Advanced Search
Search Results
176 total results found
Remediation Steps
Follow the steps below to remediate this finding on Joomla. In your Joomla configuration.php, set:public $cookie_domain = '';For Joomla 4+, edit libraries/src/Application/WebApplication.php or use the session configuration in Global Configuration > System > Se...
Remediation Steps
Follow the steps below to remediate this finding on Drupal. In settings.php, configure the session cookie:ini_set('session.cookie_samesite', 'Lax');For Drupal 9+, add to settings.php:$settings['session_handler_class'] = '\Drupal\Core\Session\SessionHandler';Sa...
Remediation Steps
Follow the steps below to remediate this finding on Generic / Developer guidance. Only load JavaScript from origins you control or that you explicitly trust.Audit all <script src="..."> tags and JavaScript includes and replace any unnecessary third-party sourc...
Remediation Steps
Follow the steps below to remediate this finding on WordPress. Audit scripts enqueued via wp_enqueue_script() and remove or replace third-party CDN sources with self-hosted copies where possible.For remaining CDN scripts, add SRI hashes via the script_loader_t...
Remediation Steps
Follow the steps below to remediate this finding on Joomla. Audit scripts loaded in your template's index.php and component views.Replace remote CDN references with locally hosted copies where possible.For third-party scripts, add integrity and crossorigin att...
Remediation Steps
Follow the steps below to remediate this finding on Drupal. Audit libraries defined in *.libraries.yml files for external URLs.Replace CDN sources with local files where possible:my_library:js:/libraries/mylib/lib.min.js: {}For external sources that must remai...
Remediation Steps
Follow the steps below to remediate this finding on Generic / Developer guidance. DOM-based XSS occurs when JavaScript reads untrusted data (URL fragments, query strings, localStorage) and writes it to the DOM without sanitisation.Remediation steps:Never pass ...
Remediation Steps
Follow the steps below to remediate this finding on WordPress. Audit custom JavaScript files in your theme and plugins for unsafe DOM writes.Use wp_localize_script() to safely pass server-side data to scripts instead of embedding raw data in HTML.Escape values...
Remediation Steps
Follow the steps below to remediate this finding on Joomla. Review template JavaScript files and Joomla component JS for unsafe DOM manipulation.Use JUri to construct URLs safely server-side rather than building them from raw user input in JavaScript.Sanitise ...
Remediation Steps
Follow the steps below to remediate this finding on Drupal. Audit custom module JavaScript files for unsafe DOM writes.Use Drupal.behaviors to attach JS safely.Pass server-side data to JavaScript via drupalSettings (set in PHP with #attached['drupalSettings'])...
Remediation Steps
Follow the steps below to remediate this finding on Generic / Developer guidance. Reflected XSS occurs when user-supplied input is echoed back in the HTTP response without proper encoding.Remediation steps:Validate all input against an allowlist of expected ch...
Remediation Steps
Follow the steps below to remediate this finding on WordPress. Use WordPress escaping functions before outputting any dynamic data:esc_html() — for HTML contentesc_attr() — for HTML attributesesc_url() — for URLsesc_js() — for inline JavaScriptwp_kses() / wp_k...
Remediation Steps
Follow the steps below to remediate this finding on Joomla. Use Joomla's JFilterInput or InputFilter to sanitise input:$input = JFactory::getApplication()->input; $value = $input->get('param', '', 'STRING');For output, use JText::_() for translated strings and...
Remediation Steps
Follow the steps below to remediate this finding on Drupal. Use Drupal's input sanitisation and output escaping functions:\Drupal\Component\Utility\Html::escape($string) — HTML context\Drupal\Component\Utility\UrlHelper::filterQueryParameters() — URL contextUs...
Remediation Steps
Follow the steps below to remediate this finding on Microsoft IIS webserver. Open IIS Manager.Select your website.Double-click HTTP Response Headers.Click Add in the Actions pane and enter:NAME: Strict-Transport-SecurityVALUE: max-age=31536000; includeSubDomai...
Remediation Steps
Follow the steps below to remediate this finding on Nginx webserver. In your nginx.conf server block (HTTPS only), add:add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;Reload Nginx:sudo systemctl reload nginx
Remediation Steps
Follow the steps below to remediate this finding on Apache webserver. Ensure mod_headers is enabled:sudo a2enmod headersAdd to your HTTPS VirtualHost or apache2.conf:Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"Relo...
Remediation Steps
Follow the steps below to remediate this finding on Plesk. Log in to the Plesk control panel.Navigate to Domains > your domain > Apache & nginx Settings.Under "Additional nginx directives", add:add_header Strict-Transport-Security "max-age=31536000; includeSub...