Security Kit and Drupal 11
The latest stable release, 2.0.3, declares a core version requirement of ^9.5 || ^10 || ^11, which covers Drupal 11.
SecKit provides Drupal with various security-hardening options. This lets your mitigate the risks of exploitation of different web application vulnerabilities. SecKit facilitates certain mitigations for Cross-site Scripting, Cross-site Request Forgery, and Clickjacking, among other issues.
Key facts
- Project
- seckit
- Latest stable with Drupal 11 support
- 2.0.3 (11 Sept 2024)
- Core version requirement
- ^9.5 || ^10 || ^11
- Maintenance status
- Seeking co-maintainer(s)
- Reported installs
- 77,766
- Last synced from drupal.org
- 21 Sept 2026
Every field above comes from the drupal.org API. The Drupal 11 status is derived from the core version requirement across this project's releases.
Source: drupal.org/project/seckit
Related modules in Security
Key
ReadyProvides management, storage and access control of sensitive keys, e.g. API and encryption keys. Works with config, file, environment and external storage. Helps meet security compliance requirements.
keyLatest stable 8.x-1.2287,053 sitesAntibot
ReadyPrevents spam submissions on forms by checking if JavaScript is enabled in the browser and that human-like activity occurs (e.g., mouse move, tab key press, or swipe gesture).
antibotLatest stable 2.0.565,487 sitesAutomated Logout
ReadyThis module provides a site administrator the ability to log users out after a specified time of inactivity. It is highly customizable and includes "site policies" by role to enforce logout.
autologoutLatest stable 8.x-1.840,555 sitesReal AES
ReadyOverview Real AES provides an encryption method plugin for the Encrypt module. This plugin offers AES encryption using CBC mode and HMAC authentication through the Defuse PHP-Encryption library. Requirements PHP 5.4 or later, with the OpenSSL extension Defuse PHP-Encryption library Real AES version Defuse PHP-Encryption version 8.x-2.x 2.x version of the library 7.x-2.x 2.x version of the library
real_aesLatest stable 8.x-2.631,022 sitesLogin Security
ReadyLogin Security module improves the security options in the login operation of a Drupal site. By default, Drupal introduces only basic access control denying IP access to the full content of the site. With Login Security module, a site administrator may protect and restrict access by adding access control features to the login forms (default login form in /user and the block called "login form
login_securityLatest stable 2.0.717,475 sitesRemove HTTP headers
ReadyOverview The Remove HTTP headers module removes configured HTTP headers from the response. Also removes <meta name="Generator" content="Drupal 8 (https://www.drupal.org)"> from the <head> tag if the X-Generator HTTP header is configured to be removed. By default the X-Generator , X-Drupal-Dynamic-Cache and X-Drupal-Cache HTTP headers are configured to be removed.
remove_http_headersLatest stable 2.1.213,675 sites