diff --git a/config/install/seckit.settings.yml b/config/install/seckit.settings.yml
index 7c7d11b..1332862 100644
--- a/config/install/seckit.settings.yml
+++ b/config/install/seckit.settings.yml
@@ -39,3 +39,13 @@ seckit_various:
   from_origin_destination: same
   from_origin_destination: ''
   disable_autocomplete: FALSE
+seckit_advanced:
+  disable_seckit: FALSE
+  unlimited_csp_reports: TRUE
+  csp_limits:
+    max_size: 4096
+    flood:
+      limit_user: 100
+      window_user: 900
+      limit_global: 1000
+      window_global: 3600
diff --git a/config/schema/seckit.schema.yml b/config/schema/seckit.schema.yml
index 35e5644..5907aa6 100644
--- a/config/schema/seckit.schema.yml
+++ b/config/schema/seckit.schema.yml
@@ -133,3 +133,36 @@ seckit.settings:
         disable_autocomplete:
           type: boolean
           label: 'Disable autocomplete'
+    seckit_advanced:
+      type: mapping
+      label: 'Advanced'
+      mapping:
+        disable_seckit:
+          type: boolean
+          lablel: 'Disable Seckit'
+        unlimited_csp_reports:
+          type: boolean
+          label: 'Unlimited CSP reports'
+        csp_limits:
+          type: mapping
+          label: 'CSP Violation reporting limits'
+          mapping:
+            max_size:
+              type: integer
+              label: 'Maximum report size (bytes)'
+            flood:
+              type: mapping
+              label: 'Flood Settings'
+              mapping:
+                limit_user:
+                  type: integer
+                  label: 'Maximum reports per IP address'
+                window_user:
+                  type: integer
+                  label: 'Time window for per IP address flood detection'
+                limit_global:
+                  type: integer
+                  label: 'Maximum reports globally (ie. irrespective of IP address)'
+                window_global:
+                  type: integer
+                  label: 'Time window for global flood detection'
diff --git a/seckit.install b/seckit.install
new file mode 100644
index 0000000..e2a90f1
--- /dev/null
+++ b/seckit.install
@@ -0,0 +1,21 @@
+<?php
+
+/**
+ * @file
+ *   Install file for seckit module.
+ */
+
+/**
+ * Set defaults for seckit_advanced settings.
+ */
+function seckit_update_8001() {
+  $config = \Drupal::configFactory()->getEditable('seckit.settings');
+  $config->set('seckit_advanced.disable_seckit', FALSE)
+    ->set('seckit_advanced.unlimited_csp_reports', TRUE)
+    ->set('seckit_advanced.csp_limits.max_size', 4096)
+    ->set('seckit_advanced.csp_limits.flood.limit_user', 100)
+    ->set('seckit_advanced.csp_limits.flood.window_user', 900)
+    ->set('seckit_advanced.csp_limits.flood.limit_global', 1000)
+    ->set('seckit_advanced.csp_limits.flood.window_global', 3600)
+    ->save();
+}
diff --git a/seckit.module b/seckit.module
index 5a2cb15..d914fba 100644
--- a/seckit.module
+++ b/seckit.module
@@ -20,6 +20,15 @@ define('SECKIT_X_FRAME_ALLOW_FROM', 3); // set X-Frame-Options HTTP header to Al
 define('SECKIT_CSP_REPORT_URL', 'report-csp-violation');
 
 /**
++ * Default limits for CSP violation reports.
++ */
+define('SECKIT_CSP_REPORT_MAX_SIZE', 4096); // Max accepted byte count
+define('SECKIT_CSP_REPORT_FLOOD_LIMIT_USER', 100); // Max reports per IP address...
+define('SECKIT_CSP_REPORT_FLOOD_WINDOW_USER', 900); // ...per time window (in seconds)
+define('SECKIT_CSP_REPORT_FLOOD_LIMIT_GLOBAL', 1000); // Max reports globally...
+define('SECKIT_CSP_REPORT_FLOOD_WINDOW_GLOBAL', 3600); // ...per time window (in seconds)
+
+/**
  * Implements hook_form_FORM_ID_alter() for 'user_login'.
  */
 function seckit_form_user_login_form_alter(&$form, FormStateInterface &$form_state) {
@@ -45,3 +54,55 @@ function _seckit_form_alter_login_form(&$form, FormStateInterface &$form_state)
     }
   }
 }
+
+/**
+ * Check for CSP violation report flooding.
+ *
+ * @return (bool)
+ *   TRUE if flooding is detected (report logging should be inhibited).
+ *   FALSE if it is safe to proceed with logging the report.
+ */
+function _seckit_csp_report_flooding_detected() {
+  $flood_service = \Drupal::service('flood');
+  $config = \Drupal::config('seckit.settings');
+
+  // The global limit provides some DDOS protection.
+  $global_limit = $config->get('seckit_advanced.csp_limits.flood.limit_global');
+  $global_window = $config->get('seckit_advanced.csp_limits.flood.window_global');
+
+  try {
+    // flood_is_allowed() does not presently allow us to ignore the identifier,
+    // meaning we would need to log two flood events per CSP report in order to
+    // check both the global and per-user counts using the API function. This
+    // query enables us to do this while only registering one event per report.
+    // @see https://www.drupal.org/node/2472941
+    $connection = \Drupal::database();
+    $global_count = $connection->select('flood', 'f')
+      ->condition('event', 'seckit_csp_report')
+      ->condition('timestamp', REQUEST_TIME - $global_window, '>')
+      ->countQuery()
+      ->execute()
+      ->fetchField();
+  }
+  catch (\Exception $e) {
+    // Table could not exist
+    $global_count = 0;
+    \Drupal::logger('seckit')->warning("Exeption trying to get global count: @message", array('@message' => $e->getMessage()));
+  }
+
+  if ($global_count >= $global_limit) {
+    return TRUE; // Flooding is in effect
+  }
+
+  // Per-user limit.
+  $user_limit = $config->get('seckit_advanced.csp_limits.flood.limit_user');
+  $user_window = $config->get('seckit_advanced.csp_limits.flood.window_user');
+  if (!$flood_service->isAllowed('seckit_csp_report', $user_limit, $user_window)) {
+    return TRUE; // Flooding is in effect
+  }
+
+  // Flooding is not in effect. Log this event, and return the status.
+  $flood_service->register('seckit_csp_report', $user_window);
+
+  return FALSE; // No flooding
+}
diff --git a/src/Controller/SeckitExportController.php b/src/Controller/SeckitExportController.php
index 114f676..e34ffb2 100644
--- a/src/Controller/SeckitExportController.php
+++ b/src/Controller/SeckitExportController.php
@@ -5,6 +5,7 @@ namespace Drupal\seckit\Controller;
 use Drupal\Core\Access\AccessResult;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
 /**
@@ -16,6 +17,11 @@ class SeckitExportController {
    * Reports CSP violations.
    */
   public function export(Request $request) {
+    $config = \Drupal::config('seckit.settings');
+    if ($config->get('seckit_advanced.disable_seckit')) {
+      throw new NotFoundHttpException();
+    }
+
     // Only allow POST data with Content-Type application/csp-report
     // or application/json (the latter to support older user agents).
     // n.b. The CSP spec (1.0, 1.1) mandates this Content-Type header/value.
@@ -32,8 +38,30 @@ class SeckitExportController {
       throw new NotFoundHttpException();
     }
 
+    $config = \Drupal::config('seckit.settings');
+    $unlimited_reports = $config->get('seckit_advanced.unlimited_csp_reports');
+
+    // Check for flooding.
+    if (!$unlimited_reports && _seckit_csp_report_flooding_detected()) {
+      // An exception gets logged, if we are preventing for performance reasons
+      // we don't want this logged because it could cause a db write if dblog
+      // is enabled.
+      return new Response();
+    }
+
     // Get and parse report.
     $reports = file_get_contents('php://input');
+
+    if (!$unlimited_reports) {
+      $max_size = $config->get('seckit_advanced.csp_limits.max_size');
+      if (strlen($reports) > $max_size)  {
+        // An exception gets logged, if we are preventing for performance reasons
+        // we don't want this logged because it could cause a db write if dblog
+        // is enabled.
+        return new Response();
+      }
+    }
+
     $reports = json_decode($reports);
     if (!is_object($reports)) {
       throw new NotFoundHttpException();
@@ -52,8 +80,6 @@ class SeckitExportController {
       \Drupal::logger('seckit')->warning('CSP: Directive @directive violated.<br /> Blocked URI: @blocked_uri.<br /> <pre>Data: @data</pre>', $info);
     }
 
-    $response['status'] = 'ok';
-
     return new Response();
   }
 }
diff --git a/src/EventSubscriber/SecKitEventSubscriber.php b/src/EventSubscriber/SecKitEventSubscriber.php
index 999e57b..e56139e 100644
--- a/src/EventSubscriber/SecKitEventSubscriber.php
+++ b/src/EventSubscriber/SecKitEventSubscriber.php
@@ -32,6 +32,11 @@ class SecKitEventSubscriber implements EventSubscriberInterface {
   }
 
   public function onKernelRequest(GetResponseEvent $event) {
+    $config = \Drupal::config('seckit.settings');
+    if ($config->get('seckit_advanced.disable_seckit')) {
+      return;
+    }
+
     $this->request = $event->getRequest();
 
     // execute necessary functions
@@ -41,6 +46,11 @@ class SecKitEventSubscriber implements EventSubscriberInterface {
   }
 
   public function onKernelResponse(FilterResponseEvent $event) {
+    $config = \Drupal::config('seckit.settings');
+    if ($config->get('seckit_advanced.disable_seckit')) {
+      return;
+    }
+
     $this->response = $event->getResponse();
 
     // execute necessary functions
@@ -106,7 +116,6 @@ class SecKitEventSubscriber implements EventSubscriberInterface {
     }
 
     // Allow requests from whitelisted Origins.
-    global $base_root;
     global $base_url;
 
     $whitelist = explode(',', $this->config->get('seckit_csrf.origin_whitelist'));
@@ -131,7 +140,6 @@ class SecKitEventSubscriber implements EventSubscriberInterface {
     );
 
     $message = 'Possible CSRF attack was blocked. IP address: @ip, Origin: @origin.';
-    $warning = t($message, $args);
     \Drupal::logger('seckit')->warning($message, $args);
 
     $event->setResponse(new Response(t('Access denied'), Response::HTTP_FORBIDDEN));
diff --git a/src/Form/SecKitSettingsForm.php b/src/Form/SecKitSettingsForm.php
index 945a676..fd9933f 100644
--- a/src/Form/SecKitSettingsForm.php
+++ b/src/Form/SecKitSettingsForm.php
@@ -38,17 +38,17 @@ class SecKitSettingsForm extends ConfigFormBase {
       '@browserscope' => 'Browserscope',
     );
     $form['seckit_description'] = array(
-      '#markup' => t('This module provides your website with various options to mitigate risks of common web application vulnerabilities like Cross-site Scripting, Cross-site Request Forgery and Clickjacking. It also has some options to improve your SSL/TLS security and fixes Drupal 6 core Upload module issue leading to an easy exploitation of an old Internet Explorer MIME sniffer HTML injection vulnerability. Note that some security features are not supported by all browsers. You may find this out at <a href=":browserscope">@browserscope</a>.', $args),
+      '#markup' => $this->t('This module provides your website with various options to mitigate risks of common web application vulnerabilities like Cross-site Scripting, Cross-site Request Forgery and Clickjacking. It also has some options to improve your SSL/TLS security and fixes Drupal 6 core Upload module issue leading to an easy exploitation of an old Internet Explorer MIME sniffer HTML injection vulnerability. Note that some security features are not supported by all browsers. You may find this out at <a href=":browserscope">@browserscope</a>.', $args),
     );
 
     // main fieldset for XSS
     $form['seckit_xss'] = array(
       '#type' => 'details',
-      '#title' => t('Cross-site Scripting'),
+      '#title' => $this->t('Cross-site Scripting'),
       '#collapsible' => TRUE,
       '#tree' => TRUE,
       '#open' => TRUE,
-      '#description' => t('Configure levels and various techniques of protection from cross-site scripting attacks'),
+      '#description' => $this->t('Configure levels and various techniques of protection from cross-site scripting attacks'),
     );
 
     // fieldset for Content Security Policy (CSP)
@@ -59,27 +59,27 @@ class SecKitSettingsForm extends ConfigFormBase {
 
     $form['seckit_xss']['csp'] = array(
       '#type' => 'details',
-      '#title' => t('Content Security Policy'),
+      '#title' => $this->t('Content Security Policy'),
       '#collapsible' => TRUE,
       '#tree' => TRUE,
       '#open' => !empty($config->get('seckit_xss.csp.checkbox')),
-      '#description' => t('Content Security Policy is a policy framework that allows to specify trustworthy sources of content and to restrict its capabilities. You may read more about it at <a href=":wiki">@wiki</a>.', $args),
+      '#description' => $this->t('Content Security Policy is a policy framework that allows to specify trustworthy sources of content and to restrict its capabilities. You may read more about it at <a href=":wiki">@wiki</a>.', $args),
     );
     // CSP enable/disable
     $form['seckit_xss']['csp']['checkbox'] = array(
       '#type' => 'checkbox',
       '#default_value' => $config->get('seckit_xss.csp.checkbox'),
-      '#title' => t('Send HTTP response header'),
+      '#title' => $this->t('Send HTTP response header'),
       '#return_value' => 1,
-      '#description' => t('Send Content-Security-Policy (official), X-Content-Security-Policy (supported by Mozilla Firefox and IE10) and X-WebKit-CSP (supported by Google Chrome and Safari) HTTP response headers with the list of Content Security Policy directives.'),
+      '#description' => $this->t('Send Content-Security-Policy (official), X-Content-Security-Policy (supported by Mozilla Firefox and IE10) and X-WebKit-CSP (supported by Google Chrome and Safari) HTTP response headers with the list of Content Security Policy directives.'),
     );
     // CSP report-only mode
     $form['seckit_xss']['csp']['report-only'] = array(
       '#type' => 'checkbox',
       '#default_value' => $config->get('seckit_xss.csp.report-only'),
-      '#title' => t('Report Only'),
+      '#title' => $this->t('Report Only'),
       '#return_value' => 1,
-      '#description' => t('Use Content Security Policy in report-only mode. In this case, violations of policies will only be reported, not blocked. Use this while configuring policies. Reports are logged.'),
+      '#description' => $this->t('Use Content Security Policy in report-only mode. In this case, violations of policies will only be reported, not blocked. Use this while configuring policies. Reports are logged.'),
     );
     // CSP description
     $keywords = array(
@@ -102,8 +102,8 @@ class SecKitSettingsForm extends ConfigFormBase {
       '@spec' => 'specification page',
     );
 
-    $description = '<strong>' . t('Directives') . '</strong><br />';
-    $description .= t('Set up security policy for different types of content. Don\'t use www prefix. Keywords are: @keywords Wildcards (*) are allowed: @wildcards More information is available at <a href=":spec">@spec</a>.', $args);
+    $description = '<strong>' . $this->t('Directives') . '</strong><br />';
+    $description .= $this->t('Set up security policy for different types of content. Don\'t use www prefix. Keywords are: @keywords Wildcards (*) are allowed: @wildcards More information is available at <a href=":spec">@spec</a>.', $args);
     $form['seckit_xss']['csp']['description'] = array(
       '#markup' => $description,
     );
@@ -113,7 +113,7 @@ class SecKitSettingsForm extends ConfigFormBase {
       '#maxlength'=> 1024,
       '#default_value' => $config->get('seckit_xss.csp.default-src'),
       '#title' => 'default-src',
-      '#description' => t("Specify security policy for all types of content, which are not specified further (frame-ancestors excepted). Default is 'self'."),
+      '#description' => $this->t("Specify security policy for all types of content, which are not specified further (frame-ancestors excepted). Default is 'self'."),
     );
     // CSP script-src directive
     $form['seckit_xss']['csp']['script-src'] = array(
@@ -121,7 +121,7 @@ class SecKitSettingsForm extends ConfigFormBase {
       '#maxlength'=> 1024,
       '#default_value' => $config->get('seckit_xss.csp.script-src'),
       '#title' => 'script-src',
-      '#description' => t('Specify trustworthy sources for &lt;script&gt; elements.'),
+      '#description' => $this->t('Specify trustworthy sources for &lt;script&gt; elements.'),
     );
     // CSP object-src directive
     $form['seckit_xss']['csp']['object-src'] = array(
@@ -129,7 +129,7 @@ class SecKitSettingsForm extends ConfigFormBase {
       '#maxlength'=> 1024,
       '#default_value' => $config->get('seckit_xss.csp.object-src'),
       '#title' => 'object-src',
-      '#description' => t('Specify trustworthy sources for &lt;object&gt;, &lt;embed&gt; and &lt;applet&gt; elements.'),
+      '#description' => $this->t('Specify trustworthy sources for &lt;object&gt;, &lt;embed&gt; and &lt;applet&gt; elements.'),
     );
     // CSP style-src directive
     $form['seckit_xss']['csp']['style-src'] = array(
@@ -137,7 +137,7 @@ class SecKitSettingsForm extends ConfigFormBase {
       '#maxlength'=> 1024,
       '#default_value' => $config->get('seckit_xss.csp.style-src'),
       '#title' => 'style-src',
-      '#description' => t('Specify trustworthy sources for stylesheets. Note, that inline stylesheets and style attributes of HTML elements are allowed.'),
+      '#description' => $this->t('Specify trustworthy sources for stylesheets. Note, that inline stylesheets and style attributes of HTML elements are allowed.'),
     );
     // CSP img-src directive
     $form['seckit_xss']['csp']['img-src'] = array(
@@ -145,7 +145,7 @@ class SecKitSettingsForm extends ConfigFormBase {
       '#maxlength'=> 1024,
       '#default_value' => $config->get('seckit_xss.csp.img-src'),
       '#title' => 'img-src',
-      '#description' => t('Specify trustworthy sources for &lt;img&gt; elements.'),
+      '#description' => $this->t('Specify trustworthy sources for &lt;img&gt; elements.'),
     );
     // CSP media-src directive
     $form['seckit_xss']['csp']['media-src'] = array(
@@ -153,7 +153,7 @@ class SecKitSettingsForm extends ConfigFormBase {
       '#maxlength'=> 1024,
       '#default_value' => $config->get('seckit_xss.csp.media-src'),
       '#title' => 'media-src',
-      '#description' => t('Specify trustworthy sources for &lt;audio&gt; and &lt;video&gt; elements.'),
+      '#description' => $this->t('Specify trustworthy sources for &lt;audio&gt; and &lt;video&gt; elements.'),
     );
     // CSP frame-src directive
     $form['seckit_xss']['csp']['frame-src'] = array(
@@ -161,7 +161,7 @@ class SecKitSettingsForm extends ConfigFormBase {
       '#maxlength'=> 1024,
       '#default_value' => $config->get('seckit_xss.csp.frame-src'),
       '#title' => 'frame-src',
-      '#description' => t('Specify trustworthy sources for &lt;iframe&gt; and &lt;frame&gt; elements. This directive is deprecated and will be replaced by child-src. It is recommended to use the both the frame-src and child-src directives until all browsers you support recognize the child-src directive.'),
+      '#description' => $this->t('Specify trustworthy sources for &lt;iframe&gt; and &lt;frame&gt; elements. This directive is deprecated and will be replaced by child-src. It is recommended to use the both the frame-src and child-src directives until all browsers you support recognize the child-src directive.'),
     );
     // CSP child-src directive
     $form['seckit_xss']['csp']['child-src'] = array(
@@ -169,7 +169,7 @@ class SecKitSettingsForm extends ConfigFormBase {
       '#maxlength'=> 1024,
       '#default_value' => $config->get('seckit_xss.csp.child-src'),
       '#title' => 'child-src',
-      '#description' => t('Specify trustworthy sources for &lt;iframe&gt; and &lt;frame&gt; elements as well as for loading Workers.'),
+      '#description' => $this->t('Specify trustworthy sources for &lt;iframe&gt; and &lt;frame&gt; elements as well as for loading Workers.'),
     );
     // CSP font-src directive
     $form['seckit_xss']['csp']['font-src'] = array(
@@ -177,7 +177,7 @@ class SecKitSettingsForm extends ConfigFormBase {
       '#maxlength'=> 1024,
       '#default_value' => $config->get('seckit_xss.csp.font-src'),
       '#title' => 'font-src',
-      '#description' => t('Specify trustworthy sources for @font-src CSS loads.'),
+      '#description' => $this->t('Specify trustworthy sources for @font-src CSS loads.'),
     );
     // CSP connect-src directive
     $form['seckit_xss']['csp']['connect-src'] = array(
@@ -185,7 +185,7 @@ class SecKitSettingsForm extends ConfigFormBase {
       '#maxlength'=> 1024,
       '#default_value' => $config->get('seckit_xss.csp.connect-src'),
       '#title' => 'connect-src',
-      '#description' => t('Specify trustworthy sources for XMLHttpRequest, WebSocket and EventSource connections.'),
+      '#description' => $this->t('Specify trustworthy sources for XMLHttpRequest, WebSocket and EventSource connections.'),
     );
 
     $report_default = !empty($config->get('seckit_xss.report-uri')) ? $config->get('seckit_xss.report-uri') : SECKIT_CSP_REPORT_URL;
@@ -195,7 +195,7 @@ class SecKitSettingsForm extends ConfigFormBase {
       '#maxlength' => 1024,
       '#default_value' => $report_default,
       '#title' => 'report-uri',
-      '#description' => t('Specify a URL (relative to the Drupal root) to which user-agents will report CSP violations. Use the default value, unless you have set up an alternative handler for these reports. Defaults to <code>' . SECKIT_CSP_REPORT_URL . '</code> which logs the report data.'),
+      '#description' => $this->t('Specify a URL (relative to the Drupal root) to which user-agents will report CSP violations. Use the default value, unless you have set up an alternative handler for these reports. Defaults to <code>' . SECKIT_CSP_REPORT_URL . '</code> which logs the report data.'),
     );
     // CSP policy-uri directive
     $form['seckit_xss']['csp']['policy-uri'] = array(
@@ -203,21 +203,38 @@ class SecKitSettingsForm extends ConfigFormBase {
       '#maxlength'=> 1024,
       '#default_value' => $config->get('seckit_xss.csp.policy-uri'),
       '#title' => 'policy-uri',
-      '#description' => t("Specify a URL (relative to the Drupal root) for a file containing the (entire) policy. <strong>All other directives will be omitted</strong> by Security Kit, as <code>policy-uri</code> may only be defined in the <em>absence</em> of other policy definitions in the <code>X-Content-Security-Policy</code> HTTP header. The MIME type for this URI <strong>must</strong> be <code>text/x-content-security-policy</code>, otherwise user-agents will enforce the policy <code>allow 'none'</code>  instead."),
+      '#description' => $this->t("Specify a URL (relative to the Drupal root) for a file containing the (entire) policy. <strong>All other directives will be omitted</strong> by Security Kit, as <code>policy-uri</code> may only be defined in the <em>absence</em> of other policy definitions in the <code>X-Content-Security-Policy</code> HTTP header. The MIME type for this URI <strong>must</strong> be <code>text/x-content-security-policy</code>, otherwise user-agents will enforce the policy <code>allow 'none'</code>  instead."),
+    );
+
+    $args = array(
+      ':adv' => '#edit-seckit-advanced',
+      '@adv' => 'Advanced_options',
+    );
+
+    $title = "<strong>" . $this->t('CSP violation reporting limits are currently disabled. See <a href=":adv">@adv</a> below.', $args) . '</strong><br />';
+    $description = $this->t("Reporting limits should be enabled once your CSP is production-ready, to prevent excessive report logging should the violation report URL be flooded.");
+    $form['seckit_xss']['csp']['csp_limits'] = array(
+      '#type' => 'markup',
+      '#markup' => $title . $description,
+      '#states' => array(
+        'visible' => array(
+          ':input[name="seckit_advanced[unlimited_csp_reports]"]' => array('checked' => TRUE),
+        ),
+      ),
     );
 
     // fieldset for X-XSS-Protection
     $form['seckit_xss']['x_xss'] = array(
       '#type' => 'details',
-      '#title' => t('X-XSS-Protection header'),
+      '#title' => $this->t('X-XSS-Protection header'),
       '#collapsible' => TRUE,
       '#tree' => TRUE,
       '#open' => $config->get('seckit_xss.x_xss.select')  != SECKIT_X_XSS_DISABLE,
-      '#description' => t('X-XSS-Protection HTTP response header controls Microsoft Internet Explorer, Google Chrome and Apple Safari internal XSS filters.'),
+      '#description' => $this->t('X-XSS-Protection HTTP response header controls Microsoft Internet Explorer, Google Chrome and Apple Safari internal XSS filters.'),
     );
     // options for X-XSS-Protection
     $x_xss_protection_options = array(
-      SECKIT_X_XSS_DISABLE => $config->get('seckit_xss.x_xss.seckit_x_xss_option_disable', t('Disabled')),
+      SECKIT_X_XSS_DISABLE => $config->get('seckit_xss.x_xss.seckit_x_xss_option_disable', $this->t('Disabled')),
       SECKIT_X_XSS_0 => $config->get('seckit_xss.x_xss.seckit_x_xss_option_0', '0'),
       SECKIT_X_XSS_1 => $config->get('seckit_xss.x_xss.seckit_x_xss_option_1', '1;'),
       SECKIT_X_XSS_1_BLOCK => $config->get('seckit_xss.x_xss.seckit_x_xss_option_1_block', '1; mode=block'),
@@ -228,10 +245,10 @@ class SecKitSettingsForm extends ConfigFormBase {
       '@link' => 'IE\'s XSS filter security flaws in past',
     );
     $items = array(
-      array('#markup' => t('Disabled - XSS filter will work in default mode. Enabled by default')),
-      array('#markup' => t('0 - XSS filter will be disabled for a website. It may be useful because of <a href=":link">@link</a>', $args)),
-      array('#markup' => t('1 - XSS filter will be left enabled, and will modify dangerous content')),
-      array('#markup' => t('1; mode=block - XSS filter will be left enabled, but it will block entire page instead of modifying dangerous content'))
+      array('#markup' => $this->t('Disabled - XSS filter will work in default mode. Enabled by default')),
+      array('#markup' => $this->t('0 - XSS filter will be disabled for a website. It may be useful because of <a href=":link">@link</a>', $args)),
+      array('#markup' => $this->t('1 - XSS filter will be left enabled, and will modify dangerous content')),
+      array('#markup' => $this->t('1; mode=block - XSS filter will be left enabled, but it will block entire page instead of modifying dangerous content'))
     );
 
     $args = array(
@@ -240,10 +257,10 @@ class SecKitSettingsForm extends ConfigFormBase {
 
     $form['seckit_xss']['x_xss']['select'] = array(
       '#type' => 'select',
-      '#title' => t('Configure'),
+      '#title' => $this->t('Configure'),
       '#options' => $x_xss_protection_options,
       '#default_value' => $config->get('seckit_xss.x_xss.select'),
-      '#description' => t('@values', $args),
+      '#description' => $this->t('@values', $args),
     );
 
     // fieldset for X-Content-Type-Options
@@ -256,69 +273,69 @@ class SecKitSettingsForm extends ConfigFormBase {
     // disabled, as it is recommended to always be enabled.
     $form['seckit_xss']['x_content_type'] = array(
       '#type' => 'details',
-      '#title' => t('X-Content-Type-Options header'),
+      '#title' => $this->t('X-Content-Type-Options header'),
       '#collapsible' => FALSE,
       '#open' => TRUE,
       '#tree' => TRUE,
-      '#description' => t('X-Content-Type-Options HTTP response header prevents browser from upsniffing content and serving files with inappropriate MIME type. More information is available at <a href=":link">@link</a>.', $args),
+      '#description' => $this->t('X-Content-Type-Options HTTP response header prevents browser from upsniffing content and serving files with inappropriate MIME type. More information is available at <a href=":link">@link</a>.', $args),
     );
     // enable/disable X-Content-Type-Options
     $form['seckit_xss']['x_content_type']['checkbox'] = array(
       '#type' => 'checkbox',
-      '#title' => t('Send HTTP response header'),
+      '#title' => $this->t('Send HTTP response header'),
       '#default_value' => $config->get('seckit_xss.x_content_type.checkbox'),
-      '#description' => t('Enable X-Content-Type-Options: nosniff HTTP response header.  It is HIGHLY recommended that this value always be be set to "ON" to mitigate security risks, please read the link above.'),
+      '#description' => $this->t('Enable X-Content-Type-Options: nosniff HTTP response header.  It is HIGHLY recommended that this value always be be set to "ON" to mitigate security risks, please read the link above.'),
     );
 
     // main fieldset for CSRF
     $form['seckit_csrf'] = array(
       '#type' => 'details',
-      '#title' => t('Cross-site Request Forgery'),
+      '#title' => $this->t('Cross-site Request Forgery'),
       '#tree' => TRUE,
       '#open' => !empty($config->get('seckit_csrf.origin')),
       '#collapsible' => TRUE,
-      '#description' => t('Configure levels and various techniques of protection from cross-site request forgery attacks'),
+      '#description' => $this->t('Configure levels and various techniques of protection from cross-site request forgery attacks'),
     );
 
     // enable/disable Origin
     $form['seckit_csrf']['origin'] = array(
       '#type' => 'checkbox',
-      '#title' => t('HTTP Origin'),
+      '#title' => $this->t('HTTP Origin'),
       '#default_value' => $config->get('seckit_csrf.origin'),
-      '#description' => t('Check Origin HTTP request header.'),
+      '#description' => $this->t('Check Origin HTTP request header.'),
     );
     // Origin whitelist
     $form['seckit_csrf']['origin_whitelist'] = array(
       '#type' => 'textfield',
-      '#title' => t('Allow requests from'),
+      '#title' => $this->t('Allow requests from'),
       '#default_value' => $config->get('seckit_csrf.origin_whitelist'),
       '#size' => 90,
       '#maxlength' => 255,
-      '#description' => t('Comma separated list of trustworthy sources. Do not enter your website URL - it is automatically added. Syntax of the source is: [protocol] :// [host] : [port] . E.g, http://example.com, https://example.com, https://www.example.com, http://www.example.com:8080'),
+      '#description' => $this->t('Comma separated list of trustworthy sources. Do not enter your website URL - it is automatically added. Syntax of the source is: [protocol] :// [host] : [port] . E.g, http://example.com, https://example.com, https://www.example.com, http://www.example.com:8080'),
     );
 
     // main fieldset for Clickjacking
     $form['seckit_clickjacking'] = array(
       '#type' => 'details',
-      '#title' => t('Clickjacking'),
+      '#title' => $this->t('Clickjacking'),
       '#collapsible' => TRUE,
       '#tree' => FALSE,
       '#open' => TRUE,
-      '#description' => t('Configure levels and various techniques of protection from Clickjacking/UI Redressing attacks'),
+      '#description' => $this->t('Configure levels and various techniques of protection from Clickjacking/UI Redressing attacks'),
     );
 
     $form['seckit_clickjacking']['x_frame_options'] = array(
       '#type' => 'details',
-      '#title' => t('X-Frame-Options header'),
+      '#title' => $this->t('X-Frame-Options header'),
       '#collapsible' => TRUE,
       '#collapsed' => ($config->get('seckit_clickjacking.x_frame') != SECKIT_X_FRAME_DISABLE),
       '#tree' => FALSE,
-      '#description' => t('Configure the X-Frame-Options HTTP header'),
+      '#description' => $this->t('Configure the X-Frame-Options HTTP header'),
     );
 
     // options for X-Frame-Options
     $x_frame_options = array(
-      SECKIT_X_FRAME_DISABLE => t('Disabled'),
+      SECKIT_X_FRAME_DISABLE => $this->t('Disabled'),
       SECKIT_X_FRAME_SAMEORIGIN => 'SameOrigin',
       SECKIT_X_FRAME_DENY => 'Deny',
       SECKIT_X_FRAME_ALLOW_FROM => 'Allow-From',
@@ -334,10 +351,10 @@ class SecKitSettingsForm extends ConfigFormBase {
     );
     $form['seckit_clickjacking']['x_frame_options']['x_frame'] = array(
       '#type' => 'select',
-      '#title' => t('X-Frame-Options'),
+      '#title' => $this->t('X-Frame-Options'),
       '#options' => $x_frame_options,
       '#default_value' => $config->get('seckit_clickjacking.x_frame'),
-      '#description' => t('X-Frame-Options HTTP response header controls browser\'s policy of frame rendering. Possible values: @values You may read more about it at <a href=":msdn">@msdn</a> or <a href=":spec">@spec</a>.', $args),
+      '#description' => $this->t('X-Frame-Options HTTP response header controls browser\'s policy of frame rendering. Possible values: @values You may read more about it at <a href=":msdn">@msdn</a> or <a href=":spec">@spec</a>.', $args),
       // Non-tree (we skip a parent).
       '#parents' => array(
         'seckit_clickjacking',
@@ -348,9 +365,9 @@ class SecKitSettingsForm extends ConfigFormBase {
     // Origin value for "Allow-From" option.
     $form['seckit_clickjacking']['x_frame_options']['x_frame_allow_from'] = array(
       '#type' => 'textarea',
-      '#title' => t('Allow-From'),
+      '#title' => $this->t('Allow-From'),
       '#default_value' => $config->get('seckit_clickjacking.x_frame_allow_from'),
-      '#description' => t('Origin URIs (as specified by RFC 6454) for the "X-Frame-Options: Allow-From" value. One per line. Example, http://domain.com'),
+      '#description' => $this->t('Origin URIs (as specified by RFC 6454) for the "X-Frame-Options: Allow-From" value. One per line. Example, http://domain.com'),
       '#states' => array(
         'required' => array(
           'select[name="seckit_clickjacking[x_frame]"]' => array('value' => SECKIT_X_FRAME_ALLOW_FROM),
@@ -370,29 +387,29 @@ class SecKitSettingsForm extends ConfigFormBase {
     // fieldset for JavaScript settings. non-#tree.
     $form['seckit_clickjacking']['javascript'] = array(
       '#type' => 'details',
-      '#title' => t('JavaScript-based protection'),
+      '#title' => $this->t('JavaScript-based protection'),
       '#collapsible' => TRUE,
       '#collapsed' => !empty($config->get('seckit_clickjacking.js_css_noscript')),
       '#tree' => FALSE,
-      '#description' => t('Warning: With this enabled, the site <em>will not work at all</em> for users who have JavaScript disabled (e.g. users running the popular <a href=":noscript">@noscript</a> browser extension, if they haven\'t whitelisted your site).', $args),
+      '#description' => $this->t('Warning: With this enabled, the site <em>will not work at all</em> for users who have JavaScript disabled (e.g. users running the popular <a href=":noscript">@noscript</a> browser extension, if they haven\'t whitelisted your site).', $args),
     );
 
     // enable/disable JS + CSS + Noscript protection
     $args = array(
       ':eduardovela' => 'http://sirdarckcat.blogspot.com/',
       '@eduardovela' => 'Eduardo Vela',
-      '%js' => t('seckit.document_write.js'),
-      '%write' => t('document.write()'),
-      '%stop' => t('stop SecKit protection'),
-      '%css' => t('seckit.no_body.css'),
-      '%display' => t('display: none'),
+      '%js' => $this->t('seckit.document_write.js'),
+      '%write' => $this->t('document.write()'),
+      '%stop' => $this->t('stop SecKit protection'),
+      '%css' => $this->t('seckit.no_body.css'),
+      '%display' => $this->t('display: none'),
     );
     $form['seckit_clickjacking']['javascript']['js_css_noscript'] = array(
       '#type' => 'checkbox',
-      '#title' => t('Enable JavaScript + CSS + Noscript protection'),
+      '#title' => $this->t('Enable JavaScript + CSS + Noscript protection'),
       '#return_value' => 1,
       '#default_value' => $config->get('seckit_clickjacking.js_css_noscript'),
-      '#description' => t('Enable protection via JavaScript, CSS and &lt;noscript&gt; tag. This is the most efficient Clickjacking prevention technique. If website is not being framed, %js starts commenting with <em>document.write()</em> and stops when the comment %stop is reached. Thus %css, which hides the page body, is ignored. If particularly this JavaScript file is being blocked (with XSS filter of Internet Explorer 8 or Safari), %css applies <em>display: none</em> to <em>body</em>, hiding it. If JavaScript is disabled within browser, it shows a special message. Credits for this trick go to <a href=":eduardovela">@eduardovela</a>.', $args),
+      '#description' => $this->t('Enable protection via JavaScript, CSS and &lt;noscript&gt; tag. This is the most efficient Clickjacking prevention technique. If website is not being framed, %js starts commenting with <em>document.write()</em> and stops when the comment %stop is reached. Thus %css, which hides the page body, is ignored. If particularly this JavaScript file is being blocked (with XSS filter of Internet Explorer 8 or Safari), %css applies <em>display: none</em> to <em>body</em>, hiding it. If JavaScript is disabled within browser, it shows a special message. Credits for this trick go to <a href=":eduardovela">@eduardovela</a>.', $args),
       '#parents' => array(
         'seckit_clickjacking',
         'js_css_noscript',
@@ -402,9 +419,9 @@ class SecKitSettingsForm extends ConfigFormBase {
     // custom text for "disabled JavaScript" message
     $form['seckit_clickjacking']['javascript']['noscript_message'] = array(
       '#type' => 'textfield',
-      '#title' => t('Custom text for disabled JavaScript message'),
+      '#title' => $this->t('Custom text for disabled JavaScript message'),
       '#default_value' => $config->get('seckit_clickjacking.noscript_message'),
-      '#description' => t('This message will be shown to user when JavaScript is disabled or unsupported in his browser. Default is "Sorry, you need to enable JavaScript to visit this website."'),
+      '#description' => $this->t('This message will be shown to user when JavaScript is disabled or unsupported in his browser. Default is "Sorry, you need to enable JavaScript to visit this website."'),
       '#states' => array(
         'required' => array(
           'input[name="seckit_clickjacking[js_css_noscript]"]' => array('checked' => TRUE),
@@ -419,11 +436,11 @@ class SecKitSettingsForm extends ConfigFormBase {
     // main fieldset for SSL/TLS
     $form['seckit_ssl'] = array(
       '#type' => 'details',
-      '#title' => t('SSL/TLS'),
+      '#title' => $this->t('SSL/TLS'),
       '#collapsible' => TRUE,
       '#tree' => TRUE,
       '#open' => !empty($config->get('seckit_ssl.hsts')),
-      '#description' => t('Configure various techniques to improve security of SSL/TLS'),
+      '#description' => $this->t('Configure various techniques to improve security of SSL/TLS'),
     );
 
     // enable/disable HTTP Strict Transport Security (HSTS)
@@ -434,15 +451,15 @@ class SecKitSettingsForm extends ConfigFormBase {
 
     $form['seckit_ssl']['hsts'] = array(
       '#type' => 'checkbox',
-      '#title' => t('HTTP Strict Transport Security'),
-      '#description' => t('Enable Strict-Transport-Security HTTP response header. HTTP Strict Transport Security (HSTS) header is proposed to prevent eavesdropping and man-in-the-middle attacks like SSLStrip, when a single non-HTTPS request is enough for credential theft or hijacking. It forces browser to connect to the server in HTTPS-mode only and automatically convert HTTP links into secure before sending request. <a href=":wiki">@wiki</a> has more information about HSTS', $args),
+      '#title' => $this->t('HTTP Strict Transport Security'),
+      '#description' => $this->t('Enable Strict-Transport-Security HTTP response header. HTTP Strict Transport Security (HSTS) header is proposed to prevent eavesdropping and man-in-the-middle attacks like SSLStrip, when a single non-HTTPS request is enough for credential theft or hijacking. It forces browser to connect to the server in HTTPS-mode only and automatically convert HTTP links into secure before sending request. <a href=":wiki">@wiki</a> has more information about HSTS', $args),
       '#default_value' => $config->get('seckit_ssl.hsts'),
     );
     // HSTS max-age directive
     $form['seckit_ssl']['hsts_max_age'] = array(
       '#type' => 'textfield',
-      '#title' => t('Max-Age'),
-      '#description' => t('Specify Max-Age value in seconds. It sets period when user-agent should remember receipt of this header field from this server. Default is 1000.'),
+      '#title' => $this->t('Max-Age'),
+      '#description' => $this->t('Specify Max-Age value in seconds. It sets period when user-agent should remember receipt of this header field from this server. Default is 1000.'),
       '#default_value' => $config->get('seckit_ssl.hsts_max_age'),
       '#states' => array(
         'required' => array(
@@ -453,8 +470,8 @@ class SecKitSettingsForm extends ConfigFormBase {
     // HSTS includeSubDomains directive
     $form['seckit_ssl']['hsts_subdomains'] = array(
       '#type' => 'checkbox',
-      '#title' => t('Include Subdomains'),
-      '#description' => t('Force HTTP Strict Transport Security for all subdomains. If enabled, HSTS policy will be applied for all subdomains, otherwise only for the main domain.'),
+      '#title' => $this->t('Include Subdomains'),
+      '#description' => $this->t('Force HTTP Strict Transport Security for all subdomains. If enabled, HSTS policy will be applied for all subdomains, otherwise only for the main domain.'),
       '#default_value' => $config->get('seckit_ssl.hsts_subdomains'),
     );
 
@@ -465,8 +482,8 @@ class SecKitSettingsForm extends ConfigFormBase {
     );
     $form['seckit_ssl']['hsts_preload'] = array(
       '#type' => 'checkbox',
-      '#title' => t('Preload'),
-      '#description' => t('If you intend to submit your domain to the <a href=":hsts_preload_list">@hsts_preload_list</a>, you will need to enable the preload flag as confirmation. Don\'t submit your domain unless you\'re sure that you can support HTTPS for the long term, as this action cannot be undone.', $args),
+      '#title' => $this->t('Preload'),
+      '#description' => $this->t('If you intend to submit your domain to the <a href=":hsts_preload_list">@hsts_preload_list</a>, you will need to enable the preload flag as confirmation. Don\'t submit your domain unless you\'re sure that you can support HTTPS for the long term, as this action cannot be undone.', $args),
       '#return_value' => 1,
       '#default_value' => $config->get('seckit_ssl.hsts_preload'),
     );
@@ -474,11 +491,11 @@ class SecKitSettingsForm extends ConfigFormBase {
     // main fieldset for various
     $form['seckit_various'] = array(
       '#type' => 'details',
-      '#title' => t('Miscellaneous'),
+      '#title' => $this->t('Miscellaneous'),
       '#collapsible' => TRUE,
       '#tree' => TRUE,
       '#open' => !empty($config->get('seckit_various.from_origin')),
-      '#description' => t('Configure miscellaneous unsorted security enhancements'),
+      '#description' => $this->t('Configure miscellaneous unsorted security enhancements'),
     );
 
     // enable/disable From-Origin
@@ -489,9 +506,9 @@ class SecKitSettingsForm extends ConfigFormBase {
 
     $form['seckit_various']['from_origin'] = array(
       '#type' => 'checkbox',
-      '#title' => t('From-Origin'),
+      '#title' => $this->t('From-Origin'),
       '#default_value' => $config->get('seckit_various.from_origin'),
-      '#description' => t('Enable From-Origin HTTP response header. This forces user-agent to retrieve embedded content from your site only to listed destination. More information is available at <a href=":spec">@spec</a> page.', $args),
+      '#description' => $this->t('Enable From-Origin HTTP response header. This forces user-agent to retrieve embedded content from your site only to listed destination. More information is available at <a href=":spec">@spec</a> page.', $args),
     );
     // From-Origin destination
     $items = array(
@@ -504,10 +521,10 @@ class SecKitSettingsForm extends ConfigFormBase {
 
     $form['seckit_various']['from_origin_destination'] = array(
       '#type' => 'textfield',
-      '#title' => t('Allow loading content to'),
+      '#title' => $this->t('Allow loading content to'),
       '#default_value' => $config->get('seckit_various.from_origin_destination'),
       '#size' => 90,
-      '#description' => t('Trustworthy destination. Possible variants are: @items', $args),
+      '#description' => $this->t('Trustworthy destination. Possible variants are: @items', $args),
       '#states' => array(
         'required' => array(
           'input[name="seckit_various[from_origin]"]' => array('checked' => TRUE),
@@ -517,9 +534,97 @@ class SecKitSettingsForm extends ConfigFormBase {
     // Disable autocomplete on login and registration forms.
     $form['seckit_various']['disable_autocomplete'] = array(
       '#type' => 'checkbox',
-      '#title' => t('Disable autocomplete on login and registration forms'),
+      '#title' => $this->t('Disable autocomplete on login and registration forms'),
       '#default_value' => $config->get('seckit_various.disable_autocomplete'),
-      '#description' => t('Prevent the browser from populating login/registration form fields using its autocomplete functionality. This as populated fields may contain sensitive information, facilitating unauthorized access.'),
+      '#description' => $this->t('Prevent the browser from populating login/registration form fields using its autocomplete functionality. This as populated fields may contain sensitive information, facilitating unauthorized access.'),
+    );
+
+    // Advanced / developer options.
+    $form['seckit_advanced'] = array(
+      '#type' => 'details',
+      '#title' => $this->t('Advanced options'),
+      '#collapsible' => TRUE,
+      '#open' => TRUE,
+      '#tree' => TRUE,
+    );
+
+    $form['seckit_advanced']['disable_seckit'] = array(
+      '#type' => 'checkbox',
+      '#default_value' => $config->get('seckit_advanced.disable_seckit'),
+      '#title' => $this->t('Disable Security Kit'),
+      '#description' => $this->t('Prevent the module from doing anything.'),
+    );
+
+    $request = \Drupal::request();
+    if ($config->get('seckit_advanced.disable_seckit') && empty($request->getContent())) {
+      drupal_set_message(t("Security Kit is currently disabled in the Advanced options (below)."), 'warning');
+    }
+
+    // CSP report limits
+    $form['seckit_advanced']['unlimited_csp_reports'] = array(
+      '#type' => 'checkbox',
+      '#default_value' => $config->get('seckit_advanced.unlimited_csp_reports'),
+      '#title' => $this->t('Unlimited CSP reports'),
+      '#description' => $this->t('Ignore restrictions on the size and quantity of CSP violation reports. This should be disabled once the CSP is production-ready.'),
+    );
+
+    $form['seckit_advanced']['csp_limits'] = array(
+      '#type' => 'details',
+      '#title' => $this->t('CSP violation reporting limits'),
+      '#description' => $this->t("Reports breaching these limits will not be logged."),
+      '#collapsible' => TRUE,
+      '#open' => TRUE,
+      '#states' => array(
+        'visible' => array(
+          ':input[name="seckit_advanced[unlimited_csp_reports]"]' => array('checked' => FALSE),
+        ),
+      ),
+    );
+
+    $form['seckit_advanced']['csp_limits']['max_size'] = array(
+      '#title' => $this->t('Maximum report size (bytes)'),
+      '#type' => 'textfield',
+      '#maxlength'=> 16,
+      '#default_value' => $config->get('seckit_advanced.csp_limits.max_size'),
+    );
+
+    $form['seckit_advanced']['csp_limits']['flood'] = array(
+      '#type' => 'details',
+      '#title' => $this->t('Flood settings'),
+      '#collapsible' => TRUE,
+      '#open' => TRUE,
+    );
+
+    $form['seckit_advanced']['csp_limits']['flood']['limit_user'] = array(
+      '#title' => $this->t('Maximum reports per IP address'),
+      '#description' => $this->t('Applicable within the given time window'),
+      '#type' => 'textfield',
+      '#maxlength'=> 16,
+      '#default_value' => $config->get('seckit_advanced.csp_limits.flood.limit_user'),
+    );
+
+    $form['seckit_advanced']['csp_limits']['flood']['window_user'] = array(
+      '#title' => $this->t('Time window for per IP address flood detection'),
+      '#description' => $this->t('Duration in seconds'),
+      '#type' => 'textfield',
+      '#maxlength'=> 16,
+      '#default_value' => $config->get('seckit_advanced.csp_limits.flood.window_user'),
+    );
+
+    $form['seckit_advanced']['csp_limits']['flood']['limit_global'] = array(
+      '#title' => $this->t('Maximum reports globally (i.e. irrespective of IP address)'),
+      '#description' => $this->t('Applicable within the given time window'),
+      '#type' => 'textfield',
+      '#maxlength'=> 16,
+      '#default_value' => $config->get('seckit_advanced.csp_limits.flood.limit_global'),
+    );
+
+    $form['seckit_advanced']['csp_limits']['flood']['window_global'] = array(
+      '#title' => $this->t('Time window for global flood detection'),
+      '#description' => $this->t('Duration in seconds'),
+      '#type' => 'textfield',
+      '#maxlength'=> 16,
+      '#default_value' => $config->get('seckit_advanced.csp_limits.flood.window_global'),
     );
 
     return parent::buildForm($form, $form_state);
@@ -533,14 +638,14 @@ class SecKitSettingsForm extends ConfigFormBase {
     $from_origin_enable = $form_state->getValue(array('seckit_various', 'from_origin'));
     $from_origin_destination = $form_state->getValue(array('seckit_various', 'from_origin_destination'));
     if ($from_origin_enable && !$from_origin_destination) {
-      $form_state->setErrorByName('seckit_various][from_origin_destination', t('You have to set up trustworthy destination for From-Origin HTTP response header. Default is same.'));
+      $form_state->setErrorByName('seckit_various][from_origin_destination', $this->t('You have to set up trustworthy destination for From-Origin HTTP response header. Default is same.'));
     }
     // if X-Frame-Options is set to Allow-From, it should be explicitly set
     $x_frame_value = $form_state->getValue(array('seckit_clickjacking', 'x_frame'));
     if ($x_frame_value == SECKIT_X_FRAME_ALLOW_FROM) {
       $x_frame_allow_from = $form_state->getValue(array('seckit_clickjacking', 'x_frame_allow_from'));
       if (!$this->_seckit_explode_value($x_frame_allow_from)) {
-        $form_state->setErrorByName('seckit_clickjacking][x_frame_allow_from', t('You must specify a trusted Origin for the Allow-From value of the X-Frame-Options HTTP response header.'));
+        $form_state->setErrorByName('seckit_clickjacking][x_frame_allow_from', $this->t('You must specify a trusted Origin for the Allow-From value of the X-Frame-Options HTTP response header.'));
       }
     }
     // if HTTP Strict Transport Security is enabled, max-age must be specified.
@@ -548,17 +653,17 @@ class SecKitSettingsForm extends ConfigFormBase {
     $hsts = $form_state->getValue(array('seckit_ssl', 'hsts'));
     $hsts_max_age = $form_state->getValue(array('seckit_ssl', 'hsts_max_age'));
     if ($hsts && !$hsts_max_age) {
-      $form_state->setErrorByName('seckit_ssl][hsts_max_age', t('You have to set up Max-Age value for HTTP Strict Transport Security. Default is 1000.'));
+      $form_state->setErrorByName('seckit_ssl][hsts_max_age', $this->t('You have to set up Max-Age value for HTTP Strict Transport Security. Default is 1000.'));
     }
     if (preg_match('/[^0-9]/', $hsts_max_age)) {
-      $form_state->setErrorByName('seckit_ssl][hsts_max_age', t('Only digits are allowed in HTTP Strict Transport Security Max-Age field.'));
+      $form_state->setErrorByName('seckit_ssl][hsts_max_age', $this->t('Only digits are allowed in HTTP Strict Transport Security Max-Age field.'));
     }
     // if JS + CSS + Noscript Clickjacking protection is enabled,
     // custom text for disabled JS must be specified
     $js_css_noscript_enable = $form_state->getValue(array('seckit_clickjacking', 'js_css_noscript'));
     $noscript_message = $form_state->getValue(array('seckit_clickjacking', 'noscript_message'));
     if ($js_css_noscript_enable && !$noscript_message) {
-      $form_state->setErrorByName('seckit_clickjacking][noscript_message', t('You have to set up Custom text for disabled JavaScript message when JS + CSS + Noscript protection is enabled.'));
+      $form_state->setErrorByName('seckit_clickjacking][noscript_message', $this->t('You have to set up Custom text for disabled JavaScript message when JS + CSS + Noscript protection is enabled.'));
     }
   }
 
@@ -580,11 +685,11 @@ class SecKitSettingsForm extends ConfigFormBase {
     $x_content_type_options_enable = $form_state->getValue('seckit_xss', 'x_content_type', 'checkbox');
     $file_system = file_default_scheme();
     if ($from_origin_enable && ($file_system == 'public')) {
-      $msg = t('From-Origin HTTP response header will not be served for files because of public file system. It is recommended to enable private file system to ensure provided by From-Origin security.');
+      $msg = $this->t('From-Origin HTTP response header will not be served for files because of public file system. It is recommended to enable private file system to ensure provided by From-Origin security.');
       drupal_set_message($msg, 'warning');
     }
     if ($x_content_type_options_enable && ($file_system == 'public')) {
-      $msg = t('X-Content-Type-Options HTTP response header will not be served for files because of public file system. It is recommended to enable private file system to ensure provided by X-Content-Type-Options security.');
+      $msg = $this->t('X-Content-Type-Options HTTP response header will not be served for files because of public file system. It is recommended to enable private file system to ensure provided by X-Content-Type-Options security.');
       drupal_set_message($msg, 'warning');
     }