drevops · AlexSkrypnyk · Sep 8, 2026 · Sep 8, 2026 · Sep 8, 2026 · Sep 8, 2026
diff --git a/.vortex/docs/content/development/modules/contributed-modules.mdx b/.vortex/docs/content/development/modules/contributed-modules.mdx
@@ -85,7 +85,7 @@ No settings override.
 
 ### Configuration
 
-[`settings.fast_404.php`](https://github.com/drevops/vortex/blob/main/web/sites/default/includes/modules/settings.fast_404.php) sets the file extensions to intercept, whitelists the front controller and the other entry-point scripts, allows anonymous access to image style derivatives, and calls `fast404_preboot()` with those settings.
+[`settings.fast_404.php`](https://github.com/drevops/vortex/blob/main/web/sites/default/includes/modules/settings.fast_404.php) sets the file extensions to intercept, whitelists the front controller and the other entry-point scripts, brings image style derivatives under the same rules so anonymous requests cannot force derivative generation, and calls `fast404_preboot()` with those settings. Path checking against the router and the URL aliases is off, as it queries the database before Drupal has connected to it.
 
 ## Generated Content
 

diff --git a/...tests/Fixtures/handler_process/_baseline/tests/phpunit/Drupal/EnvironmentSettingsTest.php b/...tests/Fixtures/handler_process/_baseline/tests/phpunit/Drupal/EnvironmentSettingsTest.php
@@ -96,15 +96,16 @@ public function testEnvironmentNoOverrides(): void {
     $settings['container_yamls'][0] = $this->app_root . '/' . $this->site_path . '/services.yml';
     $settings['entity_update_batch_size'] = 50;
     $settings['environment'] = self::ENVIRONMENT_SUT;
-    $settings['fast404_allow_anon_imagecache'] = TRUE;
+    $settings['fast404_allow_anon_imagecache'] = FALSE;
     $settings['fast404_exts'] = '/^(?!\/robots)^(?!\/system\/files).*\.(txt|png|gif|jpe?g|css|js|ico|swf|flv|cgi|bat|pl|dll|exe|asp)$/i';
     $settings['fast404_html'] = '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL "@path" was not found on this server.</p></body></html>';
+    $settings['fast404_path_check'] = FALSE;
+    $settings['fast404_respect_redirect'] = FALSE;
+    $settings['fast404_url_whitelisting'] = TRUE;
     $settings['fast404_whitelist'] = [
       'index.php',
       'rss.xml',
-      'install.php',
       'cron.php',
-      'update.php',
       'xmlrpc.php',
     ];
     $settings['file_public_path'] = 'sites/default/files';
@@ -193,15 +194,16 @@ public function testEnvironmentOverrides(): void {
     $settings['container_yamls'][0] = $this->app_root . '/' . $this->site_path . '/services.yml';
     $settings['entity_update_batch_size'] = 50;
     $settings['environment'] = self::ENVIRONMENT_SUT;
-    $settings['fast404_allow_anon_imagecache'] = TRUE;
+    $settings['fast404_allow_anon_imagecache'] = FALSE;
     $settings['fast404_exts'] = '/^(?!\/robots)^(?!\/system\/files).*\.(txt|png|gif|jpe?g|css|js|ico|swf|flv|cgi|bat|pl|dll|exe|asp)$/i';
     $settings['fast404_html'] = '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL "@path" was not found on this server.</p></body></html>';
+    $settings['fast404_path_check'] = FALSE;
+    $settings['fast404_respect_redirect'] = FALSE;
+    $settings['fast404_url_whitelisting'] = TRUE;
     $settings['fast404_whitelist'] = [
       'index.php',
       'rss.xml',
-      'install.php',
       'cron.php',
-      'update.php',
       'xmlrpc.php',
     ];
     $settings['file_public_path'] = 'custom_public';
@@ -261,15 +263,16 @@ public function testEnvironmentLocal(): void {
     $settings['container_yamls'][0] = $this->app_root . '/' . $this->site_path . '/services.yml';
     $settings['entity_update_batch_size'] = 50;
     $settings['environment'] = self::ENVIRONMENT_LOCAL;
-    $settings['fast404_allow_anon_imagecache'] = TRUE;
+    $settings['fast404_allow_anon_imagecache'] = FALSE;
     $settings['fast404_exts'] = '/^(?!\/robots)^(?!\/system\/files).*\.(txt|png|gif|jpe?g|css|js|ico|swf|flv|cgi|bat|pl|dll|exe|asp)$/i';
     $settings['fast404_html'] = '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL "@path" was not found on this server.</p></body></html>';
+    $settings['fast404_path_check'] = FALSE;
+    $settings['fast404_respect_redirect'] = FALSE;
+    $settings['fast404_url_whitelisting'] = TRUE;
     $settings['fast404_whitelist'] = [
       'index.php',
       'rss.xml',
-      'install.php',
       'cron.php',
-      'update.php',
       'xmlrpc.php',
     ];
     $settings['file_public_path'] = 'sites/default/files';
@@ -331,15 +334,16 @@ public function testEnvironmentLocalContainer(): void {
     $settings['container_yamls'][0] = $this->app_root . '/' . $this->site_path . '/services.yml';
     $settings['entity_update_batch_size'] = 50;
     $settings['environment'] = self::ENVIRONMENT_LOCAL;
-    $settings['fast404_allow_anon_imagecache'] = TRUE;
+    $settings['fast404_allow_anon_imagecache'] = FALSE;
     $settings['fast404_exts'] = '/^(?!\/robots)^(?!\/system\/files).*\.(txt|png|gif|jpe?g|css|js|ico|swf|flv|cgi|bat|pl|dll|exe|asp)$/i';
     $settings['fast404_html'] = '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL "@path" was not found on this server.</p></body></html>';
+    $settings['fast404_path_check'] = FALSE;
+    $settings['fast404_respect_redirect'] = FALSE;
+    $settings['fast404_url_whitelisting'] = TRUE;
     $settings['fast404_whitelist'] = [
       'index.php',
       'rss.xml',
-      'install.php',
       'cron.php',
-      'update.php',
       'xmlrpc.php',
     ];
     $settings['file_public_path'] = 'sites/default/files';
@@ -444,15 +448,16 @@ public function testEnvironmentGha(): void {
     $settings['container_yamls'][0] = $this->app_root . '/' . $this->site_path . '/services.yml';
     $settings['entity_update_batch_size'] = 50;
     $settings['environment'] = self::ENVIRONMENT_CI;
-    $settings['fast404_allow_anon_imagecache'] = TRUE;
+    $settings['fast404_allow_anon_imagecache'] = FALSE;
     $settings['fast404_exts'] = '/^(?!\/robots)^(?!\/system\/files).*\.(txt|png|gif|jpe?g|css|js|ico|swf|flv|cgi|bat|pl|dll|exe|asp)$/i';
     $settings['fast404_html'] = '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL "@path" was not found on this server.</p></body></html>';
+    $settings['fast404_path_check'] = FALSE;
+    $settings['fast404_respect_redirect'] = FALSE;
+    $settings['fast404_url_whitelisting'] = TRUE;
     $settings['fast404_whitelist'] = [
       'index.php',
       'rss.xml',
-      'install.php',
       'cron.php',
-      'update.php',
       'xmlrpc.php',
     ];
     $settings['file_public_path'] = 'sites/default/files';

diff --git a/.../tests/Fixtures/handler_process/_baseline/tests/phpunit/Drupal/SwitchableSettingsTest.php b/.../tests/Fixtures/handler_process/_baseline/tests/phpunit/Drupal/SwitchableSettingsTest.php
@@ -268,8 +268,11 @@ public static function dataProviderFast404(): \Iterator {
       TRUE,
       [
         'fast404_exts' => '/^(?!\/robots)^(?!\/system\/files).*\.(txt|png|gif|jpe?g|css|js|ico|swf|flv|cgi|bat|pl|dll|exe|asp)$/i',
-        'fast404_allow_anon_imagecache' => TRUE,
-        'fast404_whitelist' => ['index.php', 'rss.xml', 'install.php', 'cron.php', 'update.php', 'xmlrpc.php'],
+        'fast404_allow_anon_imagecache' => FALSE,
+        'fast404_url_whitelisting' => TRUE,
+        'fast404_whitelist' => ['index.php', 'rss.xml', 'cron.php', 'xmlrpc.php'],
+        'fast404_path_check' => FALSE,
+        'fast404_respect_redirect' => FALSE,
         'fast404_html' => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL "@path" was not found on this server.</p></body></html>',
       ],
     ];
@@ -279,7 +282,10 @@ public static function dataProviderFast404(): \Iterator {
       [
         'fast404_exts' => NULL,
         'fast404_allow_anon_imagecache' => NULL,
+        'fast404_url_whitelisting' => NULL,
         'fast404_whitelist' => NULL,
+        'fast404_path_check' => NULL,
+        'fast404_respect_redirect' => NULL,
         'fast404_html' => NULL,
       ],
     ];

diff --git a/...xtures/handler_process/_baseline/web/sites/default/includes/modules/settings.fast_404.php b/...xtures/handler_process/_baseline/web/sites/default/includes/modules/settings.fast_404.php
@@ -8,18 +8,53 @@
 declare(strict_types=1);
 
 if (file_exists($contrib_path . '/fast_404/fast404.inc')) {
+  // Disallowed extensions. Any extension set here will not be served by Drupal
+  // and will get a Fast 404. This does not affect actual files on the
+  // filesystem, as requests hit them before defaulting to a Drupal request.
   $settings['fast404_exts'] = '/^(?!\/robots)^(?!\/system\/files).*\.(txt|png|gif|jpe?g|css|js|ico|swf|flv|cgi|bat|pl|dll|exe|asp)$/i';
-  $settings['fast404_allow_anon_imagecache'] = TRUE;
+
+  // Image derivative URLs fall under the same rules as any other static file.
+  // Anonymous requests no longer create derivatives, so the site cannot be
+  // taken down by hammering it with image style paths.
+  $settings['fast404_allow_anon_imagecache'] = FALSE;
+
+  // Check requests against a whitelist before the extension list. Modules that
+  // serve their own PHP files need to be whitelisted below if they bootstrap
+  // Drupal.
+  $settings['fast404_url_whitelisting'] = TRUE;
+
+  // Files and URLs allowed while URL whitelisting is enabled.
   $settings['fast404_whitelist'] = [
     'index.php',
     'rss.xml',
-    'install.php',
     'cron.php',
-    'update.php',
     'xmlrpc.php',
   ];
+
+  // Check whether the requested path corresponds to a real page by consulting
+  // the router and the URL aliases. This finds 404s earlier at the cost of
+  // adding the lookup to regular page loads. The lookup queries the database
+  // before Drupal has connected to it, so every path other than the front page
+  // answers with a redirect to the installer. Enable it once the module is
+  // patched with
+  // https://www.drupal.org/files/issues/2022-10-05/fast_404-db_preboot_errors_d9.4-2961512-23.patch
+  // @see https://www.drupal.org/project/fast_404/issues/2961512
+  $settings['fast404_path_check'] = FALSE;
+
+  // The path check runs before the Redirect module, so it consults the
+  // redirect table to avoid answering a configured redirect with a 404. Enable
+  // it alongside the path check above.
+  $settings['fast404_respect_redirect'] = FALSE;
+
+  // Body of the 404 response. The '@path' token is replaced with the path
+  // being requested relative to the executed script.
   $settings['fast404_html'] = '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL "@path" was not found on this server.</p></body></html>';
+
   include_once $contrib_path . '/fast_404/fast404.inc';
+  // Each answered request logs a TypeError after the response is sent, because
+  // the module passes an array where an exception is expected. Patch it with
+  // https://www.drupal.org/files/issues/2023-08-24/fast_404_3x-3194034-10.patch
+  // @see https://www.drupal.org/project/fast_404/issues/3194034
   // @phpstan-ignore-next-line
   fast404_preboot($settings);
 }
diff --git a/...ures/handler_process/ciprovider_circleci/tests/phpunit/Drupal/EnvironmentSettingsTest.php b/...ures/handler_process/ciprovider_circleci/tests/phpunit/Drupal/EnvironmentSettingsTest.php
@@ -1,4 +1,4 @@
-@@ -403,9 +403,9 @@
+@@ -407,9 +407,9 @@
    }
 
    /**

diff --git a/.../code_coverage_provider_codecov_circleci/tests/phpunit/Drupal/EnvironmentSettingsTest.php b/.../code_coverage_provider_codecov_circleci/tests/phpunit/Drupal/EnvironmentSettingsTest.php
@@ -1,4 +1,4 @@
-@@ -403,9 +403,9 @@
+@@ -407,9 +407,9 @@
    }
 
    /**

diff --git a/...andler_process/deploy_types_all_circleci/tests/phpunit/Drupal/EnvironmentSettingsTest.php b/...andler_process/deploy_types_all_circleci/tests/phpunit/Drupal/EnvironmentSettingsTest.php
@@ -1,4 +1,4 @@
-@@ -403,9 +403,9 @@
+@@ -407,9 +407,9 @@
    }
 
    /**

diff --git a/...ndler_process/deploy_types_none_circleci/tests/phpunit/Drupal/EnvironmentSettingsTest.php b/...ndler_process/deploy_types_none_circleci/tests/phpunit/Drupal/EnvironmentSettingsTest.php
@@ -1,4 +1,4 @@
-@@ -403,9 +403,9 @@
+@@ -407,9 +407,9 @@
    }
 
    /**

diff --git a/...rocess/deps_updates_provider_ci_circleci/tests/phpunit/Drupal/EnvironmentSettingsTest.php b/...rocess/deps_updates_provider_ci_circleci/tests/phpunit/Drupal/EnvironmentSettingsTest.php
@@ -1,4 +1,4 @@
-@@ -403,9 +403,9 @@
+@@ -407,9 +407,9 @@
    }
 
    /**

diff --git a/...ndler_process/hosting_acquia/docroot/sites/default/includes/modules/settings.fast_404.php b/...ndler_process/hosting_acquia/docroot/sites/default/includes/modules/settings.fast_404.php
@@ -8,18 +8,53 @@
 declare(strict_types=1);
 
 if (file_exists($contrib_path . '/fast_404/fast404.inc')) {
+  // Disallowed extensions. Any extension set here will not be served by Drupal
+  // and will get a Fast 404. This does not affect actual files on the
+  // filesystem, as requests hit them before defaulting to a Drupal request.
   $settings['fast404_exts'] = '/^(?!\/robots)^(?!\/system\/files).*\.(txt|png|gif|jpe?g|css|js|ico|swf|flv|cgi|bat|pl|dll|exe|asp)$/i';
-  $settings['fast404_allow_anon_imagecache'] = TRUE;
+
+  // Image derivative URLs fall under the same rules as any other static file.
+  // Anonymous requests no longer create derivatives, so the site cannot be
+  // taken down by hammering it with image style paths.
+  $settings['fast404_allow_anon_imagecache'] = FALSE;
+
+  // Check requests against a whitelist before the extension list. Modules that
+  // serve their own PHP files need to be whitelisted below if they bootstrap
+  // Drupal.
+  $settings['fast404_url_whitelisting'] = TRUE;
+
+  // Files and URLs allowed while URL whitelisting is enabled.
   $settings['fast404_whitelist'] = [
     'index.php',
     'rss.xml',
-    'install.php',
     'cron.php',
-    'update.php',
     'xmlrpc.php',
   ];
+
+  // Check whether the requested path corresponds to a real page by consulting
+  // the router and the URL aliases. This finds 404s earlier at the cost of
+  // adding the lookup to regular page loads. The lookup queries the database
+  // before Drupal has connected to it, so every path other than the front page
+  // answers with a redirect to the installer. Enable it once the module is
+  // patched with
+  // https://www.drupal.org/files/issues/2022-10-05/fast_404-db_preboot_errors_d9.4-2961512-23.patch
+  // @see https://www.drupal.org/project/fast_404/issues/2961512
+  $settings['fast404_path_check'] = FALSE;
+
+  // The path check runs before the Redirect module, so it consults the
+  // redirect table to avoid answering a configured redirect with a 404. Enable
+  // it alongside the path check above.
+  $settings['fast404_respect_redirect'] = FALSE;
+
+  // Body of the 404 response. The '@path' token is replaced with the path
+  // being requested relative to the executed script.
   $settings['fast404_html'] = '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL "@path" was not found on this server.</p></body></html>';
+
   include_once $contrib_path . '/fast_404/fast404.inc';
+  // Each answered request logs a TypeError after the response is sent, because
+  // the module passes an array where an exception is expected. Patch it with
+  // https://www.drupal.org/files/issues/2023-08-24/fast_404_3x-3194034-10.patch
+  // @see https://www.drupal.org/project/fast_404/issues/3194034
   // @phpstan-ignore-next-line
   fast404_preboot($settings);
 }