diff --git a/WebContent/WEB-INF/jsp/pointHierarchySLTS.jsp b/WebContent/WEB-INF/jsp/pointHierarchySLTS.jsp
index 5070db6808..626b293769 100644
--- a/WebContent/WEB-INF/jsp/pointHierarchySLTS.jsp
+++ b/WebContent/WEB-INF/jsp/pointHierarchySLTS.jsp
@@ -601,7 +601,7 @@ var messages = {
     	$.ajax({
             type: "GET",
         	dataType: "json",
-        	url:myLocation+"/pointHierarchy/paths/"+key+"/"+folder,
+        	url:myLocation+"pointHierarchy/paths/"+key+"/"+folder,
         	success: function(msg){
         		var path="/";
         		if (msg.length>0) {
@@ -753,7 +753,7 @@ var messages = {
                            $.ajax({
     	 			            type: "POST",
     	 			        	dataType: "json",
-    	 			        	url:myLocation+'/pointHierarchy/move/'+toMove.key+'/'+toMove.oldParentId+'/'+toMove.newParentId+'/'+nodeDragAndDrop.isFolder(),
+    	 			        	url:myLocation+'pointHierarchy/move/'+toMove.key+'/'+toMove.oldParentId+'/'+toMove.newParentId+'/'+nodeDragAndDrop.isFolder(),
     	 			        	success: function(msg){
     	 			        	  $button.hide();
     	 			 		      $button.stopSpin();
@@ -786,7 +786,7 @@ var messages = {
     	      glyph: glyph_opts,
     	      selectMode: 2,
     	      source: {
-    	        url: myLocation+"/pointHierarchy/0",
+    	        url: myLocation+"pointHierarchy/0",
     	        debugDelay: 0,
     	        cache: false},
     	      toggleEffect: { effect: "drop", options: {direction: "left"}, duration: 100 },
@@ -802,7 +802,7 @@ var messages = {
     	      },
     	      lazyLoad: function(event, data) {
     	    	data.result = {
-    	    	 url: myLocation+"/pointHierarchy/"+data.node.key,
+    	    	 url: myLocation+"pointHierarchy/"+data.node.key,
     	         cache: false,
     	         debugDelay: 0
     	         };
@@ -832,7 +832,7 @@ var messages = {
  		          $.ajax({
 		            type: "POST",
 		        	dataType: "json",
-		        	url:myLocation+"/pointHierarchy/new/0/"+dialog.getModalBody().find('input').val(),
+		        	url:myLocation+"pointHierarchy/new/0/"+dialog.getModalBody().find('input').val(),
 		        	success: function(msg){
 		        	  var titleNewNode = dialog.getModalBody().find('input').val();
 		        	  dialog.getModalBody().html('<div><h3>'+messages.folder+':</h3><ul><li>'+messages.key+':<b>'+msg+'</b></li><li>'+messages.title+':<b>'+titleNewNode+'</b></li></ul></div>');
@@ -899,7 +899,7 @@ var messages = {
 				           $.ajax({
 				        	   type: "POST",
 				        	   dataType: "json",
-				        	   url:myLocation+"/pointHierarchy/del/"+getParentId(nodeActivate)+"/"+nodeActivate.key+"/"+nodeActivate.isFolder(),
+				        	   url:myLocation+"pointHierarchy/del/"+getParentId(nodeActivate)+"/"+nodeActivate.key+"/"+nodeActivate.isFolder(),
 				        	   success: function(msg){
 				        		   dialog.getModalBody().html('<div><h3>'+messages.folderRemoved+':</h3><ul><li>'+messages.key+':<b>'+nodeActivate.key+'</b></li><li>'+messages.title+':<b>'+nodeActivate.title+'</b></li><li>'+messages.msg+':'+msg+'</li></ul></div>');
 						           $button.hide();
@@ -949,7 +949,7 @@ var messages = {
     					           $.ajax({
     					        	   type: "POST",
     					        	   dataType: "json",
-    					        	   url:myLocation+"/pointHierarchy/del/"+getParentId(nodeActivate)+"/"+nodeActivate.key+"/"+nodeActivate.isFolder(),
+    					        	   url:myLocation+"pointHierarchy/del/"+getParentId(nodeActivate)+"/"+nodeActivate.key+"/"+nodeActivate.isFolder(),
     					        	   success: function(msg){
     					        		   dialog.getModalBody().html('<div><h3>'+messages.movedElement+':</h3><ul><li>'+messages.key+':<b>'+nodeActivate.key+'</b></li><li>'+messages.title+':<b>'+nodeActivate.title+'</b></li><li>'+messages.msg+':'+msg+'</li></ul></div>');
     							           $button.hide();
@@ -1032,7 +1032,7 @@ var messages = {
 		           $.ajax({
 			            type: "POST",
 			        	dataType: "json",
-			        	url:myLocation+"/pointHierarchy/edit/"+getParentId(nodeActivate)+"/"+nodeActivate.key+"/"+newTitle,
+			        	url:myLocation+"pointHierarchy/edit/"+getParentId(nodeActivate)+"/"+nodeActivate.key+"/"+newTitle,
 			        	success: function(msg){
 			        	  var titleNewNode = dialog.getModalBody().find('input').val();
 			        	  dialog.getModalBody().html('<div><h3>'+messages.folderChange+':</h3><ul><li>'+messages.key+':<b>'+nodeActivate.key+'</b></li><li>'+messages.oldTitle+':<b>'+nodeActivate.title+'</b></li><li>'+messages.newTitle+':<b>'+newTitle+'</b></li></ul></div>');
@@ -1140,7 +1140,7 @@ var messages = {
     		 $.ajax({
 		            type: "POST",
 		        	dataType: "json",
-		        	url:myLocation+"/viewutil/"+locale,
+		        	url:myLocation+"viewutil/"+locale,
 		        	success: function(msg){
 		        		location.reload();
 		        	},
@@ -1227,7 +1227,7 @@ var messages = {
         	$.ajax({
 	            type: "GET",
 	        	dataType: "json",
-	        	url:myLocation+"/pointHierarchy/find/"+queryGlobal+"/"+page,
+	        	url:myLocation+"pointHierarchy/find/"+queryGlobal+"/"+page,
 	        	success: function(msg){
 
 	        	  	if(msg !== undefined ) {
diff --git a/WebContent/WEB-INF/jsp/scripting.jsp b/WebContent/WEB-INF/jsp/scripting.jsp
index 353587d83d..77d8871672 100644
--- a/WebContent/WEB-INF/jsp/scripting.jsp
+++ b/WebContent/WEB-INF/jsp/scripting.jsp
@@ -38,7 +38,7 @@
   	if (!myLocation) {
    		myLocation = location.protocol + "//" + location.host + "/" + appScada + "/";
   	}
-    var urlGetDataPoints = "/api/datapoint/getAll";
+    var urlGetDataPoints = "api/datapoint/getAll";
     function executeScript(){
     	var xid = jQuery("#xid");
     	// saveScript() nie zdarzy zapisac !!!
diff --git a/WebContent/WEB-INF/spring-security.xml b/WebContent/WEB-INF/spring-security.xml
index 557a6c77b0..732fc40e23 100644
--- a/WebContent/WEB-INF/spring-security.xml
+++ b/WebContent/WEB-INF/spring-security.xml
@@ -24,6 +24,7 @@
         <!-- Other -->
         <intercept-url pattern="/**" access="hasRole('ROLE_SERVICES')" requires-channel="https"/>
 
+        <custom-filter ref="xssFilter" before="FIRST"/>
         <custom-filter position="BASIC_AUTH_FILTER" ref="basicAuthFilter"/>
         <session-management session-fixation-protection="none" />
     </http>
@@ -46,6 +47,7 @@
         <!-- Other -->
         <intercept-url pattern="/**" access="hasAnyRole('ROLE_HTTPDS')" />
 
+        <custom-filter ref="xssFilter" before="FIRST"/>
         <custom-filter position="BASIC_AUTH_FILTER" ref="basicAuthFilter"/>
         <session-management session-fixation-protection="none" />
     </http>
@@ -68,6 +70,7 @@
         <!-- Other -->
         <intercept-url pattern="/**" access="hasAnyRole('ROLE_ADMIN', 'ROLE_USER', 'ROLE_HTTPDS')" requires-channel="https"/>
 
+        <custom-filter ref="xssFilter" before="FIRST"/>
         <custom-filter position="BASIC_AUTH_FILTER" ref="basicAuthFilter"/>
         <session-management session-fixation-protection="none"/>
     </http>
@@ -90,6 +93,7 @@
         <!-- Other -->
         <intercept-url pattern="/**" access="hasAnyRole('ROLE_ADMIN')" requires-channel="https"/>
 
+        <custom-filter ref="xssFilter" before="FIRST"/>
         <custom-filter position="BASIC_AUTH_FILTER" ref="basicAuthFilter"/>
         <session-management session-fixation-protection="none"/>
     </http>
@@ -112,6 +116,7 @@
         <!-- Other -->
         <intercept-url pattern="/**" access="hasAnyRole('ROLE_ADMIN')" requires-channel="https"/>
 
+        <custom-filter ref="xssFilter" before="FIRST"/>
         <custom-filter position="BASIC_AUTH_FILTER" ref="basicAuthFilter"/>
         <session-management session-fixation-protection="none"/>
     </http>
@@ -440,13 +445,14 @@
                     authentication-failure-url="/login.htm?error" login-page="/login.htm"
                     password-parameter="password" username-parameter="username"
                     login-processing-url="/login.htm"/>
-
+        <custom-filter ref="xssFilter" before="FIRST"/>
         <custom-filter after="SECURITY_CONTEXT_FILTER" ref="setDataSessionFilter" />
         <session-management session-fixation-protection="none" />
         <logout logout-url="/logout.htm" invalidate-session="true" delete-cookies="JSESSIONID"
                 success-handler-ref="headerWriterLogoutHandler"/>
     </http>
-    <http-firewall ref="defaultHttpFirewall"/>
+    <http-firewall ref="strictHttpFirewall"/>
+    <!--http-firewall ref="defaultHttpFirewall"/-->
 
     <!-- Websocket -->
     <!--websocket-message-broker same-origin-disabled="true">
@@ -518,4 +524,14 @@
     </b:bean>
 
     <b:bean id="getSecurityBeans" class="org.scada_lts.web.beans.GetSecurityBeans"/>
+
+    <b:bean id="strictHttpFirewall" class="org.springframework.security.web.firewall.StrictHttpFirewall">
+        <b:property name="allowSemicolon" value="false"/>
+        <b:property name="allowUrlEncodedSlash" value="false"/>
+        <b:property name="allowUrlEncodedPercent" value="false"/>
+        <b:property name="allowBackSlash" value="false"/>
+        <b:property name="allowUrlEncodedPeriod" value="false"/>
+    </b:bean>
+
+    <b:bean id="xssFilter" class="org.scada_lts.web.security.XssFilter"/>
 </b:beans>
\ No newline at end of file
diff --git a/build.gradle b/build.gradle
index 276640a818..5611597879 100644
--- a/build.gradle
+++ b/build.gradle
@@ -232,6 +232,7 @@ test {
         includeTestsMatching "com.serotonin.mango.util.AddLimitIfWithoutSqlDataSourceUtilsTest"
         includeTestsMatching "com.serotonin.mango.util.StartStopDataPointsUtilsTestsSuite"
         includeTestsMatching "org.scada_lts.utils.BlockingQueuesUtilsTest"
+        includeTestsMatching "org.scada_lts.web.security.XssUtilsTest"
     }
 
     testLogging {
diff --git a/scadalts-ui/src/store/index.js b/scadalts-ui/src/store/index.js
index 0774a26d13..dffc1dd264 100644
--- a/scadalts-ui/src/store/index.js
+++ b/scadalts-ui/src/store/index.js
@@ -75,7 +75,7 @@ export default new Vuex.Store({
 			// useCredentials: true,
 			// credentials: 'same-origin',
 		},
-		webSocketUrl: 'ws-scada/alarmLevel',
+		webSocketUrl: 'ws-scada',
 
 		timePeriods: [
 			{ id: 1, label: i18n.t('common.timeperiod.seconds') },
@@ -98,7 +98,10 @@ export default new Vuex.Store({
 	},
 	mutations: {
 		updateWebSocketUrl(state) {
-            state.webSocketUrl = getAppLocation() + state.webSocketUrl;
+            let base = getAppLocation();
+            if(!state.webSocketUrl.includes(base)) {
+                state.webSocketUrl = base + state.webSocketUrl;
+            }
 		},
 
 		updateRequestTimeout(state, timeout) {
diff --git a/scadalts-ui/src/store/pointHierarchy/index.js b/scadalts-ui/src/store/pointHierarchy/index.js
index 76abca1047..641c0b9c6a 100644
--- a/scadalts-ui/src/store/pointHierarchy/index.js
+++ b/scadalts-ui/src/store/pointHierarchy/index.js
@@ -116,7 +116,7 @@ const gv = {
 			return new Promise((resolve, reject) => {
 				axios
 					.post(
-						`.//pointHierarchy/move/${nodeId}/${parentNodeId}/${newParentNodeId}/${isFolder}`,
+						`./pointHierarchy/move/${nodeId}/${parentNodeId}/${newParentNodeId}/${isFolder}`,
 						requestConfiguration,
 					)
 					.then((resp) => {
diff --git a/scadalts-ui/src/store/websocketStore.js b/scadalts-ui/src/store/websocketStore.js
index 3d0b8f053d..e8a4164b76 100644
--- a/scadalts-ui/src/store/websocketStore.js
+++ b/scadalts-ui/src/store/websocketStore.js
@@ -18,7 +18,11 @@ const webSocketModule = {
 
     mutations: {
         INIT_WEBSOCKET(state) {
-            let socket = new SockJS(getAppLocation() + state.webSocketUrl);
+            let base = getAppLocation();
+            if(!state.webSocketUrl.includes(base)) {
+                state.webSocketUrl = base + state.webSocketUrl;
+            }
+            let socket = new SockJS(state.webSocketUrl);
             let client = Stomp.over(socket);
             if(!state.debugMode) {
                 client.debug = () => {};
diff --git a/src/org/scada_lts/utils/SystemSettingsUtils.java b/src/org/scada_lts/utils/SystemSettingsUtils.java
index 77919caa16..5ff9aaab6d 100644
--- a/src/org/scada_lts/utils/SystemSettingsUtils.java
+++ b/src/org/scada_lts/utils/SystemSettingsUtils.java
@@ -67,6 +67,11 @@ private SystemSettingsUtils() {}
 
     public static final String EVENT_ASSIGN_ENABLED_KEY = "event.assign.enabled";
 
+    private static final String SECURITY_HTTP_QUERY_ACCESS_DENIED_REGEX_KEY = "scadalts.security.http.query.access.denied.regex";
+    private static final String SECURITY_HTTP_QUERY_ACCESS_GRANTED_REGEX_KEY = "scadalts.security.http.query.access.granted.regex";
+    private static final String SECURITY_HTTP_QUERY_LIMIT_KEY = "scadalts.security.http.query.limit";
+    private static final String SECURITY_HTTP_QUERY_PROTECT_ENABLED_KEY = "scadalts.security.http.query.protect.enabled";
+
     private static final org.apache.commons.logging.Log LOG = LogFactory.getLog(SystemSettingsUtils.class);
 
     public static DataPointSyncMode getDataPointSynchronizedMode() {
@@ -538,4 +543,42 @@ public static boolean isEventAssignEnabled() {
             return false;
         }
     }
+
+    public static String getSecurityHttpQueryAccessDeniedRegex() {
+        try {
+            return ScadaConfig.getInstance().getConf().getProperty(SECURITY_HTTP_QUERY_ACCESS_DENIED_REGEX_KEY, "");
+        } catch (Exception e) {
+            LOG.error(e.getMessage());
+            return "";
+        }
+    }
+
+    public static String getSecurityHttpQueryAccessGrantedRegex() {
+        try {
+            return ScadaConfig.getInstance().getConf().getProperty(SECURITY_HTTP_QUERY_ACCESS_GRANTED_REGEX_KEY, "");
+        } catch (Exception e) {
+            LOG.error(e.getMessage());
+            return "";
+        }
+    }
+
+    public static int getSecurityHttpQueryLimit() {
+        try {
+            String securityHttpQueryXssLimit = ScadaConfig.getInstance().getConf().getProperty(SECURITY_HTTP_QUERY_LIMIT_KEY, "4001");
+            return Integer.parseInt(securityHttpQueryXssLimit);
+        } catch (Exception e) {
+            LOG.error(e.getMessage());
+            return 4002;
+        }
+    }
+
+    public static boolean isSecurityHttpQueryProtectEnabled() {
+        try {
+            String securityHttpQueryXssEnabled = ScadaConfig.getInstance().getConf().getProperty(SECURITY_HTTP_QUERY_PROTECT_ENABLED_KEY, "false");
+            return Boolean.parseBoolean(securityHttpQueryXssEnabled);
+        } catch (Exception e) {
+            LOG.error(e.getMessage());
+            return false;
+        }
+    }
 }
diff --git a/src/org/scada_lts/web/security/XssFilter.java b/src/org/scada_lts/web/security/XssFilter.java
new file mode 100644
index 0000000000..b150236f2f
--- /dev/null
+++ b/src/org/scada_lts/web/security/XssFilter.java
@@ -0,0 +1,35 @@
+package org.scada_lts.web.security;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import javax.servlet.*;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+public class XssFilter extends OncePerRequestFilter {
+
+    private static final Logger LOG = LogManager.getLogger(XssFilter.class);
+    @Override
+    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
+            throws ServletException, IOException {
+
+        String queryString = request.getQueryString();
+        if (queryString != null && !XssUtils.validateHttpQuery(queryString)) {
+            LOG.warn("Potential XSS detected in request. Request URI: {}, Query: {}",
+                    request.getRequestURI(), queryString);
+
+            try {
+                response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
+                        "Potential XSS detected in the request Query: " + queryString);
+            } catch (IOException e) {
+                throw new RuntimeException(e);
+            }
+            return;
+        }
+
+        filterChain.doFilter(request, response);
+    }
+}
diff --git a/src/org/scada_lts/web/security/XssUtils.java b/src/org/scada_lts/web/security/XssUtils.java
new file mode 100644
index 0000000000..c92f42392a
--- /dev/null
+++ b/src/org/scada_lts/web/security/XssUtils.java
@@ -0,0 +1,43 @@
+package org.scada_lts.web.security;
+
+import org.scada_lts.serorepl.utils.StringUtils;
+import org.scada_lts.utils.SystemSettingsUtils;
+
+import java.util.regex.Pattern;
+
+public final class XssUtils {
+
+    private XssUtils() {}
+
+    private static final Pattern SECURITY_HTTP_ACCESS_DENIED_QUERY_REGEX = init(SystemSettingsUtils.getSecurityHttpQueryAccessDeniedRegex());
+    private static final Pattern SECURITY_HTTP_ACCESS_GRANTED_QUERY_REGEX = init(SystemSettingsUtils.getSecurityHttpQueryAccessGrantedRegex());
+    public static final int SECURITY_HTTP_ACCESS_GRANTED_QUERY_LIMIT = SystemSettingsUtils.getSecurityHttpQueryLimit();
+    public static final boolean SECURITY_HTTP_QUERY_PROTECT_ENABLED = SystemSettingsUtils.isSecurityHttpQueryProtectEnabled();
+
+    public static boolean validateHttpQuery(String query) {
+
+        if(!SECURITY_HTTP_QUERY_PROTECT_ENABLED)
+            return true;
+
+        if (query == null || query.isEmpty()) {
+            return false;
+        }
+
+        if(query.length() > SECURITY_HTTP_ACCESS_GRANTED_QUERY_LIMIT) {
+            return false;
+        }
+
+        if(SECURITY_HTTP_ACCESS_DENIED_QUERY_REGEX != null && SECURITY_HTTP_ACCESS_DENIED_QUERY_REGEX.matcher(query).matches()) {
+            return false;
+        }
+
+        return SECURITY_HTTP_ACCESS_GRANTED_QUERY_REGEX == null || SECURITY_HTTP_ACCESS_GRANTED_QUERY_REGEX.matcher(query).matches();
+    }
+
+    private static Pattern init(String regex) {
+        if(StringUtils.isEmpty(regex)) {
+            return null;
+        }
+        return Pattern.compile(regex);
+    }
+}
diff --git a/test/WEB-INF/classes/env.properties b/test/WEB-INF/classes/env.properties
deleted file mode 100644
index ad07ffb7cd..0000000000
--- a/test/WEB-INF/classes/env.properties
+++ /dev/null
@@ -1,149 +0,0 @@
-#
-#    Mango - Open Source M2M - http://mango.serotoninsoftware.com
-#    Copyright (C) 2006-2009 Serotonin Software Technologies Inc.
-#    @author Matthew Lohbihler
-#
-#    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU General Public License as published by
-#    the Free Software Foundation, either version 3 of the License, or
-#    (at your option) any later version.
-#
-#    This program is distributed in the hope that it will be useful,
-#    but WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU General Public License for more details.
-#
-#    You should have received a copy of the GNU General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-#
-
-# PARA INTEGRAR O ScadaBR AO POSTGRESQL v9.2 INSTALE O POSTGRESQL v9.2 NA M\u00c1QUINA SERVIDORA
-# ALTERE A LINHA db.password=admin (COLOQUE A SENHA DEFINIDA POR VOC\u00ca)
-# N\u00c3O REMOVA A LINHA db.url.public=jdbc:postgresql://localhost:5432/postgres
-
-#testowy!!!!
-
-#db.type=postgres
-#db.url=jdbc:postgresql://localhost:5432/scadabr
-#db.url.public=jdbc:postgresql://localhost:5432/postgres
-#db.username=postgres
-#db.password=admin
-#db.pool.maxActive=10
-#db.pool.maxIdle=10
-
-db.type=mysql
-db.datasource=true
-db.datasourceName=java:comp/test_env/jdbc/scadalts
-#db.url=jdbc:mysql://localhost:3306/scadalts
-#db.username=root
-#db.password=root
-#db.pool.maxActive=10
-#db.pool.maxIdle=10
-#db.update.log.dir=logs
-#db.upgrade.check=false
-
-#db.type=derby
-#db.url=~../../bin/scadabrDB
-#db.username=
-#db.password=
-
-js.optimizationlevel=-1
-
-api.authentication=disabled
-api.username=admin
-api.password=admin
-
-abilit.disableDataSourcesOnServerStart=false
-
-abilit.api.replace.alert.onview=true
-
-
-abilit.cacheEnable=true
-abilit.START_UPDATE_UNSILENCED_ALARM_LEVEL=100000
-abilit.START_UPDATE_EVENT_DETECTORS=100000
-abilit.START_UPDATE_PENDING_EVENTS=100000
-abilit.MILLIS_SECONDS_PERIOD_UPDATE_UNSILENCED_ALARM_LEVEL=1000
-#abilit.MILLIS_SECONDS_PERIOD_UPDATE_EVENT_DETECTORS=1000
-abilit.MILLIS_SECONDS_PERIOD_UPDATE_PENDING_EVENTS=1000
-abilit.CRONE_UPDATE_CACHE_POINT_HIERARCHY=0 0/10 * * * ?
-
-# every minute
-abilit.CRONE_UPDATE_DATA_SOURCES_POINTS=0 0/1 * * * ?
-abilit.USE_CACHE_DATA_SOURCES_POINTS_WHEN_THE_SYSTEM_IS_READY=true
-
-#Permission ACL
-abilit.USE_ACL=false
-abilit.ACL_SERVER=http://localhost:8090
-
-#Events
-abilit.DO_NOT_CREATE_EVENTS_FOR_EMAIL_ERROR=true
-
-#Reactivation HttpRetriver
-abilit.HTTP_RETRIVER_SLEEP_CHECK_TO_REACTIVATION_WHEN_START=false
-abilit.HTTP_RETRIVER_DO_NOT_ALLOW_ENABLE_REACTIVATION=false
-
-#security.hashAlgorithm=NONE
-#grove.url=http://mango.serotoninsoftware.com/servlet
-
-api.amcharts.aggregation.enabled=true
-api.amcharts.aggregation.valuesLimit=20000
-api.amcharts.aggregation.limitFactor=1.5
-
-user.cache.enabled=true
-usersprofile.cache.enabled=true
-permissions.cache.enabled=true
-shareuser.cache.enabled=true
-usercomment.cache.enabled=true
-view.cache.enabled=true
-
-alarmlevel.highest.cache.enabled=true
-alarmlevel.highest.cache.reset.enabled=true
-alarmlevel.highest.cache.reset.cron=0 0 1/3 ? * * *
-
-svg.validator.enabled=true
-svg.validator.only-xml=false
-svg.validator.schemas=svg/svg11-flat-20110816/svg11-flat-20110816.xsd;svg/svg10-flat-20010904/svg10-flat-20010904.xsd
-# Incompatible with SVG 1.0/1.1/1.1 Second Edition/1.1 Tiny/1.1 Basic - often found in files;
-# rdf:RDF - https://www.w3.org/TR/SVGTiny12/metadata.html
-svg.validator.tags.ignore=rdf:RDF;sodipodi:namedview;inkscape:perspective
-svg.validator.messages.ignore=must appear on element;Attribute 'blend' is not allowed to appear in element 'feBlend'.;sodipodi:;inkscape:;Attribute 'vector-effect' is not allowed to appear in element 'g'.
-systemsettings.http.response.headers={}
-
-datapoint.runtime.value.synchronized=NONE
-
-comm.serial.timeout.read=500
-comm.serial.timeout.write=500
-comm.serial.timeout.mode=0
-comm.serial.sleep=1000
-
-systemsettings.email.timeout=60000
-processing.workitems.limit=51
-processing.workitems.failed.limit=51
-processing.workitems.running.limit=51
-processing.workitems.running.repeat=51
-processing.workitems.history.process.limit=51
-processing.workitems.history.priority.high.limit=51
-processing.workitems.history.priority.medium.limit=51
-processing.workitems.history.priority.low.limit=51
-processing.workitems.history.longer.thanMs=1500
-processing.workitems.history.longer.limit=200
-
-scadalts.security.js.access.denied.method.regexes=getDeclaredField;getPassword;getClass;getRuntime;exec
-scadalts.security.js.access.denied.class.regexes=java.lang.Runtime;java.lang.Runtime.*;java.lang.reflect.*;java.lang.ref.*;java.lang.System.*;java.lang.System;java.lang.ClassLoader;java.lang.Compiler;java.lang.SecurityManager;java.lang.Thread;java.lang.ThreadGroup;java.lang.ThreadLocal
-scadalts.security.js.access.granted.method.regexes=^.*
-scadalts.security.js.access.granted.class.regexes=^.*
-
-view.forceFullScreen=false
-view.hideShortcutDisableFullScreen=false
-eventdetector.cache.enabled=true
-event.pending.limit=101
-event.pending.update.limit=5001
-threads.name.additional.length=5
-workitems.reporting.enabled=false
-workitems.reporting.itemspersecond.enabled=false
-workitems.reporting.itemspersecond.limit=20000
-
-webresource.uploads.path=static/uploads
-webresource.graphics.path=static/graphics
-svg.validator.disallow-doctype-decl.enabled=false
\ No newline at end of file
diff --git a/test/env.properties b/test/env.properties
index 6239588d4d..be695d0277 100644
--- a/test/env.properties
+++ b/test/env.properties
@@ -107,7 +107,9 @@ svg.validator.schemas=svg/svg11-flat-20110816/svg11-flat-20110816.xsd;svg/svg10-
 # Incompatible with SVG 1.0/1.1/1.1 Second Edition/1.1 Tiny/1.1 Basic - often found in files;
 # rdf:RDF - https://www.w3.org/TR/SVGTiny12/metadata.html
 svg.validator.tags.ignore=rdf:RDF;sodipodi:namedview;inkscape:perspective
-svg.validator.messages.ignore=must appear on element;Attribute 'blend' is not allowed to appear in element 'feBlend'.;sodipodi:;inkscape:;Attribute 'vector-effect' is not allowed to appear in element 'g'.
+svg.validator.messages.ignore=must appear on element;muss in Element;Attribute 'blend' is not allowed to appear in element 'feBlend'.;sodipodi:;inkscape:;Attribute 'vector-effect' is not allowed to appear in element 'g'.;Attribut 'vector-effect' darf nicht in Element 'g' vorkommen.;
+svg.validator.disallow-doctype-decl.enabled=false
+
 systemsettings.http.response.headers={}
 
 datapoint.runtime.value.synchronized=NONE
@@ -119,9 +121,10 @@ comm.serial.sleep=1000
 
 systemsettings.email.timeout=60000
 processing.workitems.limit=51
-processing.workitems.failed.limit=51
 processing.workitems.running.limit=51
 processing.workitems.running.repeat=51
+processing.workitems.history.limit=51
+processing.workitems.history.failed.limit=51
 processing.workitems.history.process.limit=51
 processing.workitems.history.priority.high.limit=51
 processing.workitems.history.priority.medium.limit=51
@@ -139,14 +142,14 @@ view.hideShortcutDisableFullScreen=false
 eventdetector.cache.enabled=true
 event.pending.limit=101
 event.pending.update.limit=5001
-threads.name.additional.length=5
+threads.name.additional.length=255
 workitems.reporting.enabled=false
 workitems.reporting.itemspersecond.enabled=false
 workitems.reporting.itemspersecond.limit=20000
 
 webresource.uploads.path=static/uploads
 webresource.graphics.path=static/graphics
-svg.validator.disallow-doctype-decl.enabled=false
+websocket.client.sockjs.url=../../resources/node_modules/sockjs-client/dist/sockjs.min.js
 
 thread-pool-executor.low-priority.core-pool-size=1
 thread-pool-executor.low-priority.maximum-pool-size=1
@@ -173,4 +176,20 @@ thread-pool-executor.high-priority.keep-alive-time=30
 thread-pool-executor.high-priority.blocking-queue-interface-impl=java.util.concurrent.SynchronousQueue
 thread-pool-executor.high-priority.blocking-queue-interface-impl.args=
 thread-pool-executor.high-priority.blocking-queue-interface-impl.args-types=
-thread-pool-executor.high-priority.time-unit-enum-value=SECONDS
\ No newline at end of file
+thread-pool-executor.high-priority.time-unit-enum-value=SECONDS
+
+workitems.config.BatchWriteBehind.maxRows=2000
+workitems.config.BatchWriteBehind.maxInstances=5
+workitems.config.BatchWriteBehind.spawnThreshold=10000
+
+http.protocol.reject-relative-redirect=true
+http.protocol.method.follow-redirects=false
+http.protocol.max-redirects=100
+http.protocol.allow-circular-redirects=false
+http.protocol.timeout-ms=15000
+event.assign.enabled=true
+
+scadalts.security.http.query.protect.enabled=true
+scadalts.security.http.query.limit=3900
+scadalts.security.http.query.access.denied.regex=^(.*?(javascript:|onerror|onload|onmouseover|alert\\(){1}.*?)$
+scadalts.security.http.query.access.granted.regex=^(([a-zA-Z0-9_\\-]{1,32}=[a-zA-Z0-9_\\-.,/+=\s!$*?@%]*&?)|([a-zA-Z0-9_\\-]{1,32}&?))+$
\ No newline at end of file
diff --git a/test/org/scada_lts/web/security/XssUtilsTest.java b/test/org/scada_lts/web/security/XssUtilsTest.java
new file mode 100644
index 0000000000..00902cfbe8
--- /dev/null
+++ b/test/org/scada_lts/web/security/XssUtilsTest.java
@@ -0,0 +1,122 @@
+package org.scada_lts.web.security;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+import org.junit.runners.Parameterized.Parameters;
+
+import static org.junit.Assert.*;
+
+import java.util.Arrays;
+import java.util.Collection;
+
+@RunWith(Parameterized.class)
+public class XssUtilsTest {
+
+    private final String input;
+    private final boolean expectedResult;
+
+    public XssUtilsTest(String input, boolean expectedResult) {
+        this.input = input;
+        this.expectedResult = expectedResult;
+    }
+
+    @Parameters(name = "{index}: input: {0}, expectedResult: {1}")
+    public static Collection<Object[]> data() {
+        return Arrays.asList(new Object[][]{
+
+                // Test for a legitimate Query
+                {"validUser", true},
+                {"123", true},
+
+                // Tests for queries containing banned patterns.
+                {"javascript:alert(1)", false},
+                {"onerror=alert(1)", false},
+                {"<script>alert(1)</script>", false},
+                {"onload=alert(1)", false},
+                {"onmouseover=alert(1)", false},
+                {"%6A%61%76%61%73%63%72%69%70%74", false},
+
+                // Borderline cases
+                {"=&", false},
+                {"a”.repeat(33)", false},
+                {"invalid!key", false},
+                {"validKey", true},
+                {"onerror=alert(1)&onload=alert(1)", false},
+                {"!key=value", false},
+
+
+                {"abc", true},
+                {"ABC", true},
+                {"abc=abc", true},
+                {"ABC=ABC", true},
+                {"abc=abc&ABC=ABC", true},
+                {"ABC=ABC&abc=abc", true},
+                {"abc=1", true},
+                {"ABC=1", true},
+                {"param123", true},
+                {"param1&param2=23", true},
+                {"param1=12&param2", true},
+                {"param1=12&param2&param3", true},
+                {"param1", true},
+                {"startTs=123", true},
+                {"startTs=1724326168402&endTs=1724329768507", true},
+                {"startTs=123.", true},
+                {"startTs=12345678901234567890123456789012", true},
+                {"startTs=123456789012345678901234567890123", true},
+                {"12345678901234567890123456789012=abc", true},
+                {"123456789012345678901234567890123=abc", true},
+                {"startTs=1724326168402&endTs=1724329768507&ids=101,70,97,84&configFromSystem=false&enabled=false&valuesLimit=10000&limitFactor=1", true},
+                {"projectName=sagadf&includePointValues=true&includeUploadsFolder=true&includeGraphicsFolder=true&projectDescription=&pointValuesMaxZip=100", true},
+                {"abc=", true},
+
+                {"", false},
+                {null, false},
+                {"&param1", false},
+                {"&param1&param2", false},
+                {"&param1=123&param2", false},
+                {"&param1&param=123", false},
+                {"param1&param2=23&onerror", false},
+                {"param1&param2=23onerror", false},
+                {"para!m1", false},
+                {"onerror=alert(1)", false},
+                {"onload=alert(1)", false},
+                {"onerror=abc", false},
+                {"onload=abc", false},
+                {"onload=", false},
+                {"onerror=", false},
+                {"onload", false},
+                {"onerror", false},
+                {"!param1=value", false},
+                {"<img src=x onerror=alert(document.location)>", false},
+                {"param1=<img src=x onerror=alert(document.location)>", false},
+                {"param1=<img src=x onerror=alert(document.location)>&param2=123", false},
+                {"param1=123&param2=<img src=x onerror=alert(document.location)>", false},
+                {"param1=123&param2=<img src=x onerror=document.location>", false},
+                {"param1=alert(document.location)", false},
+                {"=abc", false},
+                {"param1=<script>alert(document.location)", false},
+                {"param1=<scriptalert(document.location)", false},
+                {"param1=script>alert(document.location)", false},
+                {"param1=alert(document.location)</script>", false},
+                {"param1=alert(document.location)/script>", false},
+                {"param1=alert(document.location)</script", false},
+                {"param1=<script>document.location", false},
+                {"param1=<scriptdocument.location", false},
+                {"param1=script>document.location", false},
+                {"param1=document.location</script>", false},
+                {"param1=document.location/script>", false},
+                {"param1=document.location</script", false},
+        });
+    }
+
+    @Test
+    public void testValidate() {
+
+        //when:
+        boolean result = XssUtils.validateHttpQuery(input);
+
+        //then:
+        assertEquals("Validation failed for input: " + input, expectedResult, result);
+    }
+}
diff --git a/test/utils/mock/MockUtils.java b/test/utils/mock/MockUtils.java
index 30b5dd8bb5..57e02d50ba 100644
--- a/test/utils/mock/MockUtils.java
+++ b/test/utils/mock/MockUtils.java
@@ -53,7 +53,7 @@ public static void configMock(RuntimeManager runtimeManager, User user) throws E
         when(Common.getUser()).thenReturn(user);
         when(Common.getUser(any(HttpServletRequest.class))).thenReturn(user);
 
-        PropertiesUtils propertiesUtils = new PropertiesUtils("WEB-INF/classes/env");
+        PropertiesUtils propertiesUtils = new PropertiesUtils("env");
         when(Common.getEnvironmentProfile()).thenReturn(propertiesUtils);
     }
 
diff --git a/webapp-resources/env.properties b/webapp-resources/env.properties
index 9261124db5..84ca3ac51b 100644
--- a/webapp-resources/env.properties
+++ b/webapp-resources/env.properties
@@ -186,3 +186,8 @@ http.protocol.max-redirects=100
 http.protocol.allow-circular-redirects=false
 http.protocol.timeout-ms=15000
 event.assign.enabled=true
+
+scadalts.security.http.query.protect.enabled=true
+scadalts.security.http.query.limit=3900
+scadalts.security.http.query.access.denied.regex=^(.*?(script>|<script|/script>|</script|javascript:|onerror|onload|onmouseover|alert\\(){1}.*?)$
+scadalts.security.http.query.access.granted.regex=^(([a-zA-Z0-9_\\-]{1,32}=[a-zA-Z0-9_\\-.,/+=\s!$*?@%]*&?)|([a-zA-Z0-9_\\-]{1,32}&?))+$
diff --git a/webapp-resources/log4j2.xml b/webapp-resources/log4j2.xml
index 1f094a18bf..498cbf1bfe 100644
--- a/webapp-resources/log4j2.xml
+++ b/webapp-resources/log4j2.xml
@@ -41,6 +41,10 @@
 
         <!-- Parse log4j2.xml Logging-->
         <Property name="log4jLoggingLevel">ERROR</Property>
+
+        <!-- Security Logging-->
+        <Property name="securityLoggingLevel">ERROR</Property>
+
     </Properties>
 
     <Appenders>
@@ -171,6 +175,7 @@
         <Logger name="log_jsp" level="${dwrLoggingLevel}"/>
         <Logger name="org.directwebremoting" level="${dwrLoggingLevel}"/>
         <Logger name="com.serotonin.mango.web.dwr.DataPointEditDwr" level="${dwrLoggingLevel}"/>
+        <Logger name="com.serotonin.mango.web.dwr" level="${dwrLoggingLevel}"/>
 
         <!-- Spring Logging-->
         <Logger name="org.springframework.web.servlet.FrameworkServlet" level="${springLoggingLevel}"/>
@@ -288,6 +293,10 @@
             <AppenderRef ref="ASYNC"/>
         </Logger>
 
+        <!-- Security Logging-->
+        <Logger name="org.scada_lts.web.security" level="${securityLoggingLevel}" />
+        <Logger name="org.springframework.security" level="${securityLoggingLevel}" />
+
         <Root level="${rootLoggingLevel}">
             <AppenderRef ref="STDOUT"/>
             <AppenderRef ref="ASYNC"/>