Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Due to a recent upgrade in the scanning done by our PCI compliance testers, we recently failed a PCI, and the suggested solution is as follows:

Configure the HTTP server to specify the same error documents for both 403 (Forbidden) and 404 (Page Not Found) responses.

Our main site is running a drupal installation, and the drupal .htaccess file has the following entry:

# Make Drupal handle any 404 errors.
ErrorDocument 404 /index.php

In order to rectify the above, is this a simple matter of adding the following:

ErrorDocument 403 /index.php

Or do I need to do something more complicated?

share|improve this question
5  
How long would it take you to make that change and test it? –  John Gardeniers Feb 1 '12 at 0:28
1  
Is that really in the domain of PCI compliance? It's OK to return a 404 and 403 error, but their messages have to be the same? jeesh. –  thinice Feb 1 '12 at 2:13
add comment

1 Answer

up vote 1 down vote accepted

I would just set your 403 and 404 error pages in /admin/config/system/site-information to be the same page/node.

By default Drupal is already handling your error pages unless you have already modified your .htaccess file. The downside to making changes to the .htaccess file is that every time you update Drupal you have to be careful to preserve your changes.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.