Security checklist #

This checklist is for the security officer and site administrator of a public body. It follows Security standards, Security hardening and 13. Security hardening for production. Items marked "default" name a setting that ships off or open and that you decide on.

Contents #

1. Accounts and sign-in
2. Configuration
3. Headers and Content Security Policy
4. Logging and audit
5. Updates
6. The server and in front of it
7. Reporting

Accounts and sign-in #

• To do: No shared accounts; every administrator is a named person.
• To do: Two-step sign-in for administrators: opt-in through sevenx_authentication_2fa (Two-step sign-in).
• To do: Default: account lockout is off ([UserSettings] MaxNumberOfFailedLogin=0); decide to set it, or rate-limit in front of the site (Security standards).
• To do: Default: minimum password length is 10; OWASP ASVS level 1 asks 12 (MinPasswordLength) (Security standards).
• To do: The initial administrator password changed (Change the admin password).
• To do: Roles follow least privilege (Roles and policies); the Quarterly access review is scheduled.

Configuration #

• To do: Debug output limited to listed addresses (13. Security hardening).
• To do: Settings, templates and packages locked in production with ManagedByDeployment where your process allows (Configuration managed by the deployment).
• To do: Setup > Upgrade check shows no unexpected changed files (The upgrade check).
• To do: Third-party extensions active only when needed and named in the privacy notice (Privacy standards).
• To do: Allowed redirect hosts set (Safe redirects).

Headers and Content Security Policy #

• To do: Security headers on (default on): X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy (Security standards).
• To do: Default: HSTS empty; set it when the whole site is HTTPS.
• To do: Default: CSP report-only on the administration and off on sites; review var/log/csp.log and decide on enforcement per siteaccess (Content Security Policy).

Logging and audit #

• To do: Audit trail on (default on) and chains intact: ./console exp:audit status and ./console exp:audit verify (Security and audit).
• To do: Alert recipients set: ./console exp:audit alerts recipients.
• To do: Audit signing keys in settings/override/audit.ini.append.php included in backups (Backups: what to back up).
• To do: var/log/security.log reviewed (Request logs).

Updates #

• To do: A named person watches releases; fixes come only as the next release (SECURITY.md; Security updates and patching cadence).
• To do: Composer dependencies checked with composer audit, which the project does not run in CI (Security standards).
• To do: PHP and the operating system receive security updates (PHP and platform support).

The server and in front of it #

• To do: HTTPS with a valid certificate (TLS and HTTPS).
• To do: The administration restricted by network where possible (Restricting the administration).
• To do: A request filter such as request-shield in front (Security hardening).
• To do: File permissions as documented (Writable directories and permissions).

Reporting #

• To do: Your site tells visitors where to report a security problem; Exponential ships no security.txt (RFC 9116).
• To do: Software issues go privately to the project as SECURITY.md says, without personal data.
• To do: Incident procedure ready (Incident readiness).

Related pages #

• Government checklists
• Security standards
• Security review (for hosts)
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.