diff --git a/jspwiki-http/src/main/resources/META-INF/web-fragment.xml b/jspwiki-http/src/main/resources/META-INF/web-fragment.xml
deleted file mode 100644
index ca276a2d6b..0000000000
--- a/jspwiki-http/src/main/resources/META-INF/web-fragment.xml
+++ /dev/null
@@ -1,99 +0,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!--
-    Licensed to the Apache Software Foundation (ASF) under one
-    or more contributor license agreements.  See the NOTICE file
-    distributed with this work for additional information
-    regarding copyright ownership.  The ASF licenses this file
-    to you under the Apache License, Version 2.0 (the
-    "License"); you may not use this file except in compliance
-    with the License.  You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-    Unless required by applicable law or agreed to in writing,
-    software distributed under the License is distributed on an
-    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-    KIND, either express or implied.  See the License for the
-    specific language governing permissions and limitations
-    under the License.
--->
-
-<web-fragment xmlns="http://java.sun.com/xml/ns/javaee"
-              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-fragment_3_0.xsd"
-              version="3.0">
-    <filter>
-      <filter-name>CsrfProtectionFilter</filter-name>
-      <filter-class>org.apache.wiki.http.filter.CsrfProtectionFilter</filter-class>
-    </filter>
-
-    <filter-mapping>
-      <filter-name>CsrfProtectionFilter</filter-name>
-      <url-pattern>/*</url-pattern>
-    </filter-mapping>
-
-    <!-- optional set of servlet filters which inject OWASP recommended
-         http response headers into all outbound responses.
-         most have optional init parameters that can be used to customize the output
-    -->
-    <filter>
-        <filter-name>COEPFilter</filter-name>
-        <filter-class>org.apache.wiki.http.filter.COEPFilter</filter-class>
-    </filter>
-
-    <filter-mapping>
-        <filter-name>COEPFilter</filter-name>
-        <url-pattern>/*</url-pattern>
-    </filter-mapping>
-
-    <filter>
-        <filter-name>CORPFilter</filter-name>
-        <filter-class>org.apache.wiki.http.filter.CORPFilter</filter-class>
-    </filter>
-
-    <filter-mapping>
-        <filter-name>CORPFilter</filter-name>
-        <url-pattern>/*</url-pattern>
-    </filter-mapping>
-
-    <filter>
-        <filter-name>ContentTypeOptionsFilter</filter-name>
-        <filter-class>org.apache.wiki.http.filter.ContentTypeOptionsFilter</filter-class>
-    </filter>
-
-    <filter-mapping>
-        <filter-name>ContentTypeOptionsFilter</filter-name>
-        <url-pattern>/*</url-pattern>
-    </filter-mapping>
-
-    <filter>
-        <filter-name>CrossDomainFilter</filter-name>
-        <filter-class>org.apache.wiki.http.filter.CrossDomainFilter</filter-class>
-    </filter>
-
-    <filter-mapping>
-        <filter-name>CrossDomainFilter</filter-name>
-        <url-pattern>/*</url-pattern>
-    </filter-mapping>
-
-    <filter>
-        <filter-name>ReferrerPolicyFilter</filter-name>
-        <filter-class>org.apache.wiki.http.filter.ReferrerPolicyFilter</filter-class>
-    </filter>
-
-    <filter-mapping>
-        <filter-name>ReferrerPolicyFilter</filter-name>
-        <url-pattern>/*</url-pattern>
-    </filter-mapping>
-
-    <filter>
-        <filter-name>STSFilter</filter-name>
-        <filter-class>org.apache.wiki.http.filter.STSFilter</filter-class>
-    </filter>
-
-    <filter-mapping>
-        <filter-name>STSFilter</filter-name>
-        <url-pattern>/*</url-pattern>
-    </filter-mapping>
-
-</web-fragment>
\ No newline at end of file
diff --git a/jspwiki-util/src/main/java/org/apache/wiki/util/PropertyReader.java b/jspwiki-util/src/main/java/org/apache/wiki/util/PropertyReader.java
index e076e34951..c70f1bca6e 100644
--- a/jspwiki-util/src/main/java/org/apache/wiki/util/PropertyReader.java
+++ b/jspwiki-util/src/main/java/org/apache/wiki/util/PropertyReader.java
@@ -469,7 +469,7 @@ static void setWorkDir( final ServletContext servletContext, final Properties pr
                 LOG.info("ServletContext's temporary directory not found. Setting jspwiki.workDir to system's temporary directory: {}", defaultTmpDir);
             }
         } else {
-            LOG.info("jspwiki.workDir is already set to: {}", workDir);
+            LOG.debug("jspwiki.workDir is already set to: {}", workDir);
         }
     }
 
diff --git a/jspwiki-war/src/main/webapp/Delete.jsp b/jspwiki-war/src/main/webapp/Delete.jsp
index 1081b5c20e..345341eab2 100644
--- a/jspwiki-war/src/main/webapp/Delete.jsp
+++ b/jspwiki-war/src/main/webapp/Delete.jsp
@@ -29,6 +29,7 @@
 <%@ page import="org.apache.wiki.tags.BreadcrumbsTag" %>
 <%@ page import="org.apache.wiki.tags.BreadcrumbsTag.FixedQueue" %>
 <%@ page import="org.apache.wiki.ui.TemplateManager" %>
+<%@ page import="org.apache.wiki.http.filter.CsrfProtectionFilter" %>
 <%@ page import="org.apache.wiki.util.HttpUtil" %>
 <%@ page import="org.apache.wiki.util.TextUtil" %>
 <%@ page errorPage="/Error.jsp" %>
@@ -39,6 +40,10 @@
 %>
 
 <%
+    if( !CsrfProtectionFilter.isCsrfProtectedPost( request ) ) {
+        response.sendRedirect( "/error/Forbidden.html" );
+        return;
+    }
     Engine wiki = Wiki.engine().find( getServletConfig() );
     // Create wiki context and check for authorization
     Context wikiContext = Wiki.context().create( wiki, request, ContextEnum.PAGE_DELETE.getRequestContext() );
diff --git a/jspwiki-war/src/main/webapp/Install.jsp b/jspwiki-war/src/main/webapp/Install.jsp
index 0f7a7fd285..7c578959b5 100644
--- a/jspwiki-war/src/main/webapp/Install.jsp
+++ b/jspwiki-war/src/main/webapp/Install.jsp
@@ -29,6 +29,7 @@
 <%@ page import="org.apache.logging.log4j.LogManager" %>
 <%@ page import="java.util.ResourceBundle" %>
 <%@ page import="java.text.MessageFormat" %>
+<%@ page import="org.apache.wiki.http.filter.CsrfProtectionFilter" %>
 <%@ taglib prefix="fmt" uri="jakarta.tags.fmt" %>
 <fmt:setBundle basename="CoreResources"/>
 
@@ -54,6 +55,10 @@ ResourceBundle rb = Preferences.getBundle( wikiContext, "CoreResources" );
 // If user hit "submit" button, validate and install them
 if( request.getParameter("submit") != null )
 {
+    if( !CsrfProtectionFilter.isCsrfProtectedPost( request ) ) {
+        response.sendRedirect( "/error/Forbidden.html" );
+        return;
+    }
     validated = installer.validateProperties();
     if ( validated )
     {
diff --git a/jspwiki-war/src/main/webapp/Rename.jsp b/jspwiki-war/src/main/webapp/Rename.jsp
index d456ac2632..8eeb57f5ce 100644
--- a/jspwiki-war/src/main/webapp/Rename.jsp
+++ b/jspwiki-war/src/main/webapp/Rename.jsp
@@ -32,6 +32,7 @@
 <%@ page import="org.apache.wiki.tags.BreadcrumbsTag.FixedQueue" %>
 <%@ page import="org.apache.wiki.ui.TemplateManager" %>
 <%@ page import="org.apache.wiki.util.TextUtil" %>
+<%@ page import="org.apache.wiki.http.filter.CsrfProtectionFilter" %>
 <%@ page errorPage="/Error.jsp" %>
 <%@ taglib uri="http://jspwiki.apache.org/tags" prefix="wiki" %>
 <%@ taglib prefix="fmt" uri="jakarta.tags.fmt" %>
@@ -41,6 +42,10 @@
 %>
 
 <%
+    if( !CsrfProtectionFilter.isCsrfProtectedPost( request ) ) {
+        response.sendRedirect( "/error/Forbidden.html" );
+        return;
+    }
     Engine wiki = Wiki.engine().find( getServletConfig() );
     // Create wiki context and check for authorization
 	Context wikiContext = Wiki.context().create( wiki, request, ContextEnum.PAGE_RENAME.getRequestContext() );
diff --git a/jspwiki-war/src/main/webapp/WEB-INF/web.xml b/jspwiki-war/src/main/webapp/WEB-INF/web.xml
index 83da270d2d..86bf0d69ae 100644
--- a/jspwiki-war/src/main/webapp/WEB-INF/web.xml
+++ b/jspwiki-war/src/main/webapp/WEB-INF/web.xml
@@ -86,6 +86,80 @@
      <url-pattern>/wiki/*</url-pattern>
      <url-pattern>*.jsp</url-pattern>
    </filter-mapping>
+   
+   <filter>
+      <filter-name>CsrfProtectionFilter</filter-name>
+      <filter-class>org.apache.wiki.http.filter.CsrfProtectionFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+      <filter-name>CsrfProtectionFilter</filter-name>
+      <url-pattern>/*</url-pattern>
+    </filter-mapping>
+
+    <!-- optional set of servlet filters which inject OWASP recommended
+         http response headers into all outbound responses.
+         most have optional init parameters that can be used to customize the output
+    -->
+    <filter>
+        <filter-name>COEPFilter</filter-name>
+        <filter-class>org.apache.wiki.http.filter.COEPFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>COEPFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+
+    <filter>
+        <filter-name>CORPFilter</filter-name>
+        <filter-class>org.apache.wiki.http.filter.CORPFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>CORPFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+
+    <filter>
+        <filter-name>ContentTypeOptionsFilter</filter-name>
+        <filter-class>org.apache.wiki.http.filter.ContentTypeOptionsFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>ContentTypeOptionsFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+
+    <filter>
+        <filter-name>CrossDomainFilter</filter-name>
+        <filter-class>org.apache.wiki.http.filter.CrossDomainFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>CrossDomainFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+
+    <filter>
+        <filter-name>ReferrerPolicyFilter</filter-name>
+        <filter-class>org.apache.wiki.http.filter.ReferrerPolicyFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>ReferrerPolicyFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+
+    <filter>
+        <filter-name>STSFilter</filter-name>
+        <filter-class>org.apache.wiki.http.filter.STSFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>STSFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
 
    <session-config>
        <session-timeout>10</session-timeout>
diff --git a/jspwiki-war/src/main/webapp/Workflow.jsp b/jspwiki-war/src/main/webapp/Workflow.jsp
index 67d26388db..23b4721867 100644
--- a/jspwiki-war/src/main/webapp/Workflow.jsp
+++ b/jspwiki-war/src/main/webapp/Workflow.jsp
@@ -34,6 +34,7 @@
 <%@ page import="org.apache.wiki.workflow.NoSuchOutcomeException" %>
 <%@ page import="org.apache.wiki.workflow.Outcome" %>
 <%@ page import="org.apache.wiki.workflow.Workflow" %>
+<%@ page import="org.apache.wiki.http.filter.CsrfProtectionFilter" %>
 <%@ page import="org.apache.wiki.workflow.WorkflowManager" %>
 <%@ page errorPage="/Error.jsp" %>
 <%@ taglib uri="http://jspwiki.apache.org/tags" prefix="wiki" %>
@@ -55,6 +56,10 @@
 
     if( "decide".equals(request.getParameter("action")) )
     {
+        if( !CsrfProtectionFilter.isCsrfProtectedPost( request ) ) {
+            response.sendRedirect( "/error/Forbidden.html" );
+            return;
+        }
         try
         {
           // Extract parameters for decision ID & decision outcome
@@ -78,6 +83,10 @@
     }
     if( "abort".equals(request.getParameter("action")) )
     {
+        if( !CsrfProtectionFilter.isCsrfProtectedPost( request ) ) {
+            response.sendRedirect( "/error/Forbidden.html" );
+            return;
+        }
         try
         {
           // Extract parameters for decision ID & decision outcome