Managing Developer Portal security

You can manage multiple security elements in the Developer Portal.

Configuring CAPTCHA
You can add a CAPTCHA challenge to any of your Developer Portal pages to protect your site from spam.
Configuring reCAPTCHA
You can configure reCAPTCHA on your Developer Portal site to provide more protection from spam and abuse.
Configuring session timeout and limit
You can specify session timeout settings to control when a user is automatically logged out of the Developer Portal. You can also restrict the number of sessions a single user has available to them.
Configuring the timeout length for the password reset link
You can configure the timeout length for the one-time password reset link that is sent from the Developer Portal to the admin user account.
Configuring your site password policy
You can configure your site password policy to define the constraints that are applied to the passwords of your Developer Portal users.
Disabling CORS warnings
You can disable cross-origin resource sharing (CORS) warnings for unenforced APIs in the Developer Portal.
Disabling live testing of APIs
You can disable live testing of APIs in the Developer Portal to restrict exposure of an API.
How to enable penetration testing, and information about Developer Portal cookies
Many security features are available in the Developer Portal, but if you need to do a penetration test of your Developer Portal site, some of these features might block the scan that is required as part of the testing. This topic provides guidance on the security features that you might need to disable to allow penetration testing of your site, as well as information about Developer Portal cookies.
How to manage IP security in the Developer Portal
The Developer Portal offers the ability to perform various IP address security measures, such as adding and removing specific IP addresses from the banned IP address list, automatically banning client IP addresses by using the Drupal Perimeter Defence module, or managing login security by using flood control.
Managing banned IP addresses
You can ban specific IP addresses from accessing your Developer Portal site.
Using flood control for login security
You can configure login security for your Developer Portal by using flood control.
Login security
You can configure the login security for your Developer Portal at an IP and user level. You can also configure login security for Developer Portal contact forms.
Using the Security kit
You can improve the security of your website by configuring various options that are available in the Security Kit module, in the Developer Portal.
Using Honeypot for spam protection
Honeypot protection provides security mechanisms to protect your Developer Portal site from form submission by spam bots. If spam bot activity is detected, form submission is blocked.

Parent topic: Configuration