diff --git a/core/includes/common.inc b/core/includes/common.inc
index 9601c76..befb84e 100644
--- a/core/includes/common.inc
+++ b/core/includes/common.inc
@@ -1273,7 +1273,7 @@ function drupal_strip_dangerous_protocols($uri) {
   static $allowed_protocols;
 
   if (!isset($allowed_protocols)) {
-    $allowed_protocols = array_flip(variable_get('filter_allowed_protocols', array('ftp', 'http', 'https', 'irc', 'mailto', 'news', 'nntp', 'rtsp', 'sftp', 'ssh', 'tel', 'telnet', 'webcal')));
+    $allowed_protocols = array_flip(config('system.protocols')->get('allowed_protocols'));
   }
 
   // Iteratively remove any invalid protocol found.
diff --git a/core/modules/filter/filter.install b/core/modules/filter/filter.install
index 9237ad1..512e8d3 100644
--- a/core/modules/filter/filter.install
+++ b/core/modules/filter/filter.install
@@ -143,7 +143,26 @@ function filter_install() {
   );
   $plain_text_format = (object) $plain_text_format;
   filter_format_save($plain_text_format);
+}
 
-  // Set the fallback format to plain text.
-  variable_set('filter_fallback_format', $plain_text_format->format);
+/**
+ * @addtogroup updates-7.x-to-8.x
+ * @{
+ */
+
+/**
+ * Moves filter_fallback settings from variable to config.
+ *
+ * @ingroup config_upgrade
+ */
+function filter_update_8000() {
+  update_variables_to_config('filter.settings', array(
+    'filter_fallback_format' => 'fallback_format',
+    'filter_allowed_protocols' => 'allowed_protocols',
+  ));
 }
+
+/**
+ * @} End of "defgroup updates-7.x-to-8.x".
+ * The next series of updates should start at 9000.
+ */
diff --git a/core/modules/filter/filter.module b/core/modules/filter/filter.module
index b55066f..4851c51 100644
--- a/core/modules/filter/filter.module
+++ b/core/modules/filter/filter.module
@@ -639,7 +639,7 @@ function filter_fallback_format() {
   // existing (and potentially unsafe) text format on the site automatically
   // available to all users. Returning NULL at least guarantees that this
   // cannot happen.
-  return variable_get('filter_fallback_format');
+  return config('filter.settings')->get('fallback_format');
 }
 
 /**
@@ -1552,7 +1552,7 @@ function _filter_url($text, $filter) {
   // we cannot cleanly differ between protocols here without hard-coding MAILTO,
   // so '//' is optional for all protocols.
   // @see filter_xss_bad_protocol()
-  $protocols = variable_get('filter_allowed_protocols', array('http', 'https', 'ftp', 'news', 'nntp', 'telnet', 'mailto', 'irc', 'ssh', 'sftp', 'webcal', 'rtsp'));
+  $protocols = array_flip(config('sysytem.protocols')->get('allowed_protocols'));
   $protocols = implode(':(?://)?|', $protocols) . ':(?://)?';
 
   // Prepare domain name pattern.
diff --git a/core/modules/filter/lib/Drupal/filter/Tests/FilterUnitTest.php b/core/modules/filter/lib/Drupal/filter/Tests/FilterUnitTest.php
index 2060535..9010d37 100644
--- a/core/modules/filter/lib/Drupal/filter/Tests/FilterUnitTest.php
+++ b/core/modules/filter/lib/Drupal/filter/Tests/FilterUnitTest.php
@@ -478,8 +478,8 @@ function testUrlFilter() {
         '<a href="mailto:me@me.tv">me@me.tv</a>' => TRUE,
       ),
       // Absolute URL protocols.
-      // The list to test is found in the beginning of _filter_url() at
-      // $protocols = variable_get('filter_allowed_protocols'... (approx line 1325).
+      // The list to test is found in the file
+      // core/modules/filter/config/filter.settings.yml.
       '
 https://example.com,
 ftp://ftp.example.com,
diff --git a/core/modules/filter/lib/Drupal/filter/config/filter.settings.yml b/core/modules/filter/lib/Drupal/filter/config/filter.settings.yml
new file mode 100644
index 0000000..59c9eef
--- /dev/null
+++ b/core/modules/filter/lib/Drupal/filter/config/filter.settings.yml
@@ -0,0 +1 @@
+fallback_format: plain_text
diff --git a/core/modules/simpletest/lib/Drupal/simpletest/UnitTestBase.php b/core/modules/simpletest/lib/Drupal/simpletest/UnitTestBase.php
index 98ed71d..d449360 100644
--- a/core/modules/simpletest/lib/Drupal/simpletest/UnitTestBase.php
+++ b/core/modules/simpletest/lib/Drupal/simpletest/UnitTestBase.php
@@ -69,6 +69,8 @@ protected function setUp() {
     // Set user agent to be consistent with WebTestBase.
     $_SERVER['HTTP_USER_AGENT'] = $this->databasePrefix;
 
+    config('filter.settings')->set('allowed_protocols', array('http', 'https', 'ftp', 'news', 'nntp', 'telnet', 'mailto', 'irc', 'ssh', 'sftp', 'webcal', 'rtsp'));
+
     $this->setup = TRUE;
   }
 }
diff --git a/core/modules/system/config/system.protocols.yml b/core/modules/system/config/system.protocols.yml
new file mode 100644
index 0000000..fd1ff8f
--- /dev/null
+++ b/core/modules/system/config/system.protocols.yml
@@ -0,0 +1,13 @@
+allowed_protocols:
+  - http
+  - https
+  - ftp
+  - news
+  - nntp
+  - telnet
+  - mailto
+  - irc
+  - ssh
+  - sftp
+  - webcal
+  - rtsp
diff --git a/core/modules/system/system.install b/core/modules/system/system.install
index e938128..2222851 100644
--- a/core/modules/system/system.install
+++ b/core/modules/system/system.install
@@ -2215,6 +2215,21 @@ function system_update_8032() {
 }
 
 /**
+ * Moves filter_allowed_protocols variable to config.
+ *
+ * This config is provided now by the system module because it is used by
+ * drupal_strip_dangerous_protocols() and must to be available before the filter
+ * module be installed.
+ *
+ * @ingroup config_upgrade
+ */
+function system_update_8033() {
+  update_variables_to_config('system.protocols', array(
+    'filter_allowed_protocols' => 'allowed_protocols',
+  ));
+}
+
+/**
  * @} End of "defgroup updates-7.x-to-8.x".
  * The next series of updates should start at 9000.
  */