Access Control

Authenticated portals fail when a login wall is mistaken for access design. Droptica’s guide is most useful for teams planning how external users should see account-specific documents, dashboards, search results, and files. ...more

Lock Entity adds per-entity deletion protection for Drupal sites that need to preserve selected records, such as nodes, taxonomy terms, users, or media items. The module lets administrators add locks from a configuration page, include an optional reason, prevent unpublishing of locked published entities, and export locks through configuration. Drupal.org notes that the project is not covered by Drupal’s security advisory policy. ...more

A miniOrange blog post discusses risk-based access control for Drupal login security, focusing on contextual signals such as IP address, location, login time, device identity, and network behaviour. The article outlines how configurable policies may trigger alerts, additional verification, multi-factor authentication, or blocked access, but does not provide implementation steps or version-specific guidance. ...more

Drupal.org has revised how project maintainer permissions sync with GitLab, introducing a two-way mapping that aligns roles across both platforms. The update affects how access is granted and revoked, with a planned bulk update set to standardise permissions for existing projects. Maintainers are being advised to review membership changes as the new system may alter roles more broadly than expected. ...more

A blog post from ImageX outlines how Drupal sites can combine watermarking, metadata, and access controls to protect intellectual property. The approach emphasises layered techniques that address both human users and automated systems such as search engines and AI crawlers. ...more

A new Drupal module, Role Audit, introduces visual tools for comparing roles and permissions, helping administrators identify overlaps, access differences and potential security gaps. Shared by Jorge Tutor, the module aims to simplify governance in complex Drupal environments. ...more

In the third edition of his ECA use case series, Jürgen Haas explores how Drupal authentication workflows—from login redirects to role assignments—can be simplified using Event-Condition-Action (ECA) models. With fewer dependencies and more flexibility, ECA offers smarter alternatives to core features and popular modules alike, all while enhancing the site builder experience. ...more

In a new blog post, Saroj K presents a scenario-driven approach to Drupal module design, moving beyond file structures to focus on purpose-built architecture. Using an Event Hosting example, the post explores how to combine routes, services, permissions, and plugins to meet real-world needs. ...more

Christian Sanders from ComputerMinds explains how to render plugin blocks programmatically in Drupal using the Block Plugin API. The article walks through retrieving block instances for Views and Webform, constructing correct plugin IDs, and building render arrays. It also addresses pitfalls such as access checks, missing hooks, and caching behavior. This guide is ideal for developers integrating dynamic blocks without placing them in the admin UI. ...more

Learn how to block bots and protect public-facing routes in Drupal 10 by creating a custom human verification modal using AJAX, expirable tokens, and optional reCAPTCHA. ...more

In Episode 3 of Drupal WOWs, Syed Muhammad Azmat Shah shows how to monetise content with Drupal Commerce. Learn to sell user roles, restrict content access, and enable per-article sales—all without custom code. ...more