diff --git a/core/includes/common.inc b/core/includes/common.inc
index 6800fa5..be37075 100644
--- a/core/includes/common.inc
+++ b/core/includes/common.inc
@@ -1273,7 +1273,13 @@ function drupal_strip_dangerous_protocols($uri) {
   static $allowed_protocols;
 
   if (!isset($allowed_protocols)) {
-    $allowed_protocols = array_flip(variable_get('filter_allowed_protocols', array('ftp', 'http', 'https', 'irc', 'mailto', 'news', 'nntp', 'rtsp', 'sftp', 'ssh', 'tel', 'telnet', 'webcal')));
+    $default = config('filter.settings')->get('allowed_protocols');
+    if (empty($default)) {
+      // Seems this function is called really early during the drupal install.
+      // Provide the default values until the configuration value be available.
+      $default = array('ftp', 'http', 'https', 'irc', 'mailto', 'news', 'nntp', 'rtsp', 'sftp', 'ssh', 'tel', 'telnet', 'webcal');
+    }
+    $allowed_protocols = array_flip($default);
   }
 
   // Iteratively remove any invalid protocol found.
diff --git a/core/modules/filter/config/filter.settings.yml b/core/modules/filter/config/filter.settings.yml
new file mode 100644
index 0000000..c45498d
--- /dev/null
+++ b/core/modules/filter/config/filter.settings.yml
@@ -0,0 +1,14 @@
+fallback_format: plain_text
+allowed_protocols:
+  - http
+  - https
+  - ftp
+  - news
+  - nntp
+  - telnet
+  - mailto
+  - irc
+  - ssh
+  - sftp
+  - webcal
+  - rtsp
diff --git a/core/modules/filter/filter.install b/core/modules/filter/filter.install
index 9237ad1..ab865b0 100644
--- a/core/modules/filter/filter.install
+++ b/core/modules/filter/filter.install
@@ -145,5 +145,17 @@ function filter_install() {
   filter_format_save($plain_text_format);
 
   // Set the fallback format to plain text.
-  variable_set('filter_fallback_format', $plain_text_format->format);
+  config('filter.settings')->set('fallback_format', $plain_text_format->format)->save();
+}
+
+/**
+ * Moves filter_fallback settings from variable to config.
+ *
+ * @ingroup config_upgrade
+ */
+function filter_update_8000() {
+  update_variables_to_config('filter.settings', array(
+    'filter_fallback_format' => 'fallback_format',
+    'filter_allowed_protocols' => 'allowed_protocols',
+  ));
 }
diff --git a/core/modules/filter/filter.module b/core/modules/filter/filter.module
index b55066f..3654e96 100644
--- a/core/modules/filter/filter.module
+++ b/core/modules/filter/filter.module
@@ -639,7 +639,7 @@ function filter_fallback_format() {
   // existing (and potentially unsafe) text format on the site automatically
   // available to all users. Returning NULL at least guarantees that this
   // cannot happen.
-  return variable_get('filter_fallback_format');
+  return config('filter.settings')->get('fallback_format');
 }
 
 /**
@@ -1552,7 +1552,7 @@ function _filter_url($text, $filter) {
   // we cannot cleanly differ between protocols here without hard-coding MAILTO,
   // so '//' is optional for all protocols.
   // @see filter_xss_bad_protocol()
-  $protocols = variable_get('filter_allowed_protocols', array('http', 'https', 'ftp', 'news', 'nntp', 'telnet', 'mailto', 'irc', 'ssh', 'sftp', 'webcal', 'rtsp'));
+  $protocols = array_flip(config('filter.settings')->get('allowed_protocols'));
   $protocols = implode(':(?://)?|', $protocols) . ':(?://)?';
 
   // Prepare domain name pattern.
diff --git a/core/modules/filter/lib/Drupal/filter/Tests/FilterUnitTest.php b/core/modules/filter/lib/Drupal/filter/Tests/FilterUnitTest.php
index 2060535..a2fcf11 100644
--- a/core/modules/filter/lib/Drupal/filter/Tests/FilterUnitTest.php
+++ b/core/modules/filter/lib/Drupal/filter/Tests/FilterUnitTest.php
@@ -478,8 +478,8 @@ function testUrlFilter() {
         '<a href="mailto:me@me.tv">me@me.tv</a>' => TRUE,
       ),
       // Absolute URL protocols.
-      // The list to test is found in the beginning of _filter_url() at
-      // $protocols = variable_get('filter_allowed_protocols'... (approx line 1325).
+      // The list to test is found in the file
+      // core/modules/filter/config/filter.settings.yml
       '
 https://example.com,
 ftp://ftp.example.com,