Security Kit
Provides Drupal with various security-hardening options through HTTP headers to mitigate risks from Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), Clickjacking, and improve SSL/TLS security.
Tags
security
Antibot
Lightweight anti-spam module that prevents robotic form submissions by requiring JavaScript and human interaction.
Field Permissions
Set field-level permissions to control who can create, edit, or view specific fields on any entity type.
Honeypot
A spam prevention module that uses honeypot fields and time-based restrictions to deter automated form submissions without using CAPTCHAs.
Permissions by Term
Restricts access to nodes and taxonomy terms based on user accounts and/or user roles assigned to specific taxonomy terms.
Simple OAuth (OAuth2) & OpenID Connect
A comprehensive OAuth 2.0 Authorization Framework and OpenID Connect implementation for Drupal, built on the League OAuth2 Server library.
Masquerade
Allows privileged users to temporarily switch to another user account while maintaining a record of the original account for easy switching back.
Security Review
Security Review automates checking many configuration errors that lead to insecure Drupal sites and looks for existing vulnerabilities and attack attempts.
reCAPTCHA
Integrates Google reCAPTCHA service with Drupal's CAPTCHA module to protect forms from spam and abuse.
Two-factor Authentication (TFA)
Pluggable provider of second factor authentication for Drupal that enhances account security by requiring an additional verification step during login.
CAPTCHA
Provides CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) functionality to protect web forms from automated spam submissions.
Key
Key provides the ability to improve Drupal security by managing sensitive keys such as API and encryption keys, giving site administrators control over how and where keys are stored.
PHP Authentication Shield
Creates a simple HTTP basic authentication shield to protect Drupal sites from unauthorized access, treating the site as a "walled garden".
Password Policy
Enforces password security constraints and expiration policies through a flexible plugin-based architecture.
Content-Security-Policy
Provides Content-Security-Policy HTTP headers to protect against XSS and other code injection attacks by controlling which resources can be loaded by the browser.
Login Security
Enhances Drupal login form security by detecting brute-force attacks and implementing configurable blocking protections for users and IP addresses.
Configuration Read-only mode
Locks Drupal configuration to prevent changes in the admin UI while still allowing config imports via Drush.
Flood control
Provides an administration interface for Drupal's hidden flood control variables and enables site administrators to unblock IP addresses and user IDs that are blocked after multiple failed login attempts.
Custom Permissions
A lightweight module that allows site administrators to create custom permissions and map them to specific Drupal routes, enabling granular access control without the need for the broad 'Administer site configuration' permission.
Automatic IP ban (Autoban)
Automates IP address banning by analyzing watchdog log entries against configurable rules and integrating with IP ban providers.