Recent changes
Wednesday November 04 2026
-
Keep trash items for 90 days Updated Markdown page
Step by step - empty Exponential's trash on a schedule while keeping each item for a set number of days, with content.ini [TrashSettings] KeepItemsForDays and the trashpurge cronjob part (in no part by default), and…
-
List known vulnerabilities with composer audit Updated Markdown page
Step by step - check the Composer dependencies locked for your Exponential installation against known vulnerability advisories with composer audit and see newer releases with composer outdated, because the project's CI…
-
Lock settings with ManagedByDeployment Updated Markdown page
Step by step - switch on ManagedByDeployment for the production administration siteaccess so the web interface cannot change settings, templates, extensions or packages, after moving those settings into version control…
-
Make the audit stricter for privacy Updated Markdown page
Step by step - apply the audit guide's strict-privacy profile (hashed logins and addresses, no user agents, keys-only before and after values, 30 days to pseudonymization, shorter retention) where your data protection…
-
Publish an accessibility statement page Updated Markdown page
Step by step - publish your accessibility statement as a page of your Exponential site (no template ships), with a stable address such as /accessibility, a link in every footer, a feedback route, and versions kept for…
-
Raise the version limit for notices Updated Markdown page
Step by step - keep more versions of official notices than Exponential's default 45 per object by setting VersionHistoryClass for that class, so earlier published wordings are not removed when new versions are published.
-
Record who published content Updated Markdown page
Step by step - switch on the audit events content.object.create and content.object.publish, which Exponential leaves off by default, so the audit trail answers "who published this, and when?", and check that publishing…
-
Require alternative text on an image field Updated Markdown page
Step by step - switch on the class attribute option "Alternative text is required" (Exponential 6.0.15 and later) for the image fields editors use, so an image cannot be stored without alternative text, and check it in…
-
Reset search statistics Updated Markdown page
Step by step - check which siteaccesses record search phrases, use the figures, and remove all recorded phrases with Reset statistics on Setup > Search statistics, because phrases can contain names and case numbers.
-
Restore an archived audit day Updated Markdown page
Step by step - read audit records older than the 90 live days by restoring the archived day with exp:audit restore, check it against its signed manifest, search it, and know what happens to the restored copy.
-
Restore an archived page Updated Markdown page
Step by step - bring a page back from the archive to the current site in Exponential, whichever way it was archived (moved to an archive folder, hidden, set to an archived state, or put into an archive section), and…
-
Restore an item from the trash Updated Markdown page
Step by step - find a removed page in Exponential's trash by who trashed it and when, restore it to its original place (or choose another when the parent is gone), and check what the audit recorded.
-
Restrict debug output Updated Markdown page
Step by step - make sure Exponential's debug output is off in production, and when a live problem needs it, switch it on for your own address only, then remove it again and check that nothing is shown to visitors.
-
Restrict the administration by network Updated Markdown page
Step by step - limit the administration siteaccess of an Exponential site to your office network or VPN with Apache Require ip or nginx allow/deny, after giving it its own host name, and check from outside.
-
Retire the shared admin login Updated Markdown page
Step by step - replace the shared admin account with personal administrator accounts so the audit trail names people, then disable admin (after moving UserCreatorID) or make it unusable, and keep a tested break-glass…
-
Review CSP reports Updated Markdown page
Step by step - collect Content Security Policy violation reports with Exponential's own csp/report collector, read them in Setup > Log files, tell real problems from noise, and decide per source what to fix or allow.
-
Review the audit trail for a user Updated Markdown page
Step by step - see everything one user did (sign-ins, failed sign-ins, content moved, hidden or removed, role and setting changes) in Exponential's Audit console or with exp:audit search, narrow it by time and event…
-
Review the security log Updated Markdown page
Step by step - the weekly read of Exponential's security.log in Setup > Log files - what the request classifier records, which lines need a closer look (injection or traversal with status 200 or 500), and what to do…
-
Roll back the CSP to report-only Updated Markdown page
Step by step - when an enforced Content Security Policy blocks work, return the siteaccess to report-only in minutes, make every process send the new header, and keep collecting reports to fix the cause.
-
Rotate the audit signing key Updated Markdown page
Step by step - replace the key that signs Exponential's audit checkpoints and archive manifests, yearly or at once after a suspected leak, while keeping old keys for old archives, and back up the result.