Recent changes
Wednesday November 04 2026
-
Adding security.txt Updated Markdown page
For public bodies - Exponential ships no security.txt, so this page shows how to write one following RFC 9116, where to put it, the one rewrite rule the shipped Apache rules need so it is served, and how to check it.
-
Audit alerts and their recipients Updated Markdown page
For administrators of public sites - the seven alert rules Exponential ships (brute force, administrator role granted, settings changed out of hours, mass delete, audit switched off, broken chain), who receives the…
-
Audit integrity and verification Updated Markdown page
For public bodies that rely on the audit trail as evidence - how Exponential's hash chains, signed checkpoints and signed archive manifests make tampering visible, how to verify them, what each finding means, and what…
-
The audit trail for public bodies Updated Markdown page
For public bodies that must show who did what in their website - what Exponential's audit trail records by default (and what it does not, such as publishing), where it is kept, who may read it, how long it is kept, and…
-
Backups and recovery Updated Markdown page
For public bodies that must be able to restore their site after ransomware, a failed update or a mistaken deletion - what an Exponential backup contains, how to take a consistent one with maintenance mode, the secrets…
-
Content Security Policy for public sites Updated Markdown page
For public bodies - what Exponential's Content Security Policy does, how it is shipped (report-only on the administration, off on public sites), where violation reports go, and why enforcing it is worth the effort for a…
-
From report-only to an enforced CSP Updated Markdown page
A staged plan for public bodies to move the Content Security Policy of the administration, and later of public siteaccesses, from report-only to enforce - template audit, collecting reports, one siteaccess first…
-
CSRF and form tokens Updated Markdown page
For administrators and developers of public sites - how the ezformtoken extension protects every form against cross-site request forgery, how to check it is active, what custom AJAX code must do, and the form expired…
-
Debug output in production Updated Markdown page
For administrators of public sites - why debug output must stay off in production, Exponential's debug settings and their safe defaults, how to debug a live problem for your own address only and remove it again, and…
-
File consistency check Updated Markdown page
For public bodies that must detect unauthorized changes to their web application - how Exponential's file consistency check compares every file with the release's checksum list, in the admin and on the command line…
-
File permissions and ownership Updated Markdown page
For administrators and hosting teams - the file ownership and permission model that stops a bug in a PHP file from becoming a lasting compromise: one writing user, only var/ and settings/ writable, no world-writable…
-
File uploads and SVG Updated Markdown page
For public bodies whose staff upload images and documents - how Exponential stops uploaded files from running code (no execution below the root, type read from content, SVG sanitizer, downloads through…
-
Forwarding the audit trail to a SIEM Updated Markdown page
For public bodies with a central security operations function - how to send Exponential's audit records to a SIEM or log collector with the syslog sink (UDP, TCP, TLS) and the signed webhook sink, which channels to…
-
Go-live security checklist for public sites Updated Markdown page
A printable security checklist for the launch of a public site on Exponential, built from the project's go-live checklist and hardening guide, with a column for the evidence a public body should file for each item.
-
Hardening an Exponential site for a public body Updated Markdown page
For administrators and hosting teams of public sites - the hardening layers of Exponential in the order to work through them (web server, settings and secrets, administration, sign-in, sessions, headers, CSP, uploads…
-
HTTPS and HSTS Updated Markdown page
For public bodies serving their site only over HTTPS - the steps Exponential's installation guide gives (HTTPS on every name, redirects, Secure cookies, HSTS raised gradually, certificate monitoring), the settings for…
-
Incident response for an Exponential site Updated Markdown page
For public bodies handling a security incident on their site - contain, preserve evidence, investigate with the audit trail and logs, rebuild from known-good sources, recover credentials and sessions, notify, and…
-
ISO/IEC 27001 and an Exponential site Updated Markdown page
For public bodies with an information security management system based on ISO/IEC 27001 - how a website run with Exponential enters the ISMS scope, which product features provide evidence for typical controls, and what…
-
Log review routine Updated Markdown page
A weekly and monthly log review routine for the administrators of a public site - which Exponential logs and audit views to read, what to look for, commands to use, and how to record the review as evidence.
-
Configuration managed by the deployment Updated Markdown page
For public bodies with change management - how the ManagedByDeployment switch makes the administration unable to change settings, templates, extensions and packages in production, so every change goes through version…