Recent changes
35934 changed pages · Atom feed · Recent comments · Recently added · Recent ratings
Wednesday November 04 2026
- Making the site friendly to web archiving (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies whose sites are harvested by a national or institutional web archive - Exponential's shipped robots.txt and what to change in it, sitemaps from bcgooglesitemaps or xrowmetadata, stable URLs… - Security for public bodies (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
The security section of the Governments help - Exponential's documented security posture (OWASP Top 10, ASVS, CSP), hardening, the audit trail, two-step sign-in, CSP enforcement, request-shield, passwords and sessions… - Account lockout (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For administrators of public sites - Exponential's account lockout after failed sign-ins is off by default; how to enable it, how to keep your own network out of it, the trade-off with deliberate lockouts, and how to… - Adding security.txt (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies - Exponential ships no security.txt, so this page shows how to write one following RFC 9116, where to put it, the one rewrite rule the shipped Apache rules need so it is served, and how to check it. - Audit alerts and their recipients (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For administrators of public sites - the seven alert rules Exponential ships (brute force, administrator role granted, settings changed out of hours, mass delete, audit switched off, broken chain), who receives the… - Audit integrity and verification (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies that rely on the audit trail as evidence - how Exponential's hash chains, signed checkpoints and signed archive manifests make tampering visible, how to verify them, what each finding means, and what… - The audit trail for public bodies (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies that must show who did what in their website - what Exponential's audit trail records by default (and what it does not, such as publishing), where it is kept, who may read it, how long it is kept, and… - Backups and recovery (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies that must be able to restore their site after ransomware, a failed update or a mistaken deletion - what an Exponential backup contains, how to take a consistent one with maintenance mode, the secrets… - Content Security Policy for public sites (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies - what Exponential's Content Security Policy does, how it is shipped (report-only on the administration, off on public sites), where violation reports go, and why enforcing it is worth the effort for a… - From report-only to an enforced CSP (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
A staged plan for public bodies to move the Content Security Policy of the administration, and later of public siteaccesses, from report-only to enforce - template audit, collecting reports, one siteaccess first… - CSRF and form tokens (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For administrators and developers of public sites - how the ezformtoken extension protects every form against cross-site request forgery, how to check it is active, what custom AJAX code must do, and the form expired… - Debug output in production (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For administrators of public sites - why debug output must stay off in production, Exponential's debug settings and their safe defaults, how to debug a live problem for your own address only and remove it again, and… - File consistency check (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies that must detect unauthorized changes to their web application - how Exponential's file consistency check compares every file with the release's checksum list, in the admin and on the command line… - File permissions and ownership (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For administrators and hosting teams - the file ownership and permission model that stops a bug in a PHP file from becoming a lasting compromise: one writing user, only var/ and settings/ writable, no world-writable… - File uploads and SVG (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies whose staff upload images and documents - how Exponential stops uploaded files from running code (no execution below the root, type read from content, SVG sanitizer, downloads through… - Forwarding the audit trail to a SIEM (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies with a central security operations function - how to send Exponential's audit records to a SIEM or log collector with the syslog sink (UDP, TCP, TLS) and the signed webhook sink, which channels to… - Go-live security checklist for public sites (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
A printable security checklist for the launch of a public site on Exponential, built from the project's go-live checklist and hardening guide, with a column for the evidence a public body should file for each item. - Hardening an Exponential site for a public body (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For administrators and hosting teams of public sites - the hardening layers of Exponential in the order to work through them (web server, settings and secrets, administration, sign-in, sessions, headers, CSP, uploads… - HTTPS and HSTS (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies serving their site only over HTTPS - the steps Exponential's installation guide gives (HTTPS on every name, redirects, Secure cookies, HSTS raised gradually, certificate monitoring), the settings for… - Incident response for an Exponential site (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies handling a security incident on their site - contain, preserve evidence, investigate with the audit trail and logs, rebuild from known-good sources, recover credentials and sessions, notify, and…
