Due to a recent upgrade in the scanning done by our PCI compliance testers, we recently failed a PCI, and the suggested solution is as follows:
Configure the HTTP server to specify the same error documents for both 403 (Forbidden) and 404 (Page Not Found) responses.
Our main site is running a drupal installation, and the drupal .htaccess file has the following entry:
# Make Drupal handle any 404 errors. ErrorDocument 404 /index.php
In order to rectify the above, is this a simple matter of adding the following:
ErrorDocument 403 /index.php
Or do I need to do something more complicated?