This project is not covered by Drupal’s security advisory policy.
The security baseline of a Mutamad site.
Accounts and login: password policies, account lockout, idle logout, no username enumeration, and a site administrator who assigns the editor role only.
The site: security headers and a Content Security Policy (Security Kit and Permissions-Policy), private uploads by default, no error output to visitors, anti-automation on login and public forms (ALTCHA, Honeypot, Antibot), flood unblocking and cheap 404s.
Aligned to NCA ECC-2:2024 2-2, 3-2 and 15-2.
Part of Mutamad
Part of Mutamad, the Drupal distribution for Saudi government websites. Mutamad Standard Site applies it on every Mutamad site.
Requirements
- Drupal 11.4
- Mutamad Roles
- altcha
- antibot
- autologout
- captcha
- fast_404
- flood_control
- honeypot
- login_security
- password_policy
- permissionspolicy
- role_delegation
- seckit
- username_enumeration_prevention
- a private file path
Installation
Set a private file path in settings.php first, outside the web root: $settings['file_private_path'] = '../private';
composer require drupal/mutamad_security drush recipe ../recipes/mutamad_security
Documentation
The README explains every setting and why, and the changelog what changed in each release.
Project information
- Project categories: Security, Site structure
- Ecosystem: Security Kit, Password Policy
- By ahmadhalah on , updated
This project is not covered by the security advisory policy.
Use at your own risk! It may have publicly disclosed vulnerabilities.
