---
title: "Troubleshooting security issues"
slug: "trouboleshooting-security"
description: "Learn why some cookies lack Secure or HttpOnly attributes, and how IP restrictions affect search engine crawling and SRI implementation in Document360."
updated: 2026-11-13T11:34:12Z
published: 2026-11-13T11:34:12Z
canonical: "docs.document360.com/trouboleshooting-security"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.document360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting security issues

---

### FAQ

#### Why are some cookies not marked as Secure or HttpOnly?

Certain cookies may originate from third-party integrations, embedded services, or browser-level functionality. Security attributes such as Secure and HttpOnly depend on the purpose and implementation of each cookie. Some functional or non-sensitive cookies may intentionally not use the HttpOnly attribute if browser-side access is required. Also, required Document360 domains will have the Secure and HttpOnly attributes.

#### Why is my website not being crawled by search engines after enabling IP Restriction?

When IP Restriction is enabled for a project, access to the website is limited to the allowed IP addresses. As a result, search engine crawlers cannot access the website, preventing it from being crawled and indexed.

#### Does Document360 implement Subresource Integrity (SRI) for externally loaded scripts, stylesheets, and other third-party resources?

Yes. Document360 implements Subresource Integrity (SRI) for supported static resources hosted through the Document360 CDN whenever technically feasible.

SRI helps browsers verify that externally loaded resources have not been modified by comparing the downloaded file against a cryptographic hash. This provides an additional layer of protection against unauthorized modifications to static assets.

**Resources with SRI Support**

Document360 applies SRI to eligible static assets, including:

- Font (Font Awesome stylesheets, Google Fonts stylesheets) and icon stylesheets hosted on the Document360 CDN
- Static CSS resources
- Other supported CDN-hosted assets that do not change frequently

**Resources Without SRI**

Certain third-party resources do not support SRI because they are dynamically maintained by their providers and are updated regularly.

Examples include:

**Cloudflare Turnstile**

Cloudflare Turnstile is used to provide bot protection and verification capabilities.

Cloudflare does not recommend implementing SRI for the Turnstile script because the resource is frequently updated for security purposes. Applying SRI could result in integrity hash mismatches, causing the script to fail and preventing Turnstile validation from functioning correctly.

**Wistia Video Player**

Wistia scripts are used to support video playback functionality within the Knowledge Base.

Wistia recommends loading their player scripts directly from their managed infrastructure without applying SRI. Because these scripts are regularly updated and version-controlled by Wistia, integrity hashes can become outdated and cause the integration to stop working.

#### Why isn't SRI applied to every external resource?

SRI is most effective for static files whose content remains unchanged between releases.

For third-party services that continuously update their scripts to deliver security patches, bug fixes, and feature enhancements, applying SRI may cause functionality failures whenever the provider updates the resource.

For this reason, Document360 follows industry best practices and vendor recommendations by:

- Applying SRI to supported static resources.
- Allowing trusted third-party providers to manage dynamic resources that require regular updates.
- Continuously evaluating security controls to maintain a secure and reliable user experience.