The fact that you made additional users for each of the site is great since if one gets hacked/exploited the rest is unlikely to be affected however you could go one step further.

Vhosts in Home Folders

You can move the hosts actually into their home folders so they are jailed so to speak which will add a little bit of extra security. You can setup the vhosts so that the paths are in /home/drupal/public_html for example, and then setup so each user can't enter other users homes.

Chmod

I'm sure you done this already you seem to have your head screwed on about the security but the key files that are injected in most exploits are the template files, index file, config file and the .htaccess file. So CHMOD these files are extremely important.

While setting the CHMOD is key there is also some other key elements which you can secure your site.

SQL Injections

SQL injections are still very popular and using good security measures can prevent this, turning off things like error_reporting in the php.ini file can help as well as setting up secure .htaccess to add an extra layer. But you should always try to see if your placing of data into the SQL is sanitized, It's important that you check to see the plugins that you are using are using mysql_real_escape_string or pg_escape_string (if using PHP) or use prepared statements on all queries using variables from a POST or GET. This will help SQL injection, its pretty load winded to list exactly how to do this but your need to search Google and learn abit more about SQL injections to prevent them fully.

PHP Security

You should consider using a php.ini for each of your sites in their home directorys so you can disable things they don't need to operate. The more things you disable the less hackers have to use against your site.

I consider to disable these though depending on your site you may need things like fopen to do updates, or do the manually and you can most likely disable it.

allow_url_fopen = Off
display_errors = Off
display_startup_errors = Off
log_errors = On
error_reporting = E_ALL
error_log = /home/yourUserID/public_html/phperr.txt
expose_php = Off
magic_quotes_gpc = Off
magic_quotes_sybase = Off
register_globals = Off 

Robots.txt

Robots can add a minor a bit of security to your site by preventing search engines access to your plugins folders, a lot of security issues are caused by outdated, exploitable plugins and most often hackers use Google to find these sites. Ensure that your blocking plugins so people can't find them on your site.

The fact that you made additional users for each of the site is great since if one gets hacked/exploited the rest is unlikely to be affected however you could go one step further.

Vhosts in Home Folders

You can move the hosts actually into their home folders so they are jailed so to speak which will add a little bit of extra security. You can setup the vhosts so that the paths are in /home/drupal/public_html for example, and then setup so each user can't enter other users homes.

Chmod

I'm sure you done this already you seem to have your head screwed on about the security but the key files that are injected in most exploits are the template files, index file, config file and the .htaccess file. So CHMOD these files are extremely important.

While setting the CHMOD is key there is also some other key elements which you can secure your site.

SQL Injections

SQL injections are still very popular and using good security measures can prevent this, turning off things like error_reporting in the php.ini file can help as well as setting up secure .htaccess to add an extra layer. But you should always try to see if your placing of data into the SQL is sanitized, It's important that you check to see the plugins that you are using are using mysql_real_escape_string or pg_escape_string (if using PHP) or use prepared statements on all queries using variables from a POST or GET. This will help SQL injection, its pretty loan winded to list exactly how to do this but your need to search Google and learn a bit more about SQL injections to prevent them fully.

PHP Security

You should consider using a php.ini for each of your sites in their home directorys so you can disable things they don't need to operate. The more things you disable the less hackers have to use against your site.

I consider to disable these though depending on your site you may need things like fopen to do updates, or do the manually and you can most likely disable it.

allow_url_fopen = Off
display_errors = Off
display_startup_errors = Off
log_errors = On
error_reporting = E_ALL
error_log = /home/yourUserID/public_html/phperr.txt
expose_php = Off
magic_quotes_gpc = Off
magic_quotes_sybase = Off
register_globals = Off 

Robots.txt

Robots can add a minor a bit of security to your site by preventing search engines access to your plugins folders, a lot of security issues are caused by outdated, exploitable plugins and most often hackers use Google to find these sites. Ensure that your blocking plugins so people can't find them on your site.

The fact that you made additional users for each of the site is great since if one gets hacked/exploited the rest is unlikely to be affected however you could go one step further and move the hosts actually into their home folders so they are jailed so to speak which will add a little bit of extra security. You can setup the vhosts so that the paths are in /home/drupal/public_html for example, and then setup so each user can't enter other users homes.

I'm sure you done this already you seem to have your head screwed on about the security but the key files that are injected in most exploits are the template files, index file, config file and the .htaccess file. So CHMOD these files are extremely important.

While setting the CHMOD is key there is also some other key elements which you can secure your site.

SQL injections are still very popular and using good security measures can prevent this, turning off things like error_reporting in the php.ini file can help as well as setting up secure .htaccess to add an extra layer. But you should always try to see if your placing of data into the SQL is sanitized, It's important that you check to see the plugins that you are using are using mysql_real_escape_string or pg_escape_string (if using PHP) or use prepared statements on all queries using variables from a POST or GET. This will help SQL injection, its pretty load winded to list exactly how to do this but your need to search Google and learn abit more about SQL injections to prevent them fully.

The fact that you made additional users for each of the site is great since if one gets hacked/exploited the rest is unlikely to be affected however you could go one step further.

Vhosts in Home Folders

You can move the hosts actually into their home folders so they are jailed so to speak which will add a little bit of extra security. You can setup the vhosts so that the paths are in /home/drupal/public_html for example, and then setup so each user can't enter other users homes.

Chmod

I'm sure you done this already you seem to have your head screwed on about the security but the key files that are injected in most exploits are the template files, index file, config file and the .htaccess file. So CHMOD these files are extremely important.

While setting the CHMOD is key there is also some other key elements which you can secure your site.

SQL Injections

SQL injections are still very popular and using good security measures can prevent this, turning off things like error_reporting in the php.ini file can help as well as setting up secure .htaccess to add an extra layer. But you should always try to see if your placing of data into the SQL is sanitized, It's important that you check to see the plugins that you are using are using mysql_real_escape_string or pg_escape_string (if using PHP) or use prepared statements on all queries using variables from a POST or GET. This will help SQL injection, its pretty load winded to list exactly how to do this but your need to search Google and learn abit more about SQL injections to prevent them fully.

PHP Security

You should consider using a php.ini for each of your sites in their home directorys so you can disable things they don't need to operate. The more things you disable the less hackers have to use against your site.

I consider to disable these though depending on your site you may need things like fopen to do updates, or do the manually and you can most likely disable it.

allow_url_fopen = Off
display_errors = Off
display_startup_errors = Off
log_errors = On
error_reporting = E_ALL
error_log = /home/yourUserID/public_html/phperr.txt
expose_php = Off
magic_quotes_gpc = Off
magic_quotes_sybase = Off
register_globals = Off 

Robots.txt

Robots can add a minor a bit of security to your site by preventing search engines access to your plugins folders, a lot of security issues are caused by outdated, exploitable plugins and most often hackers use Google to find these sites. Ensure that your blocking plugins so people can't find them on your site.