Recent changes
Wednesday November 04 2026
-
Government tasks Updated Markdown page
The index of the step-by-step task pages for public bodies - publishing, compliance, sites and languages, operations, people and permissions, procurement and training - and how a task page is built.
-
Compliance tasks Updated Markdown page
Step-by-step compliance tasks for public bodies running Exponential - passwords and sessions, Content Security Policy and headers, the audit trail, privacy requests, logs and operations hygiene, accessibility, and…
-
Add HSTS Updated Markdown page
Step by step - turn on HTTP Strict Transport Security for a site that is fully HTTPS, with Exponential's SecurityHeaders setting (Apache, nginx) or Velocity's HSTSMaxAge, starting short and raising the value in stages.
-
Add a security.txt file Updated Markdown page
Step by step - publish /.well-known/security.txt (RFC 9116) for your site, which Exponential does not ship, add the one rewrite rule the shipped Apache rules need to serve it, and check it with curl.
-
Add your own words to the weak password list Updated Markdown page
Step by step - make Exponential refuse passwords built from your organization's own words (its name, the site, the city) on top of the shipped list of well-known passwords, with WeakPasswordList[] or WeakPasswordFile.
-
Answer an access request for mail preferences Updated Markdown page
Step by step - give a person their e-mail preferences and full consent history from Exponential as JSON or CSV, from the administration or the console, check the file and hand it over safely.
-
Archive last year's notices Updated Markdown page
Step by step - at the start of a year, move last year's notices into a year folder under an archive, so current lists stay short while the old notices keep their content, versions and redirecting addresses, and record…
-
Bring back an earlier version of a page Updated Markdown page
Step by step - restore the earlier wording of a page from Exponential's versions page by comparing versions and making a new draft from the old one, then publishing it, so the history keeps both the mistake and the…
-
Check alternative text across images Updated Markdown page
Step by step - find images without alternative text on a public site: with the optional Exponential Intelligence report "Missing alt text" where that extension is active, or with an accessibility checker on page samples…
-
Check that form tokens are active Updated Markdown page
Step by step - confirm that the ezformtoken extension protecting every Exponential form against cross-site request forgery is active on all siteaccesses, and what to do if it is missing.
-
Check the security headers Updated Markdown page
Step by step - check from outside that every Exponential siteaccess sends the expected security headers and cookie flags, that internal files are not served, and record the result as evidence for an audit.
-
Erase a user account Updated Markdown page
Step by step - remove a user account for good after an erasure decision, knowing that users never go to the trash, that removal erases the account's mail preferences and anonymizes its consent log, and what to remove by…
-
Erase mail data for an address Updated Markdown page
Step by step - erase the mail preferences and pending confirmations of an e-mail address and anonymize its consent log with exp:mail:preferences erase, for subscribers without an account, and decide whether to add a…
-
Export and remove form submissions Updated Markdown page
Step by step - the periodic retention routine for web form submissions in Exponential: export what must be kept to your case or records system as CSV, then remove the collections on Setup > Collected information, and…
-
Export audit records about a person Updated Markdown page
Step by step - for an access request, export every audit record made by or about one user (pseudonymized ones included) with exp:audit export --subject-user, review it for other people's data, and hand it over.
-
Export audit records for an investigation Updated Markdown page
Step by step - select the audit records an investigation needs, verify the chains, export them as a signed bundle or JSON lines with their sha256, and document the hand-over so the export can serve as evidence.
-
Extend audit retention Updated Markdown page
Step by step - keep Exponential's audit archives longer than the shipped 730 days when your records schedule requires it, per channel, with an archive directory on write-once storage, and check the result.
-
Forward the audit trail to syslog Updated Markdown page
Step by step - send Exponential's audit records to your central log collector or SIEM over TLS with the syslog sink, choose the channels, test delivery with exp:audit sinks test, and keep it running.
-
Hide notices automatically on a date Updated Markdown page
Step by step - let editors give each notice a hide date and have Exponential's hide.php cronjob hide it when the date has passed, by adding a date attribute to the class and configuring content.ini [HideSettings].
-
Keep editors on the admin4 design Updated Markdown page
Step by step - make admin4, the administration design Exponential tests against WCAG 2.2 AA, the design of the administration siteaccess, and limit the per-session design switch so staff with disabilities stay in the…