Install

Works with Drupal: ^9.2 || ^10 || ^11

Using Composer to manage Drupal site dependencies

Alternative installation files

Download tar.gz 53.3 KB
MD5: 765de256717ff6cc13f3f13e0dea4b86
SHA-1: 5d9358e72f33979546271ab37e747fd515deaae5
SHA-256: a0a25cf3dfe2b74d67d82c553ebc04e84f0aa865b404322ece1a926598f33561
Download zip 78.86 KB
MD5: 3aa4eeab9abd2979f2fc7f66efdf7d1e
SHA-1: 2a3efbc456c6282c54e4148217cc0a12409ff44c
SHA-256: 4c8f87672067a9b3968aa92c465ca93646c6ebca65f7671efc5659ed800d79d0
Downloads are for manual installation, which is not recommended when using Drupal 8 or later.

Release notes

This is a substantial bugfix/feature update for the shield module.

This release fixes all existing known bugs and introduces some long wanted features. Please read the release notes carefully. If you're having issues with this release and just need the security release, download Shield 8.x-1.9

This is the last version of Shield to support Drupal 9.5 and PHP 8.1. 8.x-1.11 will require PHP 8.3 and 10.3+

Contributors (9)

FizCS3, Technorange, fathershawn, japerry, jeffreysmattson, kuldeepbarot, lkmorlan, richard.thomas, vbouchet

Changelog

Issues: 16 issues resolved.

Changes since 8.x-1.9 (compare):

Bug

  • fix: Issue #2954553: Shield silently disabled when credentials are overridden in settings.php.
  • fix: Issue #2902135: Read basic auth credentials from CGI server variables.
  • test: Issue #3491255: Cover that an excluded path cannot unshield the site.
  • #3407823: Credentials fields are missing/hidden
  • #3277210: Shield middleware invokes hooks before modules are loaded, corrupting module_implements cache
  • fix: Issue #183672: Rate limit failed Shield authentications.

Feature

  • task #3285819: Flag "administer shield" as a restricted permission.
  • feat: Issue #3266227: Add IP logging.
  • feat: Issue #3266227: Log successful Shield authentications.
  • Revert "feat: Issue #3266227: Log successful Shield authentications."
  • Revert "feat: Issue #3266227: Add IP logging."
  • feat: Issue #3285819: Allow bypassing shield based on the request user agent.
  • feat: Issue #3410025 by vbouchet, kuldeepbarot: Add an include mode to the domain list.
  • feat: Issue #3266227: Log successful Shield authentications.
  • feat: Issue #2923801: Let requests authenticated by basic_auth pass Shield.
  • feat: Issue #2931945 by Technorange: Support multiple username and password...

Misc

  • Load constants before authentication.
  • Set responses to uncacheable when the IP address allowlist is matched.
  • test: Cover the remaining Shield bypasses, credential providers and update hooks.
  • Set responses to uncacheable when the user agent allowlist is matched.
  • Only load the module files when a request actually carries basic auth credentials.
  • Store the Shield credential provider's usernames and passwords as encoded lists.
  • Match a configured path against the alias and the system path of the request.

Task

  • fix: #3617896 Fix issues raised by cspell
Created by: japerry
Created on: 21 Oct 2026 at 18:12 UTC
Last updated: 21 Oct 2026 at 18:12 UTC
Git tag 8.x-1.10
Bug fixes
New features

Other releases