Configuration
All Grav configuration files are written in YAML syntax with a .yaml file extension. YAML is very intuitive which makes it very easy to both read and write, however, you can check out the YAML page in the Advanced chapter to get a complete understanding of the syntax available.
Note
TIP: See Security > Configuration for a quick guide how to secure and optimize your production site.
System Configuration
Grav focuses on making things as easy as possible for the user, and the same goes for configuration. Grav comes with some sensible default options, and these are contained in a file that resides in the system/config/system.yaml file.
However, you should never change this file, instead any configuration changes you need to make should be stored in a file called user/config/system.yaml. Any setting in this file with the same structure and naming will override the setting provided in the default system configuration file.
Tip
Generally speaking you should NEVER change anything in the system/ folder. All things the user does (creating content, installing plugins, editing configuration, etc.) should be done in the user/ folder. This way it allows simpler upgrading and also keeps your changes all in one location for backing up, synchronizing, etc.
Here are the variables found in the default system/config/system.yaml file:
Basic Options
1absolute_urls: false
2timezone: ''
3default_locale:
4param_sep: ':'
5wrapped_site: false
6reverse_proxy_setup: false
7force_ssl: false
8force_lowercase_urls: true
9custom_base_url: ''
10username_regex: '^[a-z0-9_-]{3,16}$'
11pwd_regex: '(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}'
12intl_enabled: true
13http_x_forwarded:
14 protocol: true
15 host: false
16 port: true
17 ip: true
These configuration options do not appear within their own child sections. They're general options that affect the way the site operates, its timezone, and base URL.
| Property | Description |
|---|---|
| absolute_urls: | Absolute or relative URLs for base_url |
| timezone: | Valid values can be found here |
| default_locale: | Default locale (defaults to system) |
| param_sep: | This is used for Grav parameters in the URL. Don't change this unless you know what you are doing. Grav automatically sets this to ; for users running Apache web server on Windows |
| wrapped_site: | For themes/plugins to know if Grav is wrapped by another platform. Can be true or false |
| reverse_proxy_setup: | Running in a reverse proxy scenario with different webserver ports than proxy. Can be true or false |
| force_ssl: | If enabled, Grav forces to be accessed via HTTPS (NOTE: Not an ideal solution). Can be true or false |
| force_lowercase_urls: | If you want to support mixed cased URLs set this to false |
| custom_base_url: | Manually set the base_url here |
| username_regex: | Only lowercase chars, digits, dashes, underscores. 3 - 16 chars |
| pwd_regex: | At least one number, one uppercase and lowercase letter, and be at least 8+ chars |
| intl_enabled: | Special logic for PHP International Extension (mod_intl) |
| http_x_forwarded: | Configuration options for the various HTTP_X_FORWARD headers (Grav 1.7.0+) |
Languages
1languages:
2 supported: []
3 default_lang:
4 include_default_lang: true
5 include_default_lang_file_extension: true
6 pages_fallback_only: false
7 translations: true
8 translations_fallback: true
9 session_store_active: false
10 http_accept_language: false
11 override_locale: false
12 content_fallback: {}
The Languages area of the file establishes the site's language settings. This includes which language(s) are supported, designation of the default language in the URLs, and translations. Here is the breakdown for the Languages area of the system configuration file:
| Property | Description |
|---|---|
| supported: | List of languages supported. eg: [en, fr, de] |
| default_lang: | Default is the first supported language. Must be one of the supported languages |
| include_default_lang: | Include the default lang prefix in all URLs. Can be true or false |
| include_default_lang_file_extension: | If enabled, saving a page will prepend the default language to the file extension (eg. .en.md). Disable it to keep the default language using .md file extension. Can be true or false (Grav 1.7.0+) |
| pages_fallback_only: | Only fallback to find page content through supported languages. Can be true or false |
| translations: | Enable translations by default. Can be true or false |
| translations_fallback: | Fallback through supported translations if active lang doesn't exist. Can be true or false |
| session_store_active: | Store active language in session. Can be true or false |
| http_accept_language: | Attempt to set the language based on http_accept_language header in the browser. Can be true or false |
| override_locale: | Override the default or system locale with language specific one. Can be true or false |
| content_fallback: | By default if the content isn't translated, Grav will display the content in the default language. Use this setting to override that behavior per language basis. (Grav 1.7.0+) |
Home
1home:
2 alias: '/home'
3 hide_in_urls: false
The Home section is where you set the default route to the site's homepage. You can also choose to hide the home route in URLs.
| Property | Description |
|---|---|
| alias: | Default path for home, ie: /home or / |
| hide_in_urls: | Hide the home route in URLs. Can be true or false |
Pages
1pages:
2 type: regular
3 theme: quark
4 order:
5 by: default
6 dir: asc
7 list:
8 count: 20
9 dateformat:
10 default:
11 short: 'jS M Y'
12 long: 'F jS \a\t g:ia'
13 publish_dates: true
14 process:
15 markdown: true
16 twig: false
17 twig_first: false
18 never_cache_twig: false
19 events:
20 page: true
21 twig: true
22 markdown:
23 extra: false
24 auto_line_breaks: false
25 auto_url_links: false
26 escape_markup: false
27 special_chars:
28 '>': 'gt'
29 '<': 'lt'
30 valid_link_attributes:
31 - rel
32 - target
33 - id
34 - class
35 - classes
36 types: [html,htm,xml,txt,json,rss,atom]
37 append_url_extension: ''
38 expires: 604800
39 cache_control:
40 last_modified: false
41 etag: false
42 vary_accept_encoding: false
43 redirect_default_route: false
44 redirect_default_code: 302
45 redirect_trailing_slash: true
46 ignore_files: [.DS_Store]
47 ignore_folders: [.git, .idea]
48 ignore_hidden: true
49 hide_empty_folders: false
50 url_taxonomy_filters: true
51 frontmatter:
52 process_twig: false
53 ignore_fields: ['form','forms']
The Pages section of the system/config/system.yaml file is where you set a lot of the main theme-related settings. For example, this is where you set the theme used to render the site, page ordering, twig and markdown processing defaults, and more. This is where most of the decisions that affect the way your pages are rendered are made.
| Property | Description |
|---|---|
| type: | Experimental setting to enable Flex Pages in frontend. Use flex to enable, regular otherwise. This defaults to regular (Grav 1.7+) |
| theme: | This is where you set the default theme. This defaults to quark |
| order: | |
| ... by: | Order pages by default, alpha or date |
| ... dir: | Default ordering direction, asc or desc |
| list: | |
| ... count: | Default item count per page |
| dateformat: | |
| ... default: | The default date format Grav expects in the date: field |
| ... short: | Short date format. Example: 'jS M Y' |
| ... long: | Long date format. Example: 'F jS \a\t g:ia' |
| publish_dates: | Automatically publish/unpublish based on dates. Can be set true or false |
| process: | |
| ... markdown: | Enable or disable the processing of markdown on the front end. Can be set true or false |
| ... twig: | Enable or disable the processing of twig on the front end. Can be set true or false |
| twig_first: | Process Twig before markdown when processing both on a page. Can be set true or false |
| never_cache_twig: | Enabling this will allow you to add a processing logic that can change dynamically on each page load, rather than caching the results and storing it for each page load. This can be enabled/disabled site-wide in the system.yaml, or on a specific page. Can be set true or false |
| events: | |
| ... page: | Enable page-level events. Can be set true or false |
| ... twig: | Enable Twig-level events. Can be set true or false |
| markdown: | |
| ... extra: | Enable support for Markdown Extra support (GitHub-flavored Markdown (GFM) by default). Can be set true or false |
| ... auto_line_breaks: | Enable automatic line breaks. Can be set true or false |
| ... auto_url_links: | Enable automatic HTML links. Can be set true or false |
| ... escape_markup: | Escape markup tags into entities. Can be set true or false |
| ... special_chars: | List of special characters to automatically convert to entities. Each character consumes a line below this variable. Example: '>': 'gt' |
| ... valid_link_attributes: | Valid attributes to pass through via markdown links (Grav 1.7+) |
| types: | List of valid page types. For example: [txt,xml,html,htm,json,rss,atom] |
| append_url_extension: | Append page's extension in Page URLs (e.g. .html results in /path/page.html) |
| expires: | Page expires time in seconds (604800 seconds = 7 days) (no cache is also possible) |
| cache_control: | Can be blank for no setting, or a valid cache-control text value |
| last_modified: | Set the last modified date header based on file modification timestamp. Can be set true or false |
| etag: | Set the etag header tag. Can be set to true or false |
| vary_accept_encoding: | Add Vary: Accept-Encoding header. Can be set to true or false |
| redirect_default_route: | Automatically redirect to a page's default route. Can be set to true or false |
| redirect_default_code: | Default code to use for redirects. For example: 302 |
| redirect_trailing_slash: | Handle automatically or 302 redirect a trailing / URL |
| ignore_files: | Files to ignore in Pages. Example: [.DS_Store] |
| ignore_folders: | Folders to ignore in Pages. Example: [.git, .idea] |
| ignore_hidden: | Ignore all Hidden files and folders. Can be set to true or false |
| hide_empty_folders: | If folder has no .md file, should it be hidden. Can be set to true or false |
| url_taxonomy_filters: | Enable auto-magic URL-based taxonomy filters for page collections. Can be set to true or false |
| frontmatter: | |
| ... process_twig: | Should the frontmatter be processed to replace Twig variables? Can be set to true or false |
| ... ignore_fields: | Fields that might contain Twig variables and should not be processed. Example: ['form','forms'] |
Cache
1cache:
2 enabled: true
3 check:
4 method: file
5 driver: auto
6 prefix: 'g'
7 purge_at: '0 4 * * *'
8 clear_at: '0 3 * * *'
9 clear_job_type: 'standard'
10 clear_images_by_default: false
11 cli_compatibility: false
12 lifetime: 604800
13 gzip: false
14 allow_webserver_gzip: false
15 redis:
16 socket: false
17 password:
18 database:
The Cache section is where you can configure the site's caching settings. You can enable, disable, choose the method, and more.
| Property | Description |
|---|---|
| enabled: | Set to true to enable caching. Can be set to true or false |
| check: | |
| ... method: | Method to check for updates in pages. Options: file, folder, hash and none. more details |
| driver: | Select a cache driver. Options are: auto, file, apcu, redis, memcache, and wincache |
| prefix: | Cache prefix string (prevents cache conflicts). Example: g |
| purge_at: | Scheduler: How often to purge old cache using cron at syntax |
| clear_at: | Scheduler: How often to clear the cache using cron at syntax |
| clear_job_type: | Type to clear when processing the scheduled clear job. Options: standard | all |
| clear_images_by_default: | By default grav does not include processed images when cache clears, this can be enabled by setting this to true |
| cli_compatibility: | Ensures only non-volatile drivers are used (file, redis, memcache, etc.) |
| lifetime: | Lifetime of cached data in seconds (0 = infinite). 604800 is 7 days |
| gzip: | GZip compress the page output. Can be set to true or false |
| allow_webserver_gzip: | This option will change the header to Content-Encoding: identity allowing gzip to be more reliably set by the webserver although this usually breaks the out-of-process onShutDown() capability. The event will still run, but it won't be out of process, and may hold up the page until the event is complete |
| redis: | |
| ... socket: | The path to the redis socket file |
| ... password: | Optional password |
| ... database: | Optional database ID |
Twig
1twig:
2 cache: true
3 debug: true
4 auto_reload: true
5 autoescape: false
6 undefined_functions: true
7 undefined_filters: true
8 umask_fix: false
The Twig section gives you a quick set of tools with which to configure Twig on your site for debugging, caching, and optimization.
| Property | Description |
|---|---|
| cache: | Set to true to enable Twig caching. Can be set to true or false |
| debug: | Enable Twig debug. Can be set to true or false |
| auto_reload: | Refresh cache on changes. Can be set to true or false |
| autoescape: | Autoescape Twig vars. Can be set to true or false |
| undefined_functions: | Allow undefined functions. Can be set to true or false |
| undefined_filters: | Allow undefined filters. Can be set to true or false |
| umask_fix: | By default Twig creates cached files as 755, fix switches this to 775. Can be set to true or false |
Assets
1assets:
2 css_pipeline: false
3 css_pipeline_include_externals: true
4 css_pipeline_before_excludes: true
5 css_minify: true
6 css_minify_windows: false
7 css_rewrite: true
8 js_pipeline: false
9 js_pipeline_include_externals: true
10 js_pipeline_before_excludes: true
11 js_module_pipeline: false
12 js_module_pipeline_include_externals: true
13 js_module_pipeline_before_excludes: true
14 js_minify: true
15 enable_asset_timestamp: false
16 enable_asset_sri: false
17 collections:
18 jquery: system://assets/jquery/jquery-2.x.min.js
The Assets section enables you to configure options related to the Assets Manager (JS, CSS).
| Property | Description |
|---|---|
| css_pipeline: | The CSS pipeline is the unification of multiple CSS resources into one file. Can be set to true or false |
| css_pipeline_include_externals: | Include external URLs in the pipeline by default. Can be set to true or false |
| css_pipeline_before_excludes: | Render the pipeline before any excluded files. Can be set to true or false |
| css_minify: | Minify the CSS during pipelining. Can be set to true or false |
| css_minify_windows: | Minify Override for Windows platforms. false by default due to ThreadStackSize. Can be set to true or false |
| css_rewrite: | Rewrite any CSS relative URLs during pipelining. Can be set to true or false |
| js_pipeline: | The JS pipeline is the unification of multiple JS resources into one file. Can be set to true or false |
| js_pipeline_include_externals: | Include external URLs in the pipeline by default. Can be set to true or false |
| js_pipeline_before_excludes: | Render the pipeline before any excluded files. Can be set to true or false |
| js_module_pipeline | The JS Module pipeline is the unification of multiple JS Module resources into one file. Can be set to true or false |
| js_module_pipeline_include_externals | Include external URLs in the pipeline by default. Can be set to true or false |
| js_module_pipeline_before_excludes | Render the pipeline before any excluded files. Can be set to true or false |
| js_minify: | Minify the JS during pipelining. Can be set to true or false |
| enable_asset_timestamp: | Enable asset timestamps. Can be set to true or false |
| enable_asset_sri: | Enable asset SRI. Can be set to true or false |
| collections: | This contains collections, designated as sub-items. For example: jquery: system://assets/jquery/jquery-3.x.min.js. Read more about this |
Errors
1errors:
2 display: 0
3 log: true
The Errors section determines how Grav handles error display and logging.
| Property | Description |
|---|---|
| display: | Determines how errors are displayed. Enter either 1 for the full backtrace, 0 for Simple Error, or -1 for System Error |
| log: | Log errors to /logs folder. Can be set to true or false |
Log
1log:
2 handler: file
3 syslog:
4 facility: local6
The Log section allows you to configure alternate logging capabilities for Grav.
| Property | Description |
|---|---|
| handler: | Log handler. Currently supported: file | syslog |
| syslog: | |
| ... facility: | Syslog facilities output |
Debugger
1debugger:
2 enabled: false
3 provider: clockwork
4 censored: false
5 shutdown:
6 close_connection: true
The Debugger section gives you the ability to activate Grav's debugger. A useful tool during development.
| Property | Description |
|---|---|
| enabled: | Enable Grav debugger and following settings. Can be set to true or false |
| provider: | Debugger provider: Can be set to debugbar or clockwork (Grav 1.7+) |
| censored: | Censor potentially sensitive information (POST parameters, cookies, files, configuration and most array/object data in log messages). Can be set to true or false (Grav 1.7+) |
| shutdown: | |
| ... close_connection: | Close the connection before calling onShutdown(). false for debugging |
Images
1images:
2 default_image_quality: 85
3 cache_all: false
4 cache_perms: '0755'
5 debug: false
6 auto_fix_orientation: false
7 seofriendly: false
8 cls:
9 auto_sizes: false
10 aspect_ratio: false
11 retina_scale: 1
12 defaults:
13 loading: auto
The Images section gives you the ability to set the default image quality images are resampled to, as well as to control image caching and debugging features.
| Property | Description |
|---|---|
| default_image_quality: | Default image quality to use when resampling images. For example: 85 = 85% |
| cache_all: | Cache all images by default. Can be set to true or false |
| cache_perms: | Must be in quotes! Default cache folder perms. Usually '0755' or '0775' |
| debug: | Show an overlay over images indicating the pixel depth of the image when working with retina, for example. Can be set to true or false |
| auto_fix_orientation: | Try to automatically fix images uploaded with non-standard rotation |
| seofriendly: | SEO-friendly processed image names |
| cls: | Cumulative Layout Shift. More details |
| ... auto_sizes: | Automatically add height/width to image |
| ... aspect_ratio: | Reserve space with aspect ratio style |
| ... retina_scale: | Scale to adjust auto-sizes for better handling of HiDPI resolutions |
| defaults: | (Grav 1.7+) |
| ... loading: | Let browser pick: auto, lazy or eager (Grav 1.7+) |
Media
1media:
2 enable_media_timestamp: false
3 unsupported_inline_types: []
4 allowed_fallback_types: []
5 auto_metadata_exif: false
The Media section handles the configuration options for settings related to the handling of media files. This includes timestamp display, upload size, and more.
| Property | Description |
|---|---|
| enable_media_timestamp: | Enable media timetsamps |
| unsupported_inline_types: | Array of supported media types to try to display inline. These file types are placed within [] brackets |
| allowed_fallback_types: | Array of allowed media types of files found if accessed via Page route. These file types are placed within [] brackets |
| auto_metadata_exif: | Automatically create metadata files from Exif data where possible |
Session
1session:
2 enabled: true
3 initialize: true
4 timeout: 1800
5 name: grav-site
6 uniqueness: path
7 secure: false
8 httponly: true
9 samesite: Lax
10 split: true
11 domain:
12 path:
These options determine session properties for your site.
| Property | Description |
|---|---|
| enabled: | Enable Session support. Can be set to true or false |
| initialize: | Initialize session from Grav (if false, plugin needs to start the session) |
| timeout: | Timeout in seconds. For example: 1800 |
| name: | Name prefix of the session cookie. Use alphanumeric, dashes or underscores only. Do not use dots in the session name. For example: grav-site |
| uniqueness: | Should sessions be path based or security.salt based |
| secure: | Set session secure. If true, indicates that communication for this cookie must be over an encrypted transmission. Enable this only on sites that run exclusively on HTTPS. Can be set to true or false |
| httponly: | Set session HTTP only. If true, indicates that cookies should be used only over HTTP, and JavaScript modification is not allowed. Can be set to true or false |
| samesite: | Set session SameSite. Possible values are Lax, Strict and None. See here |
| domain: | The session domain to be used in the responses. Use only if you you rewrite the site domain for example in a Docker Container. |
| path: | The session path to be used in the responses. Use only if you you rewrite the site subfolder for example in a Docker Container. |
GPM
1gpm:
2 releases: stable
3 proxy_url:
4 method: 'auto'
5 verify_peer: true
6 official_gpm_only: true
Options in the GPM section control Grav's GPM (Grav Package Manager). For example, you can restrict GPM to using official sources and select the method GPM uses to retrieve packages. You can also choose between stable and testing releases, as well as set up a proxy URL.
| Property | Description |
|---|---|
| releases: | Set to either stable or testing to determine if you want to update to the latest stable or testing build |
| proxy_url: | Configure a manual proxy URL for GPM. For example: 127.0.0.1:3128 |
| method: | Either 'curl', 'fopen' or 'auto'. 'auto' will try fopen first and if not available cURL |
| verify_peer: | On some systems (Windows mostly) GPM is unable to connect because the SSL certificate cannot be verified. Disabling this setting might help |
| official_gpm_only: | By default GPM direct-install will only allow URLs via the official GPM proxy to ensure security, disable this to allow other sources |
Accounts
1accounts:
2 type: regular
3 storage: file
Accounts settings allows you to try out the new experimental Flex Users. This basically means that Users are stored as Flex objects allowing more power and performance.
| Property | Description |
|---|---|
| type: | Account type: regular or flex |
| storage: | Flex storage type: file or folder |
Flex
1flex:
2 cache:
3 index:
4 enabled: true
5 lifetime: 60
6 object:
7 enabled: true
8 lifetime: 600
9 render:
10 enabled: true
11 lifetime: 600
Flex Objects cache configuration settings are new in Grav 1.7. These are default settings for all Flex types, but they can be overridden for each Flex Directory.
| Property | Description |
|---|---|
| cache: | (Grav 1.7+) |
| ... index: | (Grav 1.7+) |
| ... ... enabled: | Set to true to enable Flex index caching. Is used to cache timestamps in files (Grav 1.7+) |
| ... ... lifetime: | Lifetime of cached index in seconds (0 = infinite) (Grav 1.7+) |
| ... object: | (Grav 1.7+) |
| ... ... enabled: | Set to true to enable Flex object caching. Is used to cache object data (Grav 1.7+) |
| ... ... lifetime: | Lifetime of cached objects in seconds (0 = infinite) (Grav 1.7+) |
| ... render: | (Grav 1.7+) |
| ... ... enabled: | Set to true to enable Flex render caching. Is used to cache rendered output (Grav 1.7+) |
| ... ... lifetime: | Lifetime of cached HTML in seconds (0 = infinite) (Grav 1.7+) |
Strict Mode
1strict_mode:
2 yaml_compat: true
3 twig_compat: true
4 blueprint_compat: false
Strict mode allows for a cleaner migration to future versions of Grav by moving to the newer versions of YAML and Twig processors. These may not be compatible with all 3rd party extensions.
| Property | Description |
|---|---|
| yaml_compat: | Enables YAML backwards compatibility |
| twig_compat: | Enables deprecated Twig autoescape setting |
| blueprint_compat: | Enables backward compatible strict support for blueprints |
Caution
You do not need to copy the entire configuration file to override it, you can override as little or as much as you like. Just ensure you have the exact same naming structure for the particular setting you want to override.
Site Configuration
As well as the system.yaml file, Grav also provides a default site.yaml configuration file that is used to set some front-end specific configuration such as author name, author email, as well as some key taxonomy settings. You can override these in the same way as you would the system.yaml by providing your own configuration file in user/config/site.yaml. You can also use this file to put in arbitrary configuration options that you may want to reference from your content or templates.
The default system/config/site.yaml file that ships with Grav looks something like this:
1title: Grav # Name of the site
2default_lang: en # Default language for site (potentially used by theme)
3
4author:
5 name: John Appleseed # Default author name
6 email: '[email protected]' # Default author email
7
8taxonomies: [category,tag] # Arbitrary list of taxonomy types
9
10metadata:
11 description: 'My Grav Site' # Site description
12
13summary:
14 enabled: true # enable or disable summary of page
15 format: short # long = summary delimiter will be ignored; short = use the first occurrence of delimiter or size
16 size: 300 # Maximum length of summary (characters)
17 delimiter: === # The summary delimiter
18
19redirects:
20# '/redirect-test': '/' # Redirect test goes to home page
21# '/old/(.*)': '/new/$1' # Would redirect /old/my-page to /new/my-page
22
23routes:
24# '/something/else': '/blog/sample-3' # Alias for /blog/sample-3
25# '/new/(.*)': '/blog/$1' # Regex any /new/my-page URL to /blog/my-page Route
26
27blog:
28 route: '/blog' # Custom value added (accessible via site.blog.route)
29
30#menu: # Menu Example
31# - text: Source
32# icon: github
33# url: https://github.com/getgrav/grav
34# - icon: twitter
35# url: http://twitter.com/getgrav
Let's break down the elements of this sample file:
| Property | Description |
|---|---|
| title: | The title is a simple string variable that can be referenced whenever you want to display the name of this site |
| author: | |
| ... name: | The name of the author of the site, that can be referenced whenever you need it |
| ... email: | A default email for use in your site |
| taxonomies: | An arbitrary list of high-level types that you can use to organize your content. You can assign content to specific taxonomy types, for example, categories or tags. Feel free to edit, or add your own |
| metadata: | Set default metadata for all your pages, see the content page headers section for more details |
| summary: | |
| ... size: | A variable to override the default number of characters that can be used to set the summary size when displaying a portion of content |
| routes: | This is a basic map that can provide simple URL alias capabilities in Grav. If you browse to /something/else you will actually be sent to /blog/sample-3. Feel free to edit, or add your own as needed. Regex Replacements ((.*) - $1) are now supported at the end of route aliases. You should put these at the bottom of the list for optimal performance |
| (custom options) | You can create any option you like in this file and a good example is the blog: route: '/blog' option that is accessible in your Twig templates with site.blog.route |
Caution
For most people, the most important element of this file is the Taxonomy list. The taxonomies in this list must be defined here if you wish to use them in your content.
Security
For increased security there is system/config/security.yaml file that sets some sensible defaults and is used by the Admin plugin when Saving content, as well in the new Reports section of Tools.
The default configuration looks like this:
1xss_whitelist: [admin.super]
2xss_enabled:
3 on_events: true
4 invalid_protocols: true
5 moz_binding: true
6 html_inline_styles: true
7 dangerous_tags: true
8xss_invalid_protocols:
9 - javascript
10 - livescript
11 - vbscript
12 - mocha
13 - feed
14 - data
15xss_dangerous_tags:
16 - applet
17 - meta
18 - xml
19 - blink
20 - link
21 - style
22 - script
23 - embed
24 - object
25 - iframe
26 - frame
27 - frameset
28 - ilayer
29 - layer
30 - bgsound
31 - title
32 - base
33uploads_dangerous_extensions:
34 - php
35 - html
36 - htm
37 - js
38 - exe
39sanitize_svg: true
If you wish to make any changes to these settings, you should copy this file to user/config/security.yaml and make edits there.
Other Configuration Settings and Files
User configuration is completely optional. You can override as little or as much of the default settings as you need. This applies to both the system, site, and any plugin configurations in your site.
You are also not limited to the user/config/system.yaml or the user/config/site.yaml files as described above. You can create any arbitrary .yaml configuration file in the user/config folder you wish and it will get picked up by Grav automatically.
As an example if the new configuration file is named user/config/data.yaml and a yaml variable in this file is called count:
count: 39
The variable would be accessed in your Twig template by using the following syntax:
{{ config.data.count }}
It would also be accessible via PHP from any plugin with the code:
$count_var = Grav::instance()['config']->get('data.count');
Warning
You can also provide a custom blueprint to enable your custom file to be editable in the admin plugin. Check out the relevant recipe in the Admin Cookbook section.
Config Variable Namespacing
Paths to the configuration files will be used as a namespace for your configuration options.
Alternatively, you can put all the options into one file and use YAML structures to specify the hierarchy for your configuration options. This namespacing is built from a combination of the path + filename + option name.
For example: An option such as author: Frank Smith in file plugins/myplugin.yaml could be accessible via: plugins.myplugin.author. However, you could also have a plugins.yaml file and in that file have an option name called myplugin: author: Frank Smith and it would still be reachable by the same plugins.myplugin.author namespace.
Some example configuration files could be structured:
| File | Description |
|---|---|
| user/config/system.yaml | Global system configuration file |
| user/config/site.yaml | A site-specific configuration file |
| user/config/plugins/myplugin.yaml | Individual configuration file for myplugin plugin |
| user/config/themes/mytheme.yaml | Individual configuration file for mytheme theme |
Caution
Having a namespaced configuration file will override or mask all options having the same path in the default configuration files
Plugins Configuration
Most plugins will come with their own YAML configuration file. We recommend copying this file to the user/config/plugins/ directory rather than editing configuration options directly to the file located in the plugin's directory. Doing this will ensure that an update to the plugin will not overwrite your settings, and keep all of your configurable options in one, convenient place.
If you have a plugin called user/plugins/myplugin that has a configuration file called user/plugins/myplugin/myplugin.yaml then you would copy this file to user/config/plugins/myplugin.yaml and edit the file there.
The YAML file that exists within the plugin's primary directory will act as a fallback. Any settings listed there and not in the User folder's copy will be picked up and used by Grav.
Themes Configuration
The same rules for themes apply as they did for plugins. So if you have a theme called user/themes/mytheme that has a configuration file called user/themes/mytheme/mytheme.yaml then you would copy this file to user/config/themes/mytheme.yaml and edit the file there.