Specification: security defaults of September 2026 #

Between 22 and 30 September 2026 a set of defaults changed so that a default installation is safe without extra work. This page lists each default, the setting that controls it, what changed for an existing installation and how to check it. Read it before you upgrade an installation with its own .htaccess, a caching proxy, or scripts that read the session cookie; the upgrade checklist at the end is the short version. Input handling of individual datatypes is in Datatype and input hardening.

Settings at a glance #

The three [Session] keys are commented out in the shipped settings/site.ini; the defaults above apply while they are unset.

1. Security headers on every page #

Before 27 September a default installation answered every page, the administration included, with no X-Content-Type-Options, no framing restriction, no Referrer-Policy and no Permissions-Policy, on Apache and on Velocity alike. The administration could be framed by any site (clickjacking on the publish and delete buttons) and uploaded files could be sniffed into another type by the browser.

settings/site.ini [HTTPHeaderSettings]:

• An empty value drops a header. HeaderList overrides per path still win. Names and values that could split the response are ignored.
• To allow a trusted editor host to frame the admin, override the policy: SecurityHeaders[Content-Security-Policy]=frame-ancestors 'self' https://edit.example.com.
• Turn HSTS on only when the whole site is HTTPS-only: SecurityHeaders[Strict-Transport-Security]=max-age=31536000.
• Pages answered from the HTTP cache carry the same headers. The cache stores the configured headers with each page; the key carries the scheme so a header meant for HTTPS never reaches an HTTP answer.
• Velocity sends the same headers on static files, its own error pages, redirects and 304 answers ([ServerSettings] ResponseHeaders[]) and on the answers of the three front controllers (ResponseHeadersOnScripts=enabled, only where the script sent none), plus Strict-Transport-Security on every HTTPS answer ([HTTPSSettings] HSTSMaxAge=300, HSTSIncludeSubDomains, HSTSPreload; HSTSMaxAge=0 writes nothing). Needs the engine release that reads Q.webserver.headers, headersOnScripts and hsts; an older one ignores them.

Check:

curl -sI https://example.com/ | grep -i -E 'x-content-type|x-frame|referrer|permissions|content-security'

2. The session cookie #

The session cookie is the login, yet it went out without HttpOnly, SameSite or Secure unless the site had set them, which a default installation never did. A script injected into any page could read the admin session; a forged cross-site form carried it along; over HTTPS it was still offered to plain HTTP.

settings/site.ini [Session]:

setCookieParams() uses the array form of session_set_cookie_params(); Velocity's session layer already honours it, so both servers send the same cookie. Explicit settings still win. If an integration needs cross-site cookies, set CookieSameSite=None and CookieSecure=true.

3. Login and account recovery #

4. Files the web server serves #

.htaccess_root and .htaccess_root_static (and Velocity, which uses the same list for every engine) changed so that Apache and Velocity serve rule for rule the same files:

• A .php, .phtml or .phar file below the document root answers 404, so only the front controllers at the root run. Before, any .php in the package store (56 in the demo packages), in an extension or under var/ was executed when its path was asked for.
• Only the preview images (png, jpg, gif, webp) of imported packages are served from var/storage/packages. Before, package XML, SQL, templates and settings were readable. SVG is left out on purpose because it can carry script.
• A dot file or dot directory (.git, .env, .htaccess) answers 404 wherever it lies; .well-known stays reachable.
• The site's own references are served: the service worker /index.js (and /sw.js, its former name, kept for browsers registered before the rename of 30 September), the vendor and media folders of an extension's design (the layout editor's scripts and fonts) and the image files among the stored originals (so SVG images are shown). Other originals stay behind content/download.
• Fonts of an extension's design are no longer refused by the shipped rules.
• Velocity serves from var/ only image files below storage/original/image (png, jpeg, gif, webp, svg) and only the previews from the package store. Before, every file below var/*/storage/original/image and the whole package store were handed out.

Upgrade note: if you maintain your own copy of .htaccess, merge these rules. The shipped example is doc/eng-us/examples/ and the root files .htaccess_root and .htaccess_root_static.

5. Caching and personal pages #

• A page that carries a form token (csrf-token meta tag, hidden field in every POST form) is sent Cache-Control: private, no-cache, must-revalidate. Before, no-cache only asked for revalidation, and a shared cache that did not know the session cookie could store the signed-in page with its token and hand it to every anonymous visitor.
• Velocity tells its response cache which cookies mean "personal": the session cookie as the handler names it (session.name for the default handler, [Session] SessionNamePrefix as a prefix for custom) plus is_logged_in. An explicit list replaces the derived one: SkipCookies[] in velocity.ini [CacheSettings] (the former [ServerSettings] CacheSkipCookies still works; a value in [CacheSettings] wins; default empty = derive the list). Before, an installation on the default handler (PHPSESSID) got a skip list of eZSESSID and never matched its own cookie, so with the response cache on, a signed-in request could be answered from the cache.
• Purge tags are no longer public. Every response of a cached siteaccess used to carry the page's purge tags twice (xkey and Surrogate-Key), naming its nodes, objects and layouts. httpcache.ini [HttpCacheSettings] TagHeader replaces ProxyHeaders; the default disabled sends none. Set it to the one header your purging proxy reads (xkey for Varnish, Surrogate-Key for Fastly, Cache-Tag for Cloudflare). ProxyHeaders=enabled in an existing override still means xkey. A name that is not an HTTP token or is a framing header is refused. See HTTP cache.

6. Other fixes with a security effect #

Upgrade checklist #

1. Compare your .htaccess with .htaccess_root and merge the new rules.
2. Look at your pages' response headers (command above) and decide whether you need to relax Content-Security-Policy for a trusted editor host.
3. If a proxy in front of the site purged by xkey or Surrogate-Key, set [HttpCacheSettings] TagHeader in settings/override/httpcache.ini.append.php.
4. If a script of yours depended on a non-HttpOnly or cross-site session cookie, set [Session] CookieHttponly or CookieSameSite explicitly.
5. Change the static cache user agent in any web server rule that matched the old name.
6. Clear caches after the changes: php bin/php/ezcache.php --clear-all --allow-root-user.

Related pages #

• Specifications: Datatype and input hardening, Security hardening of August 2026 (the earlier patch set), Security hardening 6.0.13, Velocity HTTP/2 and security
• Upgrade notes: Hardening guide, HTTP cache, Behaviour changes, 16 to 30 September 2026, RAD tools — security
• Features: Velocity, Form expired page, Installing in one command
• Changelog 6.0.15, chronicles 16 to 30 September 2026 and February 2026