Recent changes
35934 changed pages · Atom feed · Recent comments · Recently added · Recent ratings
Wednesday November 04 2026
- ISO/IEC 27001 and an Exponential site (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies with an information security management system based on ISO/IEC 27001 - how a website run with Exponential enters the ISMS scope, which product features provide evidence for typical controls, and what… - Log review routine (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
A weekly and monthly log review routine for the administrators of a public site - which Exponential logs and audit views to read, what to look for, commands to use, and how to record the review as evidence. - Configuration managed by the deployment (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies with change management - how the ManagedByDeployment switch makes the administration unable to change settings, templates, extensions and packages in production, so every change goes through version… - NIS2 and an Exponential site (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For EU public bodies that fall under the NIS2 Directive (EU) 2022/2555 or national cybersecurity rules derived from it - a general framing of how features of Exponential support common risk-management measures (logging… - NIST Cybersecurity Framework and an Exponential site (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies that organize security with the NIST Cybersecurity Framework 2.0 - a general framing of where Exponential's features and the operator's practices fit under the six functions Govern, Identify, Protect… - Mapping OWASP ASVS to Exponential (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies whose security requirements reference the OWASP Application Security Verification Standard - the ASVS 4.0.3 chapters the project maps controls to, the status Unverified, the one known level 1 gap… - Mapping the OWASP Top 10 to Exponential (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
A category-by-category view of the OWASP Top 10 (2021) for public bodies - the mitigations Exponential ships, the operator's part, and the evidence to show an auditor, based on the project's security statement. - Password policy (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies that must set a password policy - Exponential's password settings (minimum length, weak password check, composition rules, reset link lifetime, change notification), the shipped defaults, and a… - Patching cadence (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies that must keep systems patched - how Exponential releases and supports versions, what to watch (kernel, extensions, Composer dependencies, PHP, database, engine), a practical update routine with test… - Penetration tests of an Exponential site (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies commissioning a security test of their site - scope, rules of engagement, what to give testers (versions, siteaccesses, test accounts per role, known gaps), how to prepare the installation, and how to… - Proxies and trusted headers (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public sites behind load balancers, CDNs or TLS terminators - why forwarded headers must only be trusted from your own proxies, Exponential's TrustedProxies setting and reading from the right, Velocity's own list… - Request logs and the security log (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For administrators of public sites - what Exponential writes to 404.log and security.log (probes, traversal, injection, scanners, 404 bursts), how addresses and query values are masked, how long the logs are kept, and… - request-shield in front of a public site (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies whose sites face constant scanning - what request-shield is (a separate MIT-licensed PHP firewall by the CJW Network, not part of Exponential's composer.json), how it complements the kernel's request… - Roles and least privilege (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies that must apply least privilege to website staff - how Exponential's roles, policies and limitations work, which policies are security-sensitive, a sample role design for a public body, leavers, and… - Secrets in settings/override (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For administrators and hosting teams of public sites - which files in settings/override hold secrets (database password, audit keys, mail preference secret, Velocity token, 2FA encryption key), what happens if they are… - Security headers (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For administrators of public sites - the five security headers Exponential sends on every page by default, how to check them, how to change one safely, and how Velocity, Apache and nginx handle static files. - Exponential's security posture at a glance (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies assessing Exponential - the project's own status against the OWASP Top 10, OWASP ASVS, Content Security Policy, the OWASP cheat sheets and coordinated disclosure, what is on by default, what is off by… - Separating the administration (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies that want the editing interface out of the public's reach - giving the administration siteaccess its own host, restricting it by network, VPN or a second authentication, request rules for system URLs… - Two-step sign-in for public staff (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies that require multi-factor authentication - how Exponential's two-step sign-in works (authenticator app or e-mail code, extension sevenx_authentication_2fa), how to turn it on and require it, how to… - Vulnerability disclosure (Updated, Markdown page)
Markdown documentation (help center) · Public sector · Changed 01:08 pm
For public bodies - how the Exponential project receives and fixes vulnerability reports (SECURITY.md, private e-mail or GitHub advisory, supported versions, immutable releases), and how to set up your own disclosure…
