I'm looking into the possibility of using Expression Engine to build secure sites. How does the EE core hold up against penetration tests and vulnerability scans that check for things like cross site scripting and SQL injection?

Thanks, RS

  • I didn't see a way to "subscribe" to this thread so I'm posting here. Thanks, Bob.
    – Bob Foster
    Commented Sep 3, 2013 at 23:17
  • @BobFoster I think that's what the favorite button is for (star).
    – AllInOne
    Commented Sep 4, 2013 at 22:03
  • Uh, Duh, I guess you're right. :-)
    – Bob Foster
    Commented Sep 5, 2013 at 19:53

1 Answer 1


We've had ExpressionEngine installs penetration tested in the past, most recently by the Security Operations team at one of the world's largest technology companies. The key takeaway was that the vast majority of issues were found in third-party add-ons. There were a few issues with ExpressionEngine itself; some of them were fixed in more recent versions of EE.

Many of the remaining EE issues and most of the add-on issues were only accessible via control panel URLs. In some cases, only to logged-in admins. I'm not sure if this is a vulnerability condition for you or if your architecture assumes that admins can be trusted and/or locks the control panel files down behind a firewall. In our case, we hardened the control panel folder in a few ways, including by requiring external OAuth authorization before a session is even started.

It's also worth noting that you're very likely to introduce SQLi and XSS vulnerabilities in your own code. Make sure you're fully testing all get/post params, escaping when displaying user-supplied data, etc.... I'm happy to elaborate if it's helpful!

  • can you say more about how you require OAuth? Is it totally external to EE (or, even PHP), where all access to CP URLs is blocked until the external login is passed? Or, is it another login layer added to the EE CP?
    – Jay F
    Commented Sep 3, 2013 at 23:31
  • @JayF We extended the native EE session class to require an authorized OAuth login before a control panel session is allowed to start. Basically, if you don't have an active EE session, and try to access the EE control panel login, we redirect you to an external OAuth flow. If you authenticate through that flow and the verified user information matches specific criteria we're looking for, we log you in and start an EE control panel session.
    – Matt
    Commented Sep 4, 2013 at 4:42
  • thanks for the additional details. So it's two-factor authentication -- very smart.
    – Jay F
    Commented Sep 4, 2013 at 4:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.