diff --git a/core/includes/common.inc b/core/includes/common.inc
index a608ba4..d5e9c90 100644
--- a/core/includes/common.inc
+++ b/core/includes/common.inc
@@ -1296,7 +1296,10 @@ function drupal_strip_dangerous_protocols($uri) {
   static $allowed_protocols;
 
   if (!isset($allowed_protocols)) {
-    $allowed_protocols = array_flip(variable_get('filter_allowed_protocols', array('ftp', 'http', 'https', 'irc', 'mailto', 'news', 'nntp', 'rtsp', 'sftp', 'ssh', 'tel', 'telnet', 'webcal')));
+    // During test-setup system.filter.protocols may be empty. In order to
+    // avoid test breakage, a list of protocols necessary to run tests is
+    // supplied in that case.
+    $allowed_protocols = array_flip(config('system.filter')->get('protocols') ?: array('ftp', 'http', 'https', 'irc', 'mailto', 'news', 'nntp', 'rtsp', 'sftp', 'ssh', 'tel', 'telnet', 'webcal'));
   }
 
   // Iteratively remove any invalid protocol found.
diff --git a/core/modules/filter/config/filter.settings.yml b/core/modules/filter/config/filter.settings.yml
new file mode 100644
index 0000000..59c9eef
--- /dev/null
+++ b/core/modules/filter/config/filter.settings.yml
@@ -0,0 +1 @@
+fallback_format: plain_text
diff --git a/core/modules/filter/filter.install b/core/modules/filter/filter.install
index 9237ad1..f3c29a5 100644
--- a/core/modules/filter/filter.install
+++ b/core/modules/filter/filter.install
@@ -143,7 +143,25 @@ function filter_install() {
   );
   $plain_text_format = (object) $plain_text_format;
   filter_format_save($plain_text_format);
+}
 
-  // Set the fallback format to plain text.
-  variable_set('filter_fallback_format', $plain_text_format->format);
+/**
+ * @addtogroup updates-7.x-to-8.x
+ * @{
+ */
+
+/**
+ * Moves filter_fallback settings from variable to config.
+ *
+ * @ingroup config_upgrade
+ */
+function filter_update_8000() {
+  update_variables_to_config('filter.settings', array(
+    'filter_fallback_format' => 'fallback_format',
+  ));
 }
+
+/**
+ * @} End of "defgroup updates-7.x-to-8.x".
+ * The next series of updates should start at 9000.
+ */
diff --git a/core/modules/filter/filter.module b/core/modules/filter/filter.module
index b55066f..c17971c 100644
--- a/core/modules/filter/filter.module
+++ b/core/modules/filter/filter.module
@@ -639,7 +639,7 @@ function filter_fallback_format() {
   // existing (and potentially unsafe) text format on the site automatically
   // available to all users. Returning NULL at least guarantees that this
   // cannot happen.
-  return variable_get('filter_fallback_format');
+  return config('filter.settings')->get('fallback_format');
 }
 
 /**
@@ -1552,7 +1552,7 @@ function _filter_url($text, $filter) {
   // we cannot cleanly differ between protocols here without hard-coding MAILTO,
   // so '//' is optional for all protocols.
   // @see filter_xss_bad_protocol()
-  $protocols = variable_get('filter_allowed_protocols', array('http', 'https', 'ftp', 'news', 'nntp', 'telnet', 'mailto', 'irc', 'ssh', 'sftp', 'webcal', 'rtsp'));
+  $protocols = config('system.filter')->get('protocols') ?: array('ftp', 'http', 'https', 'irc', 'mailto', 'news', 'nntp', 'rtsp', 'sftp', 'ssh', 'tel', 'telnet', 'webcal');
   $protocols = implode(':(?://)?|', $protocols) . ':(?://)?';
 
   // Prepare domain name pattern.
diff --git a/core/modules/filter/lib/Drupal/filter/Tests/FilterUnitTest.php b/core/modules/filter/lib/Drupal/filter/Tests/FilterUnitTest.php
index 2060535..e6e0999 100644
--- a/core/modules/filter/lib/Drupal/filter/Tests/FilterUnitTest.php
+++ b/core/modules/filter/lib/Drupal/filter/Tests/FilterUnitTest.php
@@ -479,7 +479,7 @@ function testUrlFilter() {
       ),
       // Absolute URL protocols.
       // The list to test is found in the beginning of _filter_url() at
-      // $protocols = variable_get('filter_allowed_protocols'... (approx line 1325).
+      // $protocols = config('system.filter')->get('protocols')... (approx line 1555).
       '
 https://example.com,
 ftp://ftp.example.com,
diff --git a/core/modules/system/config/system.filter.yml b/core/modules/system/config/system.filter.yml
new file mode 100644
index 0000000..3bfbd9a
--- /dev/null
+++ b/core/modules/system/config/system.filter.yml
@@ -0,0 +1,13 @@
+protocols:
+  - http
+  - https
+  - ftp
+  - news
+  - nntp
+  - telnet
+  - mailto
+  - irc
+  - ssh
+  - sftp
+  - webcal
+  - rtsp
diff --git a/core/modules/system/lib/Drupal/system/Tests/Upgrade/SystemUpgradePathTest.php b/core/modules/system/lib/Drupal/system/Tests/Upgrade/SystemUpgradePathTest.php
index e3cb1d0..bf8321d 100644
--- a/core/modules/system/lib/Drupal/system/Tests/Upgrade/SystemUpgradePathTest.php
+++ b/core/modules/system/lib/Drupal/system/Tests/Upgrade/SystemUpgradePathTest.php
@@ -79,6 +79,15 @@ public function testVariableUpgrade() {
       'cancel_method' => 'user_cancel_reassign',
     );
 
+    $expected_config['system.filter'] = array(
+      'protocols.0' => 'http',
+      'protocols.1' => 'https',
+    );
+
+    $expected_config['filter.settings'] = array(
+      'fallback_format' => 'pagan_poetry'
+    );
+
     foreach ($expected_config as $file => $values) {
       $config = config($file);
       $this->verbose(print_r($config->get(), TRUE));
diff --git a/core/modules/system/system.install b/core/modules/system/system.install
index 55f20b5..58e3259 100644
--- a/core/modules/system/system.install
+++ b/core/modules/system/system.install
@@ -2209,6 +2209,21 @@ function system_update_8034() {
 }
 
 /**
+ * Moves filter_allowed_protocols variable to config.
+ *
+ * This config is provided now by the system module because it is used by
+ * drupal_strip_dangerous_protocols() and must to be available before the filter
+ * module be installed.
+ *
+ * @ingroup config_upgrade
+ */
+function system_update_8035() {
+  update_variables_to_config('system.filter', array(
+    'filter_allowed_protocols' => 'protocols',
+  ));
+}
+
+/**
  * @} End of "defgroup updates-7.x-to-8.x".
  * The next series of updates should start at 9000.
  */
diff --git a/core/modules/system/tests/upgrade/drupal-7.system.database.php b/core/modules/system/tests/upgrade/drupal-7.system.database.php
index e9f31d3..46cd25c 100644
--- a/core/modules/system/tests/upgrade/drupal-7.system.database.php
+++ b/core/modules/system/tests/upgrade/drupal-7.system.database.php
@@ -94,6 +94,10 @@
 ->values(array(
   'name' => 'user_cancel_method',
   'value' => 's:20:"user_cancel_reassign"',
+  ))
+->values(array(
+  'name' => 'filter_allowed_protocols',
+  'value' => 'a:2:{i:0;s:4:"http";i:1;s:5:"https";}',
 ))
 ->execute();
 
@@ -105,4 +109,8 @@
     ->fields(array('value' => 's:22:"Testing config upgrade";'))
     ->condition('name', 'site_name')
     ->execute();
+db_update('variable')
+  ->fields(array('value' => 's:12:"pagan_poetry";'))
+  ->condition('name', 'filter_fallback_format')
+  ->execute();