Install

Works with Drupal: ^10.3 || ^11 || ^12

Using Composer to manage Drupal site dependencies

Alternative installation files

Download tar.gz 45.15 KB
MD5: 70c0b9aca431410abfa84419e04553e7
SHA-1: 34ed14fa12a088e571ca3127ac905bdc469cfdb7
SHA-256: 349451703ea52715df3b30c0bd7835605735c3e4ddf112246d308db1392a4677
Download zip 61.81 KB
MD5: 4d90b83b130cfb634b609013c2b6364f
SHA-1: 644cc7a0991c6043907f19754daaf360df949b31
SHA-256: c2a1cc3dc679a7e196c835ee3f9db3a4b68d72cab1b3bb3423314414713fee3d

Release notes

Added

- Drupal 12 support, tested on 12.0.0-beta2 with PHP 8.5, as well as Drupal 11 and 10.3. The module's hooks are now in a class of their own, which Drupal 11.1 and later call directly; Drupal 10.3 and 11.0 still reach them through runlight.module.

Fixed

- Visits are counted on hosts that run ModSecurity with the OWASP Core Rule Set, as many cPanel and shared hosts do. The tracker sent each visit as text/plain, which the rule set refuses outright (rule 920420), so those sites recorded nothing while the page and the script loaded normally. The tracker now sends visits to its own site as application/json. Thanks to xmacinfo for tracking this down: https://www.xmacinfo.com/en/blog/runlight-zero-production-when-modsecuri...
- The settings form keeps its services in protected properties, so Drupal can save the form between requests, as it does for AJAX, without trying to store the services themselves.
- A request to /e with a method other than POST now gets a 405 with a message that a GET there usually means a firewall or proxy replaced the tracker's request with its own error page.
- The dashboard no longer scrolls sideways on a phone.

Full changelog: https://github.com/runlightsh/runlight/blob/v0.4.2/CHANGELOG.md

Created by: joncphillips
Created on: 10 Nov 2026 at 22:19 UTC
Last updated: 10 Nov 2026 at 22:19 UTC
Bug fixes
New features

Other releases