drupal/varbase_security_base

A recipe to manage default security configurations including password policy, username enumeration prevention, security kit, CAPTCHA, honeypot, antibot, and flood control.

Maintainers

Details

git.drupalcode.org/project/varbase_security_base.git

Source

Issues

Installs: 74

Dependents: 1

Suggesters: 0

Security: 0

Type:drupal-recipe

pkg:composer/drupal/varbase_security_base

1.0.x-dev 2026-01-15 19:56 UTC

Requires

  • drupal/antibot: ~2
  • drupal/captcha: ~2
  • drupal/core: ~11.3.0
  • drupal/flood_control: ~3
  • drupal/honeypot: ~2
  • drupal/password_policy: ~4
  • drupal/recaptcha: ~3
  • drupal/seckit: ~2
  • drupal/username_enumeration_prevention: ~1

GPL-2.0-or-later a8091a19f585af36b5d6c57d5185f607cfc5b5d2

securitycaptchaHoneypotantibotrecipepassword policydrupal recipesdrupal recipeVarbase recipesvarbase recipe

This package is auto-updated.

Last update: 2026-01-15 17:07:13 UTC

README

A recipe to manage default security configurations for Varbase.

This recipe provides comprehensive security features including:

  • Password policy with character type requirements, length, and username checks
  • Username enumeration prevention
  • Security Kit (SecKit) for XSS, CSRF, and clickjacking protection
  • CAPTCHA and reCAPTCHA for form protection
  • Honeypot for spam prevention
  • Antibot for additional bot protection
  • Flood control to prevent brute force attacks

Installation

Add the recipe using composer:

composer require drupal/varbase_security_base:~1.0.0

Change directory to /web or /docroot

Run the Drupal recipe bash script:

bash core/scripts/drupal recipe recipes/contrib/varbase_security_base

or

Run the Drush recipe command:

drush recipe recipes/contrib/varbase_security_base

Security Features

Password Policy

The default password policy requires:

  • Minimum 8 characters
  • At least 1 uppercase letter
  • At least 1 lowercase letter
  • At least 1 number
  • At least 1 special character
  • Password different from username

Honeypot

Protected forms include:

  • User registration form
  • User login form
  • Password reset form
  • Webform submissions
  • Comment forms

Flood Control

  • IP-based login attempt limits: 5 attempts per 30 minutes
  • User-based login attempt limits: 4 attempts per 30 minutes

Security Kit

  • XSS protection enabled
  • Clickjacking protection via X-Frame-Options
  • Autocomplete disabled for sensitive forms