Every default in a content management system is a decision someone made. Most are inherited, copied from a fifteen-year-old codebase and never revisited. This one was written down first: what a request may do, what a session may keep, what a template may print.

What "strict by default" changes

A page is rendered from data that has been validated, not from data that was hoped for. Output is escaped unless a template asks otherwise, in one place, on purpose. Nothing in a request reaches the filesystem without a name that was checked against what is actually there.

Security is not a feature you bolt on. It is what remains when you remove everything you cannot justify.

The result is a site that behaves the same on day one and on day four hundred, because nothing drifted: no plugin update changed a behaviour, no theme pulled a script from somewhere else.