We fully audited the website of Virgin Mobile Chile, solving specific problems and security, performance, code quality and software architecture matters.

An audit not only allows the comprehension of what is happening and what the principal problems are, but it also enables you to apply the best solutions

We performed an audit at System Architecture level, which included:

• Performance tests at hardware level (CPU, RAM, disk consumption - IOPS, iowait)

• Software performance tests (concurrence of requests to "MySQL", study of Slow Queries, use of the cache of MySQL, concurrence in Varnish, concurrence in Apache).

• Study of sessions: we recommended using the "sticky session" strategy at the balancer level given that there were problems regarding the integrity of the content cached.

• Recommendation to use shared storage: Dynamic data was not shared between compute nodes, which gave inconsistent responses to clients. After studying the infrastructure, we recommend and helped to set up an NFS server.

• Analysis of processes and services which were not being used, such as memcached and postfix server when using an external service...

We provided recommendations for the configuration of the different services they used:

• Varnish: we analysed the URLs to be cached and proposed a list of new URLs that could be cached without any problem; we suggested that all varnish pointed to all Apaches in order to find high availability. We also adjusted the RAM used.

• Apache: It was badly configured which only allowed only 15 requests per node. We offered a better Apache configuration.

• Redis: Use was minimal. We gave some guidelines in order to improve its performance.

• MySQL: We provided a more suitable configuration for its current use, working on caches and slow queries.

We performed an audit at Drupal Development level:

• Recommendation of a development flow based on GitFlow and with continuous integration to avoid large misalignments between development, preproduction and production environments.

• Control of the drupal_http_request function for requests to external subsystems

• Security breaches

• Incorrect permissions on important Drupal files. To stop this, we created a script that will ensure the integrity of the Drupal file structure.

• It was detected in two forms that they could be attacked with techniques like SQL Injection. We made suggestions and changes in code.

• Updating of modules, with priority given to security updates.

• Fixing part of the Drupal kernel that was affected. This is a bad Drupal practice and it's always advisable to leave the kernel intact.

• Coding errors: Irregularities in the coding of personalized modules (non-compliance with coding standards, non-compliance with comments standards, existence of unused code, inappropriate use of includes, code not adapted to multi-language support, etc...).