Advanced Search
Search Results
176 total results found
Remediation Steps
Follow the steps below to remediate this finding on Joomla. Review Joomla's Redirect Manager (Components > Redirect) and ensure no sensitive GET parameters are preserved in destination URLs.In custom components, always call $app->redirect($url); followed by ex...
Remediation Steps
Follow the steps below to remediate this finding on Drupal. Audit any custom redirect logic in hook_form_submit or EventSubscriber implementations.Use the Drupal redirect service:$response = new \Symfony\Component\HttpFoundation\RedirectResponse($url); $respon...
Remediation Steps
Follow the steps below to remediate this finding on Microsoft IIS webserver. Open IIS Manager and select the site or virtual directory.Double-click Directory Browsing in the Features pane.In the Actions pane on the right, click Disable.Alternatively, in web.co...
Remediation Steps
Follow the steps below to remediate this finding on Nginx webserver. Ensure the autoindex directive is disabled (it is off by default).In your server or location block, explicitly set:autoindex off;Reload Nginx:sudo systemctl reload nginx
Remediation Steps
Follow the steps below to remediate this finding on Apache webserver. Remove the Indexes option from the Directory directive in your Apache configuration:<Directory /var/www/html> Options -Indexes </Directory>Alternatively, add the following to your .htaccess ...
Remediation Steps
Follow the steps below to remediate this finding on Plesk. Log in to Plesk.Go to Domains > your domain > Apache & nginx Settings.Under "Additional Apache directives", add:Options -IndexesClick Apply.
Remediation Steps
Follow the steps below to remediate this finding on Microsoft IIS webserver. Open IIS Manager.Select your website.Double-click HTTP Response Headers.Click Add in the Actions pane and enter:NAME: Content-Security-PolicyVALUE: default-src 'self'; script-src 'sel...
Remediation Steps
Follow the steps below to remediate this finding on Nginx webserver. In your nginx.conf server block, add:add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;Reload Nginx:sudo systemctl reload nginxNote: Start ...
Remediation Steps
Follow the steps below to remediate this finding on Apache webserver. Ensure mod_headers is enabled:sudo a2enmod headersAdd to your apache2.conf or VirtualHost configuration:Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; obje...
Remediation Steps
Follow the steps below to remediate this finding on Plesk. Log in to the Plesk control panel.Navigate to Domains > your domain > Apache & nginx Settings.Under "Additional nginx directives", add:add_header Content-Security-Policy "default-src 'self'; script-src...
Remediation Steps
Follow the steps below to remediate this finding on WordPress. Add the following to your theme's functions.php file:add_action('send_headers', function() { header("Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; object-src 'none...
Remediation Steps
Follow the steps below to remediate this finding on Joomla. Edit the .htaccess file in the Joomla root directory and add:<IfModule mod_headers.c> Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; object-src 'none...
Remediation Steps
Follow the steps below to remediate this finding on Drupal. Install and enable the Security Kit (SecKit) module:composer require drupal/seckit drush en seckitNavigate to Admin > Configuration > System > Security Kit.Under the "Content Security Policy" section,...
Remediation Steps
Follow the steps below to remediate this finding on Microsoft IIS webserver. In web.config, use URL Rewrite to append SameSite=Lax or SameSite=Strict to Set-Cookie headers:<rewrite> <outboundRules> <rule name="Add SameSite" preCondition="No SameSite"> <match s...
Remediation Steps
Follow the steps below to remediate this finding on Nginx webserver. Use the proxy_cookie_flags directive (nginx >= 1.19.3):proxy_cookie_flags ~ SameSite=Lax;For older versions, use the lua-nginx-module or configure the application itself to set the correct Sa...
Remediation Steps
Follow the steps below to remediate this finding on Apache webserver. Ensure mod_headers is enabled:sudo a2enmod headersAdd to your VirtualHost or .htaccess:Header always edit Set-Cookie (.*) "$1; SameSite=Lax"Reload Apache:sudo systemctl reload apache2
Remediation Steps
Follow the steps below to remediate this finding on Plesk. Log in to the Plesk control panel.Navigate to Domains > your domain > Apache & nginx Settings.Under "Additional Apache directives", add:Header always edit Set-Cookie (.*) "$1; SameSite=Lax"Click Apply.
Remediation Steps
Follow the steps below to remediate this finding on WordPress. Add the following to wp-config.php to set SameSite=Lax on the WordPress session cookie:@ini_set('session.cookie_samesite', 'Lax');For the auth cookies, add to functions.php:add_filter('set_auth_coo...