Who this is for. Whoever signs a member site off. Work through it on the production environment, or a staging copy of its settings, signed out and as test members, never as yourself.

Accounts and sign-in

  • Registration is on only if the site needs it, its Type is Frontend, and its default groups are right (Registration settings).
  • Every account screen the site links to has a template, including the address list, which must be overridden; on a Twig site, every screen and users/emails/reset-password-twig.html (Account routes and their templates).
  • The reset email's subject and sender are the client's, not the defaults (The reset email).
  • The minimum password length is raised from its default of six.
  • The sign-in template carries redirectUrl through, so members return to the page they wanted (Where the member lands).
  • No member account has a backend user type (Checking an inherited site).

Sign-in providers and passkeys

  • The Core dna provider is left off member sign-in pages.
  • Each enabled provider has its credentials, and a redirect URI registered for every hostname members use; Microsoft's tenant is the organisation's where the site is for one organisation (Enabling a provider).
  • If passkeys are on, enrolment and sign-in are tested on production's hostname (Passkeys).

Members-only content

Caching

  • No personal output on a cached public page; personal parts arrive as fragments, and preventCaching() is in the fragments, not the base template (Member pages and the page cache).
  • No enforceCaching() on any page that shows something about the visitor.
  • Public pages answer X-Cache-Status: hit on a second request.

Security

  • Every signed-in form carries the CSRF token, and errors/not-authorized.html explains an expired page (CSRF on member forms).
  • Rate limits on sign-in, registration and password reset are agreed and tested at the edge (Rate limiting and captcha).
  • Registration and public forms have a captcha, Forms module forms have Require completed captcha ticked, and each shows a fallback contact route.
  • Templates, jobs and emails pass the personal data checks (Checks).
  • Every API key and OAuth client is known, and each integration's user can read only what it needs.
  • The site sends email from the client's authenticated domain, so reset emails arrive.