LogoLogo
10.0.x
10.0.x9.0.x
10.0.x
10.0.x9.0.x
  • Overview
    • About Varbase
    • Roadmap
    • Release Cycle and Supported Versions
    • How to Get Support
  • Developers
    • Getting Started
    • Installing Varbase
      • Requirements
      • Installing Varbase locally with DDEV
      • Installing Varbase locally with Lando
    • Understanding Varbase
      • Basic Concepts
      • Core Components
        • Varbase Core
          • Varbase Admin
          • Varbase Page
          • Varbase Security
          • Varbase Webform
          • Varbase Default Content
          • Varbase Tour
        • Varbase Media
        • Varbase Editor
        • Varbase Email
        • Varbase SEO
        • Varbase Workflow
        • Varbase Dashboards
        • Varbase Layout Builder
          • Varbase Landing page (Layout Builder)
          • Varbase Heading Block
          • Varbase Rich Text Block
          • Varbase HTML Code Block
          • Varbase Media (Image/Video) Block
          • Varbase Gallery Block
        • Varbase Components
        • Vartheme Claro
        • Vartheme BS5
      • Optional Components
        • Varbase AI
          • Varbase AI Default recipe
          • Varbase AI Editor Assistant recipe
          • Varbase AI Image Alt recipe
          • Varbase AI Taxonomy Tagging recipe
          • Varbase AI Agents recipe
        • Varbase API
        • Varbase Internationalization
        • Varbase Hero Slider
        • Varbase Carousels
        • Varbase Blog
        • Varbase Search
        • Varbase Social Single Sign-On
        • Varbase Media Twitter
        • Varbase Media Instagram
        • Varbase Content Planner
        • Varbase Bootstrap Paragraphs
          • Varbase Bootstrap Paragraphs Text and Image
        • Varbase Landing Page (Paragraphs)
      • Additional Components
        • Varbase Media Header
        • Varbase FAQs
        • Varbase Reports
        • Varbase Commerce
        • Varbase YouTube Import
      • Development Components
        • Varbase Development
        • Reroute Email
        • Varbase Updates Helper
      • Deprecated Components
        • Varbase Media Hero Slider
        • Varbase Style Guide
        • Vartheme BS4
        • Varbase Total Control Dashboard
    • Configuring a Varbase Site
      • Navigation
        • Defining Active Menu Trail Using Menu Position
      • Using View Modes Inventory
      • Content Moderation and Workflows
      • URL Aliases in Varbase/Drupal
        • Configuring URL Aliases
        • Managing URL Aliases
      • Managing URL Patterns for Multilingual Websites
      • Managing Date and Time Formats to Display Across the Site
      • Using Varbase Layout Builder
        • Creating a Landing Page With Varbase Layout Builder
        • Activating Varbase Layout Builder for Content Types
      • Configuring Pathologic When Going Live
      • Configuring SEO Features
        • Disallow Oembed Media Links
      • Configuring Security Features
        • Spam Protection
        • Password Policies
        • Other Security Kits
        • Flood Contorl
        • Enable HTTP Password Authentication
      • Configuring JSON:API Features
      • Configure Varbase Media Hero Slider
      • Configuring Varbase Media Header
      • Configuring Varbase Mailer Settings
        • Configure Symfony Mailer
      • Configure Level of Logging and Errors
      • Entity Definition Update Manager Class
      • Module Installer Factory Class
      • Configure Ckeditor 5 Media Embed
    • Theme Development with Varbase
      • Understanding The Vartheme Starterkit Theme
      • Creating Your Own Theme
      • Integration of Varbase with Storybook 1.0 - CL Server
      • Integration of Varbase with Storybook 2.0
      • Customize a Varbase Single Directory Components (SDC) In a Custom Theme
      • Local Tasks and Moderation Sidebar
      • Add Preloaded Fonts in Vartheme
      • Command to Install Needed Theming Tools
      • Manually Install Needed Theming Tools
    • Launching a Varbase Site to Production
    • Updating a Varbase Site
      • Understanding Varbase Updater Package
      • Handling Patches When Updating
      • Handling Configuration Updates
      • Updating Varbase to work with Composer 2.0
      • Updating Drush to the Latest Stable Version
      • Version Update Guides
        • Updating Varbase ~9.0 to Drupal 10
        • Updating from Varbase 8.x to 9.x
    • Varbase Patches
    • Frequently Asked Questions (FAQs)
    • Extending Varbase
      • Overriding Varbase
      • Creating Your Own Feature
      • Install Needed YARN and Webpack Tools
      • Compiling Provided Component Styles
      • Check Standards/Practice Coding And Linting
  • Content Designers
    • Accessing the Administration Area
      • Website Environments
    • Dashboard
      • Reports
    • Content Management
      • Create Content
        • Rich-Text Editor “WYSIWYG”
      • Modify Content
      • Delete Content
      • Preview Content
      • Bulk Edit Content
      • Publish Content
      • Authoring Information
    • Content Structure
      • EntityQueues
        • Add a New Term
      • Menu Management
        • Add Menu Items
        • Update Menu Items
        • Adding a Page to the Menu
      • Taxonomies
        • List Terms
        • Add Terms
        • Reorder and Edit Terms
    • Content Translation
      • Translating Content
      • Language Switcher
      • Deleting a Translation
      • Editing a Translation
    • Content Workflow
    • Layout Builder
      • Section
        • Section Styles
      • Block Management
        • Block Styles
      • Reordering Blocks
    • Webforms
      • Create New Webform View
      • Setting up Emails Handler Conditions
      • Setting up Confirmations Message Settings Types
    • Media Management
      • Accessing the Media Library
      • Uploading Media Files
        • Image
        • Remote Video
        • Video
      • Applying Metadata and Descriptions
      • Resizing Images
    • User Management
      • Login & Registration
      • Add User
      • Edit User
      • Delete User
      • Simulating Another User
      • Default Roles and Site Personas
        • Edit Roles' Permissions
        • Managing Roles
    • URL Management
      • URL Aliases
      • Generating URL Alias
      • URL Redirects
      • Domain Redirects
    • SEO Management
      • XML Sitemap
      • Meta Tags in Varbase
      • Disallow Indexing for Content Items
    • Site Configuration
      • System
        • Clearing Varbase Cache
        • Google Analytics
        • Mail Templates
      • User Interface
        • Coffee
        • External Links
        • Gin Moderation Sidebar
        • Layout Builder Modal
        • Moderation Sidebar
        • Shortcuts
        • Taxonomy Manager
        • Tours
        • CL Components
        • Antibot
        • Responsive Preview
        • Navigation Settings
      • Development
      • Varbase Settings
      • Web Services
        • OpenAPI
    • Additional Tips
      • Content Uploading Standards
      • Common Error Handling Tips
      • Glossary
  • Contributing
    • Contributing to Documentation
Powered by GitBook
On this page
  1. Developers
  2. Configuring a Varbase Site
  3. Configuring Security Features

Other Security Kits

Security Kit for XSS, CSRF, SSL/TLS, Expect-CT, and More

PreviousPassword PoliciesNextFlood Contorl

Last updated 1 year ago

To configure the Security Kit module in your site, navigate to: Administration \ Configuration \ System \ Security Kit settings

The configuration page allows you to configure settings to tighten your website's security regarding:

  • Cross-site Scripting (XSS)

    • Content Security Policy (CSP): Content Security Policy is a policy framework that allows to specify trustworthy sources of content and to restrict its capabilities. You may read more about it at Mozilla Wiki.

    • X-XSS-Protection header: X-XSS-Protection HTTP response header controls Microsoft Internet Explorer, Google Chrome and Apple Safari internal XSS filters.

  • Cross-site Request Forgery (CSRF): Configure levels and various techniques of protection from cross-site request forgery attacks.

  • Clickjacking

    • X-Frame-Options header: Configure the X-Frame-Options HTTP header.

    • JavaScript-based protection: Warning: With this enabled, the site will not work at all for users who have JavaScript disabled (e.g. users running the popular NoScript browser extension, if they haven't whitelisted your site).

  • SSL/TLS: Configure various techniques to improve security of SSL/TLS

  • Expect-CT: Configure the Expect-CT header which allows sites to opt in to reporting and/or enforcement of Certificate Transparency requirements. See Mozilla's developer documentation.

  • Feature policy: Allows configuration of the Feature-Policy header to selectively enable, disable, and modify the behavior of certain APIs and web features in the browser. See Google's developer documentation.

  • Miscellaneous: Configure miscellaneous unsorted security enhancements such as:

    • From-Origin HTTP response header

    • Referrer-Policy HTTP response header

All necessary documentation and examples of usage are on the settings page.

Security Kit