Security in Drupal 8: Tips and Tricks
summary
Drupal 8 ships concrete security improvements: Twig auto-escaping and removal of the PHP input filter reduce template injection risk, and Composer enables third‑party libraries. Practical modules and numbers: session controls (Auto Logout, Session Limit), brute‑force protections (Login Security), spam defences (Honeypot/Captcha), auditing (Site Audit, Security Review, Login History), and authentication hardening with TFA + Google Authenticator plugin or federated SimpleSAMLphp. Data protection uses Encrypt + Key modules (AES/Defuse, Field/File Encrypt, Pubkey Encrypt for OwnCloud‑style keys). Ops guidance: log to syslog not dblog, use coder/hacked, test backups, and feed logs into Splunk/ELK.
AI-written summary · about
chapters (8)
- 0:00Intro
- 4:46Overview
- 8:59hardening techniques
- 13:41auditing
- 18:07authentication
- 23:28encryption
- 27:59DevOps
- 32:54Environment Solutions
related talks
42mSecurity in Drupal: what can go wrong?
39mSecurity, Drupal 9, and Navigating the Changing Web Landscape
52mPractical Security in Web Applications
01h 01mSecurity: From basic principles to PHP specifics
19mFrontend Security is a Thing
02h 18mWeb application security (Part 2)
41mWhat’s New in Drupal 8?
55mDip Your Toes in the Sea of Security