govcms-2.x-dev/modules/custom/core/govcms_security/govcms_security.module

<?php

/**
 * @file
 * Module file.
 */

use Drupal\Core\Form\FormStateInterface;
use Drupal\Core\Site\Settings;
use Drupal\Core\Access\AccessResult;
use Drupal\Core\Entity\EntityInterface;
use Drupal\Core\Session\AccountInterface;

/**
 * Implements hook_form_FORM_ID_alter().
 */
function govcms_security_form_contact_message_contact_form_alter(&$form, FormStateInterface $form_state) {
  $form['actions']['preview']['#access'] = FALSE;
}

/**
 * Implements hook_form_FORM_ID_alter().
 */
function govcms_security_form_user_login_form_alter(&$form, &$form_state) {
  $form['#attributes']['autocomplete'] = 'off';
}

/**
 * Implement hook_form_FORM_ID_alter()
 */
function govcms_security_form_user_admin_settings_alter(&$form, FormStateInterface $form_state) {
  $form['admin_role']['#access'] = FALSE;
}

/**
 * Implements hook_form_alter().
 */
function govcms_security_form_alter(&$form, FormStateInterface $form_state, $form_id) {
  // Author information shouldn't be displayed by default for new content types.
  // If desired, it can be enabled however ISM states individual employees
  // shouldn't have their names or details present on the website.
  if ($form_id === "node_type_add_form") {
    $form['display']['display_submitted']['#default_value'] = 0;
  }
}

/**
 * Implements hook_ENTITY_TYPE_access().
 */
function govcms_security_user_access(EntityInterface $entity, $operation, AccountInterface $account) {
  if ($entity->id() == 1 && !Settings::get('govcms_security_super_ui')) {
    return AccessResult::forbidden();
  }

  return AccessResult::neutral();
}