- Measurements exist for CPalius. Single-request response times were measured using
cp:perf:probeon a database with 100k users, 20k topics, 200k posts, and 100k bookings. Concurrent load testing (k6/ab) was not performed. - No measurements for competitors. We did not set up competitor systems to run with identical data. Competitor information in this document is based on source code inspection and makes no performance claims. "Present / None" reflects what was observed in the source; adding a capability via an extension or plugin is also possible.
- Sulu: The skeleton repository lacks a
vendordirectory. Core code was not analyzed—onlysecurity.yamland the package list were inspected; Sulu cells are therefore marked as "partial." - MODX and ProcessWire: Only relevant sections of security code (password hashing, access policies, session, CSRF, login throttling, file validation) were examined; the complete codebase was not audited.
- Verification level: Most Drupal and TYPO3 security cells (RequestSanitizer, CSRF token, RequestToken, CSP, MFA, filename validation, hash factory) were directly verified in source code. Competitor cells in the performance table, as well as certain cells for MODX, ProcessWire, and Sulu, rely on general domain knowledge and were not individually cross-checked in source; verify before publishing.
- This is not a security audit; vulnerabilities were not hunted, mechanisms were compared.
Performance mechanisms
| Feature | CPalius 2.2.68 | Drupal 11 | TYPO3 14 | MODX 3 | ProcessWire | Sulu |
|---|---|---|---|---|---|---|
| Guest page served directly as a static file by web server (without PHP) | Present (Apache, including gzip copy) | Internal page cache executes PHP | Page cache executes PHP | Element cache | Plugin (ProCache) | HTTP cache (FOSHttpCache/Varnish) |
| Tag-based invalidation | Present (push-based index, ~3 ms/page) | Present (checksum on delivery) | Present | Limited | Limited | Present |
| Stale-while-revalidate (serve stale, refresh in background) | Present | None (single request waits) | None | None | None | Depends on proxy |
| Render cache / BigPipe for uncacheable fragments | None | Present | Partial | Element cache | Module cache | None |
| Per-page cost metrics in admin panel | Present | Module (Web Profiler/Devel) | Admin panel tool available | None | Debug mode | Profiler |
| Query count guardrail (N+1) | Present (in development mode) | None | None | None | None | None |
| Server posture audit (OPcache, MySQL buffers, compression) | Present (cp:doctor) | Status report (partial) | Environment page (partial) | None | None | None |
Security mechanisms
| Feature | CPalius 2.2.68 | Drupal 11 | TYPO3 14 | MODX 3 | ProcessWire | Sulu |
|---|---|---|---|---|---|---|
| CSRF token | Present (session-bound) | Present (session seed + value-bound) | Present (scoped, time-limited, signed JWT) | Present | Present (single-use option) | Symfony |
| Re-authentication for sensitive actions | Present (new) | None | MFA enforcement available, none per action | None | None | None |
| Key rotation | Present (new) | No hash_salt rotation | Invalidated when encryption key changes | None | None | None |
| Password hashing and re-hashing | bcrypt cost 13, upgraded on login | PhpassHashedPassword/PHP | Argon2id/bcrypt/PBKDF2 factory | PHP native, PBKDF2 | bcrypt | Symfony auto |
| Two-factor authentication | TOTP, email code, recovery codes | Module | TOTP, recovery codes | Extra / Plugin | Module | scheb 2FA |
| Login throttling | Present (IP + account, captcha, banning) | Flood service | Lockout | Limited | SessionLoginThrottle | Symfony limiter |
| CSP | Present (nonce, report collector, recommendation tool) | None in core | Present (comprehensive, generates recommendations) | None | None | None |
| File upload: actual MIME, double extension, execution prevention | Present; SVG cannot be uploaded | Dangerous extension regex | Filename denylist + SVG sanitizer | Denylist | Denylist + file validator modules | Media bundle |
| SVG allowed (with sanitizer) | None (intentionally disallowed) | None | Present | None | None | None |
Input structure sanitization (# keys, external destination) | Unnecessary (Symfony returns 400, redirects filtered) | Present (RequestSanitizer) | Present | Patterns | Sanitizer | Symfony |
| Granular permissions | Role + user-based overrides, ownership | Role + "restrict access" flag | Permission sets | Context / resource group / policy (highly granular) | Role / permission | Webspace / collection matrix |
| Restricted permission flag | Present (new) | Present | None | None | None | None |
| Extension/plugin security advisories | Present (new, signed directory) | Present (update module) | Present (official advisories) | None | None | Composer audit |
| Trusted host | Present (AACP setting) | Enforced | Present | None | httpHosts | Symfony |
| WAF and IP banning | Present | Module | Extension | None | None | None |
| Security posture audit | Present (SecurityAuditor, cp:doctor) | Status report | Environment / Install tool | None | None | None |
Key takeaways from this table
- Where CPalius stands out: Server-side guest cache served as static files, stale-while-revalidate model, re-authentication for sensitive operations, key rotation, built-in WAF and posture checks, and N+1 query guardrails.
- Where CPalius falls behind: Fragmented caching such as render cache / BigPipe (Drupal), ultra-granular ACL (MODX context/resource groups, Sulu webspace matrix), safe acceptance of SVGs (TYPO3), full-text search indexing (currently
LIKE+ caching + rate limiting), and concurrent load testing. - Features intentionally omitted from competitors: Accepting SVGs via sanitization (disallowed for now, safer),
RequestSanitizer(Symfony inherently returns 400), and FULLTEXT indexing (avoiding dependency on ngram for MariaDB compatibility).
Next steps
- Portable full-text index for search (functional across both MySQL and MariaDB).
- Fragment caching on authenticated pages (factoring in staleness risks for user-specific data).
- k6/ab load testing on a live server under production settings.
- Individual audit of object-level authorization (access to other users' records) and SSRF endpoints.
Comments (0)
No comments yet. Be the first to write one.
Leave a comment
Your comment will appear after it is reviewed.