content model, content metrics, display configurations, access control, site structure, packages, database, layout, and forms
- Plugin-based architecture allowing easy extension with custom reports
- CSV download support for all reports enabling external data analysis
- Drush commands for CLI-based reporting (node_count, paragraph_count, usage_place)
- Caching system for improved report generation performance
- Entity architecture reports showing content types, bundles, and field configurations
- Content metrics reports with counts by type, status, language, and time periods
- Views analysis including cache configuration, access settings, and anonymous user accessibility checks
- Menu and navigation architecture analysis with hierarchical display
- Module and theme status reports including version information and recommended updates
- Database table size analysis with configurable size thresholds
- Block layout configuration reports with visibility conditions
- User and role analysis including user counts by role, status, and activity period
- Display mode configuration reports for nodes, paragraphs, media, taxonomy, and blocks
- Image styles usage analysis across display modes, responsive images, and CKEditor
- External resources (oEmbed) monitoring for media entities
- Webform configuration reports (when Webform module is installed)
- Batch processing support for large data operations
- Insights submodule for Status Report integration with configurable warnings
Use Cases
Site Audit Before Migration
Before migrating a Drupal site or performing major updates, use Xray Audit to generate comprehensive reports on content types, modules, and configurations. Export all reports as CSV files for documentation and planning purposes.
Performance Optimization
Use the Views report to identify views without caching configured, and the Database report to find oversized tables. The Insight submodule will automatically flag these issues in the Status Report.
Content Inventory
Generate detailed content metrics reports to understand the distribution of content across types, languages, and time periods. Useful for content governance and cleanup initiatives.
Security Review
Analyze user roles and permissions, identify admin views accessible to anonymous users, and review block visibility conditions to ensure proper access control.
Module Cleanup
Use the Modules report to identify installed but unused modules, and the Insight module will flag these in the Status Report for cleanup consideration.
Image Style Audit
Analyze image style usage across display modes, responsive image configurations, and CKEditor settings to identify unused image styles that can be removed or consolidate duplicate styles.
Documentation Generation
Export all reports as CSV files to create documentation of the site's configuration, useful for client handoffs or team onboarding.
Tips
- Use the 'Download All Reports as ZIP' feature on the main dashboard to quickly export all available reports for external analysis or documentation
- Configure revision thresholds in the settings to match your site's content management workflow - some sites legitimately have many revisions
- The Views report highlights admin views accessible to anonymous users in red - review these carefully for potential security issues
- Export module reports before major updates to have a record of the pre-update state
- Use the Insight submodule during regular site maintenance to catch potential issues early
Technical Details
Admin Pages 3
/admin/reports/xray-audit
Main dashboard displaying all available report categories. Each category links to a group of related reports covering different aspects of the Drupal installation.
/admin/config/development/xray_audit/settings
Configuration page for setting thresholds used in reports and insights.
/admin/config/xray_audit_insight/settings
Configuration for the Insight submodule, allowing customization of which insights appear in the Drupal Status Report.
Permissions 2
Drush Commands 3
drush xray_audit:node_count
Counts nodes that are being used (published status)
drush xray_audit:paragraph_count
Counts paragraph bundles that are in use across the site
drush xray_audit:usage_place
Lists nodes where entity bundles (node or paragraph) are used
Troubleshooting 4
Ensure the required dependencies for specific reports are enabled (e.g., Paragraphs module for paragraph reports, Webform for webform reports). Check that you have appropriate permissions to view the data.
Ensure your server allows file downloads and the temporary directory is writable. Check PHP memory limits if generating large reports.
Verify the Xray Audit Insight submodule is enabled and check the Insight settings to ensure the specific insight is not disabled.
Clear the Xray Audit cache by clearing all Drupal caches or waiting for cache expiration. Report data is cached for performance.
Security Notes 3
- The 'xray_audit access' and 'xray_audit administer configuration' permissions are marked as restricted and should only be granted to trusted administrators
- Reports may expose sensitive information about site configuration, user counts, and database structure
- The module analyzes anonymous user access to views which can help identify potential security issues