Overview:
The SystemConfig rules specify system-wide options that grant sites more fluid control over various system settings, including HTTP policy headers.
The SystemConfig rule group is found in the Rules Maintenance tool on the System Admin Dashboard. Each rule in the rule group consists of a rule name and a result value.
Filter Value:
None
The SystemConfig rules do not use filter values.
Result Value:
Any text
The SystemConfig rules accept any text as the result value.
Rules:
EmailRequired
Specifies (in the result value) a semicolon-separated list of flags indicating which contacts should require a validly formed email address. Once enable, if a contact does not have a “real” email address, use anything@example.com. The example.com is reserved for exactly this purpose (e.g., support@example.com). The default is *, meaning ALL. Most valid values can be combined:
- * — all except “primary companies”. Do not combine. This is the default.
- E; — employees
- C; — customers
- V; — vendors
- U; — users (recommended minimum)
- P; — primary companies (perhaps the most difficult; you can use info@theirdomain.com)
- O; — other (than employee, customer or vendor)
- 1 — required for every contact. Do not combine.
- 0 — not required for any contact. Do not combine.
For example: U;V; for all users and all vendor contacts.
HH-List
Specifies (in the result value) a semicolon-separated list of HTTP Headers to be set by the web application. Each header is set only if there is a corresponding HH-HTTP Header Name rule with a non-empty value. The default result value is Permissions-Policy;Strict-Transport-Security. So, for example, each of those headers requires a corresponding rule (see HH-Permissions-Policy below for the default. There is currently no default for Strict-Transport-Security).
HH-HTTP Header Name
Specified (in the result value) the text to be send in the specified header. The header must be included in the HH-List rule.
HH-Permissions-Policy
Specifies (in the result value) the text to be sent in the HTTP Permissions-Policy header. See https://www.w3.org/TR/permissions-policy/ for details about this header. The default result value is unload=*,payment=(),fullscreen=self,camera=self,microphone=self.
PW.ExpireInDays
Specifies (in the result value) the number of days between required password changes. We recommend using Microsoft Entra instead!
PW.LockoutHours
Specifies (in the result value) the number of hours an account should be locked due to excessive login attempts.
PW.RetriesAllowed
Specifies (in the result value) the number of retries allowed before an account is locked.
ReportHeaderCompany
Specifies (in the result value) the text used on report headers.
UXBrandingColor
[Power UX only] Specifies (in the result value) the #6-character RGB code for the color to be used as the site theme color. The default is 0 (zero), which means use the Spitfire default color #297CF9. Hint: to determine the RGB code for a different color, go to User Choice in the Settings tab of your User Settings. Your result value should start with #. After changing this rule, a Reload Configuration is required. The new site color will show up at the next login.
KBA-01935; Last updated: August 11, 2026 at 10:35 am; green text = new
