- Security responsibilities of partners What partners are responsible for in the security of the sites they build and host - secure defaults, hardening, updates, credentials, private disclosure, incidents, and a security checklist per site.
- Backups and restores Back up a site so you can really restore it - what to back up (database, storage, settings), the commands per database engine, maintenance mode for consistency, a restore procedure and a restore test.
- Fetch functions: how they work What happens when a template calls fetch() - eZFunctionHandler, eZModuleFunctionInfo, the module's function_definition.php and its function collection class - the definition format, results and errors, the module…
- Licensing for partners: GPL code, GFDL documentation What the licenses of Exponential mean for partners' business - the GPL v2 or later for code, the GFDL 1.3 or later for documentation, CC BY-SA for the program text - what partners may do, what they must do when…
- Publishing workflow for apps The landing page of the publishing workflow pages for app developers - how editors' drafts, versions and publishing relate to what an app sees, previewing app screens before publishing, the user accounts and roles an…
- Search results template Styling the site search: the content/search.tpl template and the variables it uses, the search fetch, results drawn with a search view, the navigator with the search text in its links, an accessible search form, no…
- Security engineering overview The security model of Exponential for engineers - access control through policies, output escaping, safe SQL, CSRF tokens, the secure defaults of 2026, the HTTP security layer, authentication and two-factor sign-in, the…
- Drafts, preview and publishing How drafts and versions of Exponential content relate to an app - REST reads only published content, reading drafts and versions through the expversion services with versionread rights, building an editor preview for…
- HTTP security: headers, CSP, request rules and proxies The HTTP security layer of Exponential - security headers from SecurityHeaders[], the Content Security Policy with modes, directives, nonces and reports, request rules that allow, deny, redirect or log after URL…
- Layout types and zones The layout types defined in explayouts.ini (1 to 4 columns, hero, sidebars, featured, mosaic, header/main/footer, admin types), their zones, the template that draws each grid, and how to add a layout type of your own.
- Protecting customer data How partners protect personal data of their customers and their customers' users in every part of the partnership - support tickets, bug reports, activity logs, leads, case studies, staging copies and training - with…
- Updates and upgrades for site owners Keep Exponential, its extensions and PHP up to date - how versions work, reading the changelog and BC notes, updating with Composer and Git, the database update, testing on a copy, and the upgrade check afterwards.
- User and login templates Styling the sign-in, registration, password and profile pages of the user module: the templates in user/, the field names the module reads, autocomplete and accessibility, the signed-in state in the pagelayout, and…
- Authentication, sessions and two-factor sign-in How users and machines authenticate to Exponential - password storage and policy, the list of well-known passwords, lockout, session handlers and cookies, two-factor sign-in with sevenx_authentication_2fa, OAuth 2.0 and…
- Block definitions How a block type is defined in explayouts.ini (Name, Handler, ViewTypes, IsContainer, Placeholders, HasCollection, Category), the shipped blocks by category, and adding a view type or a new block to a design.
- Forms in templates Forms on a public site built from content: information collection (feedback and contact forms) with ActionCollectInformation, the collect templates, validation messages, the result page and mail templates, the form…
- Maintenance mode during changes Take a site offline for upgrades, imports and restores - Setup > Maintenance or maintenance.php, the message and expected end, who still gets in, what visitors and search engines get, and the way back in.
- Partner FAQ Short answers to the questions people ask most about the Exponential Partner Program - who runs it, costs, levels, how to apply, renewals, the Foundation's role, licensing, logos, support and what is still open - each…
- Permissions for app users Set up the user accounts and roles an app runs as - integration users, read roles limited by section or subtree, write roles limited to one folder and class, the policies OAuth and API keys need, checking a user's…
- Edit, remove and create buttons on the site Buttons on public pages that open the edit form, remove an item or create a new one below it - the content/action form fields they post, the permission checks that decide when to show them, and where the user lands…
Documentation license
This documentation is free documentation, licensed under the GNU Free Documentation License 1.3 or later.
Exponential Copyright © 1998-2026 Exponential Foundation and 7x