README

Version: 0.1 Machine Name: security_layer
Type: Recipe Author: Carla Mola Compatible with: Drupal 11.x

Introduction

Security Layer is a ready-to-use configuration recipe that strengthens your Drupal site’s security by automatically installing and configuring essential security modules. It enforces password policies, two-factor authentication (2FA), form protection, brute-force prevention, session control, data encryption, and HTTP header hardening.

Designed for developers and administrators who want to apply best practices in security quickly and reliably.

Features

Strong Password Policies

• Minimum 12 characters.
• Must contain at least 4 types of characters.
• Prevents reuse of the last 5 passwords.
• Cannot include the username.
• Passwords expire every 90 days.

Session Timeout and Control

• Automatically logs out users after 30 minutes of inactivity.
• Maximum session length configurable (default: 2 hours).
• Session tracking and logout logs enabled.
• Applies only to authenticated users.

Brute-force Protection

• Maximum 5 failed login attempts.
• Activity logged after 10 failed attempts within 1 hour.
• Temporary blocking enabled.

CAPTCHA on Critical Forms

• Math-based challenge.
• Enabled for login, registration, and password reset.
• Case-insensitive validation.

Two-Factor Authentication (2FA)

• Based on TOTP (e.g., Google Authenticator).
• Enabled by default for all authenticated users.
• 10 recovery codes generated per user.
• 6 failed attempts allowed per 5 minutes (flood control).
• Email notifications on 2FA enable/disable actions.

Data Encryption

• AES-256 encryption via the real_aes module.
• Encryption key stored securely using the key module.
• Key is Base64-encoded and must be manually generated (see below).
• Integrates with encrypt, key, and real_aes.

Secure HTTP Headers

• Removes insecure or unnecessary headers (X-Powered-By, Server).
• Sets strict security policies:
• X-Frame-Options: SAMEORIGIN
• X-XSS-Protection: 1; mode=block
• Strict-Transport-Security
• Basic Content-Security-Policy (CSP)

Performance Tuning

• Enables CSS and JS aggregation.
• Browser and proxy caching set to 1 hour.

Requirements

Required Contributed Modules

This recipe depends on the following Drupal modules:

• password_policy
• captcha
• flood_control
• tfa
• encrypt
• key
• real_aes
• secure_headers

All of them are automatically installed via Composer when applying the recipe.

Installation

Step 1: Add the repository (if not on drupal.org)

1. Requiring this Recipe

   composer require drupal/security_layer:1.0.0`
   

2. Applying this Recipe

   drush cr
   drush recipe security_layer
   

Post-installation Configuration

1. Generate your own encryption key Before enabling encryption features, you must generate a secure 256-bit key:

   openssl rand -base64 32
   

   This produces a Base64-encoded 256-bit key.

2. Then, open the file: config/install/key.key.encryption_key.yml Find the key_value field and replace its content with your generated key.

   key_value: YOUR_BASE64_ENCODED_KEY_HERE
   

   Do not use the default key in production environments.