Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Due to a recent upgrade in the scanning done by our PCI compliance testers, we recently failed a PCI, and the suggested solution is as follows:

Configure the HTTP server to specify the same error documents for both 403 (Forbidden) and 404 (Page Not Found) responses.

Our main site is running a drupal installation, and the drupal .htaccess file has the following entry:

# Make Drupal handle any 404 errors.
ErrorDocument 404 /index.php

In order to rectify the above, is this a simple matter of adding the following:

ErrorDocument 403 /index.php

Or do I need to do something more complicated?

share|improve this question
How long would it take you to make that change and test it? – John Gardeniers Feb 1 '12 at 0:28
Is that really in the domain of PCI compliance? It's OK to return a 404 and 403 error, but their messages have to be the same? jeesh. – thinice Feb 1 '12 at 2:13
up vote 1 down vote accepted

I would just set your 403 and 404 error pages in /admin/config/system/site-information to be the same page/node.

By default Drupal is already handling your error pages unless you have already modified your .htaccess file. The downside to making changes to the .htaccess file is that every time you update Drupal you have to be careful to preserve your changes.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.