Security
Security in layers.
For agencies and IT managers: how KLXM Studio protects the system and data – every request passes several layers of protection, data only leaves the server encrypted. open sourceSoftware whose source code is public and may be used, examined and modified under a free licence. This creates transparency and independence from individual vendors.opensource.org (opens in a new tab) and verifiable.
The path of a request
Seven layers between attacker and data.
If one layer fails, the next ones hold. Each works on its own – together they form the concept.
Connection
HTTPSThe encrypted variant of HTTP: pages and form data are transmitted protected by TLS. Recognisable by “https://” in the address.en.wikipedia.org (opens in a new tab) with HSTS (one year), security headers against framing, sniffing and access to camera or location.
- HTTPS with Strict-Transport-Security for one year
- Behind a proxy, X-Forwarded-Proto only counts from configured trusted addresses
- X-Frame-Options: no framing in other sites
- nosniff and Referrer Policy; Permissions Policy without camera, microphone and location
Content
Strict Content Security PolicyServer header that specifies from which sources a page may load scripts, styles, images and so on. It makes attacks such as cross-site scripting considerably harder.developer.mozilla.org (opens in a new tab): only own scripts, no inline code, no third-party sources without approval.
- Content Security Policy on every page: scripts and styles only from your own server
- No inline code, no style attributes, no event handlers in HTML
- Extensions may add sources – never unsafe-inline or unsafe-eval
- Rich text only via an allowlist, output escaped by default
Login
Passwords with bcrypt, lockout after 8 failed attempts per IP, second factor via app or passkeySign-in without a password: a key pair is stored on your device and unlocked with a fingerprint, face recognition or PIN. Passkeys are largely immune to phishing.fidoalliance.org (opens in a new tab) – mandatory per role.
- Passwords with bcrypt, automatic upgrade to stronger algorithms
- 8 failed attempts per IP and 20 per account within 15 minutes, then a pause
- Second factor: authenticator app (two-factor sign-inSign-in with two proofs, such as a password plus a six-digit code from an app (TOTP). Even if the password becomes known, the account stays protected.en.wikipedia.org (opens in a new tab)) or passkey (WebAuthn), mandatory per role, also “passkey only”
- Session cookie HttpOnly, Secure, SameSite=Lax; a new password ends all sessions
Permissions
Configurable roles, permissions per data tableStructured content such as team, events, products or references: entries with the same fixed fields that can appear on several pages – often with a detail page per entry., CSRF protection and permission checks on every admin action.
- Configurable roles, permissions per data table
- Every admin route checks login, permission and CSRF token
- Roles can only be assigned by people who hold them
- APIApplication programming interface: programs use it to exchange data without the user interface – for example to take over entries from another system.en.wikipedia.org (opens in a new tab) and MCPModel Context Protocol: open standard through which AI assistants access tools and data. Via an MCP server, such assistants can, for example, read a website’s content or create drafts.modelcontextprotocol.io (opens in a new tab) keys bound to the account, only with its permissions
Data
Form submissions encrypted – plain text never reaches the database. Credentials stored encrypted.
- Form data encrypted on arrival (libsodium) – readable only with the editors’ key
- SMTP password and credentials stored encrypted
- Uploads by allowlist, SVGs sanitised, files containing PHPWidely used programming language for websites. KLXM Studio is written in PHP and therefore runs on almost any common web hosting.php.net (opens in a new tab) code rejected
- Protected media outside the web root, only after login
Monitoring
Hourly integrity check of code, configuration and database, activity log, email alerts.
- Hourly: checksums of code, .htaccess and configuration
- Executable files in media, database triggers, new administrators and keys
- Email alert on new findings
- Activity log: who changed, published or deleted what and when
Backup
Backed up every night, optionally encrypted off-site – WebDAV, SFTP, FTPS. Restore tested.
- Every night: database and media of every website, shared media and tables
- Optionally off-site: WebDAV, SFTP, FTPS or NAS – encrypted with XChaCha20-Poly1305
- The key stays with the operator, not in the backup
- Restore on a new server with a single command
Structure of an installation
Only one folder is public.
Code, keys and data live outside the web root. What the web server may deliver is clearly limited – and monitored.
Installation
httpdocs/app/core – checksums, checked hourlyconfig/keys – not publicstorage/databases, data – not publicbackups/nightly backupspools/protected media – login requiredextensions/extensions – checked like the corepublic/the only public folderindex.phpthe only executable fileassets/built CSS and JavaScriptmedia/images and files – never executable
What it means
-
One entry point
The web server only runs public/index.php. Any other PHP file under public/ is reported as an error by the integrity check – except deliberately installed applications such as Matomo.
-
Data outside
Databases (SQLiteDatabase in a single file, without a separate database server. Ideal for small and medium-sized websites: easy to back up and to move.sqlite.org (opens in a new tab) or MySQLWidely used database servers for websites. MariaDB is a largely compatible, free continuation of MySQL.mariadb.org (opens in a new tab)), keys, sessions and backups live in storage/ and config/ – not reachable from the web.
-
Clean uploads
SVGs are sanitised against an allowlist, files containing PHP code are rejected, Office files only accepted if the administrators allow it.
-
Protected media
Files for member areas live in storage/pools and are only delivered after checking the login – they have no public address.
Principles
What carries the concept.
-
Small attack surface
No large framework, no plugin market with third-party code. Extensions only hook in through documented interfaces.
- One public entry point
- Strict CSP on every page
- New features off by default if they send data elsewhere
-
Your data stays with you
No tracking and no third-party services out of the box. Maps, fonts and videos run via your own server or only after a click.
- Maps via your own server
- Self-hosted fonts
- YouTube and Vimeo only after consent
-
Verifiable, not promised
The source code is open (MIT). Static analysis, self-tests and a check for known vulnerabilities in libraries are part of every change.
- PHPStan level 5 without findings
- Self-tests for core and extensions
- composer audit and pnpm audit
Your part as operator
- Require a second factor for administrators (Users & roles → Login & security)
- Set up off-site backup and keep the key somewhere else
- Keep the server, PHP and KLXM Studio up to date
- Take integrity check alerts seriously
In detail
All measures at a glance.
For review by your IT – every statement can be traced in the source code.
| Area | Technology | Details |
|---|---|---|
| Transport | HTTPS, HSTS | Strict-Transport-Security for one year; behind a proxy only with configured trusted addresses. |
| Headers | X-Frame-Options, nosniff, Referrer and Permissions Policy | No framing in other sites, no MIME sniffing, no access to camera, microphone or location. |
| Content | Content Security Policy | script-src and style-src only from your own server; extensions may add sources, never unsafe-inline or unsafe-eval. |
| Session | Cookie HttpOnly, Secure, SameSite=Lax | Sign out everywhere via a version number per account – a new password ends all sessions. |
| Passwords | bcrypt (password_hash) | Automatic upgrade when PHP sets a stronger default algorithm. |
| Login protection | Limits per IP and per account | 8 attempts per IP and 20 per account within 15 minutes; the second factor has its own limit. |
| Second factor | TOTP (authenticator app), passkeys (WebAuthn) | Mandatory per role if you wish, including “passkey only”; always required for network accounts in production. |
| Permissions | Roles, permissions per data table, CSRF | Every admin route checks login, permission and CSRF token; roles can only be assigned by people who hold them. |
| Interfaces | API and MCP keys | Bound to the account, only with the owner’s permissions; new keys are reported by the integrity check. |
| Uploads | Allowlist, SVG sanitising, PHP detection | Dangerous types blocked, SVGs without scripts and external references, Office documents only if allowed. |
| Submissions | libsodium (sealed box) | Form data is encrypted on arrival; readable only with the editors’ key, not by the web host. |
| Secrets | libsodium (secretbox) | SMTP password, credentials of external sources and backup targets stored encrypted. |
| Integrity | Checksums, signed baselines | Hourly: code, .htaccess, configuration, executable files in media, triggers, new administrators and keys. |
| Logging | Activity log | Who created, changed, published or deleted pages, records and media, and when. |
| Backup | Nightly local, encrypted off-site | XChaCha20-Poly1305 (libsodium); targets WebDAV, SFTP, FTPS or a folder; key only on the server. |
| Development | PHPStan, self-tests, audits | Static analysis level 5, self-tests per area, composer audit and pnpm audit without known vulnerabilities. |
Found a vulnerability? Please report it privately – via “Report a vulnerability” in the GitHub repository or by email to info@klxm.de (subject “Security: KLXM Studio”).
Questions
Frequently asked questions about security
Where is the data stored?
On the server KLXM Studio runs on – yours or ours. Databases, media and backups live in the same installation; nothing goes to third parties unless you set it up.
Who can read form submissions?
Only people with the key for submissions. The data is stored encrypted on arrival – even the web host only sees encrypted values in the database.
What happens if someone breaks in?
Within an hour, the integrity check reports changed files, new administrator accounts or keys by email. With the off-site backup, the last clean state can be restored on a new server.
Is a second factor mandatory?
Always for network accounts in production. For the roles of a website you decide yourself – we recommend it at least for administrators, optionally “passkey only”.
Can we have the code reviewed?
Yes. The source code is open (MIT) and available on GitHub – your IT or a service provider can review it completely.
How do we report a vulnerability?
Privately via “Report a vulnerability” in the GitHub repository or by email to info@klxm.de with the subject “Security: KLXM Studio” – please not in public issues.
Kontakt
Sprechen Sie mit KLXM Crossmedia.
Vorführung, Einsatz in Ihrem Projekt oder eine Erweiterung nach Ihren Wünschen – sprechen Sie uns an. Wir antworten persönlich.
Am Schürmannshütt 40g
47441 Moers
Germany
- Phone
- +49 2841 889998-0
- info@klxm.de
- Website
- klxm.de (opens in a new tab)