1

Due to a recent upgrade in the scanning done by our PCI compliance testers, we recently failed a PCI, and the suggested solution is as follows:

Configure the HTTP server to specify the same error documents for both 403 (Forbidden) and 404 (Page Not Found) responses.

Our main site is running a drupal installation, and the drupal .htaccess file has the following entry:

# Make Drupal handle any 404 errors.
ErrorDocument 404 /index.php

In order to rectify the above, is this a simple matter of adding the following:

ErrorDocument 403 /index.php

Or do I need to do something more complicated?

CodesInChaos
  • 143
  • 7
JonoB
  • 253
  • 1
  • 3
  • 9

1 Answers1

1

I would just set your 403 and 404 error pages in /admin/config/system/site-information to be the same page/node.

By default Drupal is already handling your error pages unless you have already modified your .htaccess file. The downside to making changes to the .htaccess file is that every time you update Drupal you have to be careful to preserve your changes.

3dinfluence
  • 12,409
  • 2
  • 27
  • 41