Security

This chapter details Grav's security policies, how to report security issues, and the status of current and previous reports.

Overview

Overview If you discover a possible security issue related to Grav or one of its extensions, please send an email to the core team at [email protected] and we'll address it as soon as possible. Issues should not be publicly disclosed - including on GitHub, Discord, or the Discourse forum - b...

Recommended Configuration

Recommended Configuration Like with every other application, it is important that you check through the configuration options to secure and optimize your site. Production Site It is important to secure your production site by hardening the configuration. To do this, we recommend you to set you...

Users

Users When running Grav, with or without an Administration Panel installed, there are some best practices to keep in mind. These relate to who can access what on your website, and the potential risks of not limiting risk factors in this regard. Grav Users and the Administration Panel When...

Developers

Developers When creating a plugin or theme for Grav, it is not only important to follow best practices, but to consider whether your work opens up any avenues of attack for potential intruders to a site. As Grav is a flat-file CMS and reliant on few dependencies, it is by nature more secure than s...

Server-side

Server-side Protecting your Grav-installation server-side consists of using sensible options for your server and PHP. This guide does not cover settings for the server you run Grav on, nor ideal conditions, but rather highlights some tips and best practices in securing Grav or links to resources w...

Reports

Reports Since GitHub now have support for security advisories for each repository, this is where you'll find up-to-date reports and policies. You can always find more details on MITRE's CVE-program, and an overview on CVE Details. Most prominently, Grav itself and the Admin-plugin are what e...