Mutamad Security

The security baseline of a Mutamad site.

Accounts and login: password policies, account lockout, idle logout, no username enumeration, and a site administrator who assigns the editor role only.

The site: security headers and a Content Security Policy (Security Kit and Permissions-Policy), private uploads by default, no error output to visitors, anti-automation on login and public forms (ALTCHA, Honeypot, Antibot), flood unblocking and cheap 404s.

Aligned to NCA ECC-2:2024 2-2, 3-2 and 15-2.

Part of Mutamad

Part of Mutamad, the Drupal distribution for Saudi government websites. Mutamad Standard Site applies it on every Mutamad site.

Requirements

• Drupal 11.4
• Mutamad Roles
• altcha
• antibot
• autologout
• captcha
• fast_404
• flood_control
• honeypot
• login_security
• password_policy
• permissionspolicy
• role_delegation
• seckit
• username_enumeration_prevention
• a private file path

Installation

Set a private file path in settings.php first, outside the web root: $settings['file_private_path'] = '../private';

composer require drupal/mutamad_security
drush recipe ../recipes/mutamad_security

Documentation

The README explains every setting and why, and the changelog what changed in each release.