Recent changes
Wednesday November 04 2026
-
Route audit alerts to a security mailbox Updated Markdown page
Step by step - send Exponential's audit alerts (brute force, administrator role granted, mass delete, audit switched off, broken chain) to your security team's mailbox instead of the site's AdminEmail, and check the…
-
Run an accessibility spot check of a page Updated Markdown page
Step by step - a 15-minute accessibility check of one public page (automated check with an axe-based browser tool, keyboard pass, zoom, a quick screen reader pass, content review), and how to record and route findings…
-
Run the file consistency check Updated Markdown page
Step by step - compare every file of the installation with the release's checksum list in Setup > Upgrade check or on the command line, read the findings, and file the result after updates and incidents.
-
Separate session cookies for the administration Updated Markdown page
Step by step - give every siteaccess its own session cookie in Exponential (SessionNameHandler=custom), so a sign-in on the public site is not a sign-in in the administration, and check the result.
-
Set log retention Updated Markdown page
Step by step - give Exponential's kernel logs an age limit with MaxAgeDays per log (404, security and CSP have one already), schedule pruning with the logs cronjob part, and check with a dry run.
-
Set the minimum password length to 12 Updated Markdown page
Step by step - raise Exponential's minimum password length from the shipped 10 to 12 (the OWASP ASVS 4.0.3 level 1 value) or more, without locking anyone out, and check that new passwords follow it.
-
Set the sender details in the mail footer Updated Markdown page
Step by step - fill in the organization name, postal address and privacy notice link that Exponential's mail gate adds to every optional mail (they ship empty), and check them on the status page and in a test mail.
-
Sign out every session of a user Updated Markdown page
Step by step - after a suspected account takeover or a lost device, end every session of one user in Exponential by changing the password (EndOtherSessions), disabling the account, or removing sessions under Setup >…
-
Start CSP reporting on a public site Updated Markdown page
Step by step - public siteaccesses get no Content Security Policy by default; switch one to report-only with Exponential's own report collector, so you learn what your design, content and embeds would need before…
-
Stop all optional mail to an address Updated Markdown page
Step by step - honor a "stop writing to me" request in Exponential with a suppression list entry (reason legal), which blocks every optional mail and confirmation to that address while storing only a hash, and check it.
-
Switch the administration's CSP to enforce Updated Markdown page
Step by step - after the template audit and a period of clean reports, change the Content Security Policy of the administration siteaccess from report-only to enforce, deploy it to every process, and check the header.
-
Verify the audit trail Updated Markdown page
Step by step - check that no audit record was changed, removed or inserted with exp:audit verify or Verify now, add the check to monitoring by its exit code, and know what to do when a channel is broken.
-
Operations tasks Updated Markdown page
Index of step-by-step operations tasks for a public-sector Exponential site - maintenance windows, backups and restores, caches, cronjobs, logs, the audit trail, upgrade checks, deploys, certificates, databases…
-
Add a read replica Updated Markdown page
Step by step - send read queries of a MySQL or MariaDB site to one or more replicas with UseSlaveServer, after the database team has set up replication, and check the effect; with the limits (MySQL and MariaDB only…
-
Back up a SQLite site safely Updated Markdown page
Step by step - back up an Exponential site that runs on SQLite 3 without stopping it, with the sqlite3 .backup command instead of a file copy, and schedule it.
-
Bring the site back online Updated Markdown page
Step by step - end a maintenance window safely - check the site from an allowed address, switch maintenance off, clear the caches in front of the site, check every server answers 200, resume cronjobs and record the…
-
Check file and directory permissions Updated Markdown page
Step by step - check that only var/ (and, where needed, settings/) is writable by the site's PHP, that every process writing var/ uses the same owner, and that new files are not world-readable, with the hardened modes…
-
Check log health Updated Markdown page
Step by step - read Setup > Log files > Log health for disk use against the budget, fast-growing logs, logs over their limit, logs the web server cannot write, and the rotation settings in effect, and act on each.
-
Check PHP extensions before an upgrade Updated Markdown page
Step by step - before a PHP or Exponential upgrade, list the PHP extensions the installation wants and which are missing on the target machine with exp:velocity ext check, compare with System information, and clear the…
-
Check security headers Updated Markdown page
Step by step - verify that every page of a public website carries the five security headers Exponential sends by default, that dot files and PHP files below the root answer 404, and that the session cookie has the right…