System settings

Fifty-one settings in the pageblocks namespace, all created by the package installer. The defaults below are what a fresh installation gets.

A missing setting is not the same as its default

MODX returns an empty value for a setting that does not exist, and the code usually reads that as "off". If a feature seems inert, check that the key is actually in System → System settings before changing anything — on a site where the package was delivered by copying files rather than installing, the settings never appeared at all.

Main

Setting	Default	Description
pageblocks_routing	full	Routing mode: Disabled (off), Route Only (routes), Full API (full).
pageblocks_strict_routes	off	Match routes strictly, without lenient fallbacks.
pageblocks_route_cache	off	Cache the compiled route table. Cleared with the MODX cache.
pageblocks_site_mode	prod	Production or Development. See Mail — in dev it stops mail from reaching real users.
pageblocks_versioning	on	Keep a version history of objects, so changes can be rolled back.
pageblocks_moderation	off	The moderation queue: a badge in the top menu, a dashboard widget, and a "Moderation" checkbox in the table constructor.
pageblocks_hide_templates		Template ids where the PageBlocks tab is hidden.
pageblocks_hide_parents		Parent resource ids where the tab is hidden.
pageblocks_hide_resources		Resource ids where the tab is hidden.
pageblocks_hide_users		User ids for whom the tab is hidden.
pageblocks_hide_user_groups		User groups for whom the tab is hidden.

A missing pageblocks_routing is not off

The installer sets full. But when the key is absent entirely, the component reads that as routes: routes work, the full API does not. Routing is only disabled by an explicit off.

Moderation changes your tables

The setting moderates nothing by itself — it reveals the "Moderation" checkbox in the table constructor. A table with that box ticked gets a moderation_at column when saved, and the queue picks rows by that column. Turn the setting off and nothing is queued, and new tables get no column.

It is off by default on purpose: on a site where everything is published straight away, moderation only adds a menu item, a widget and a counter query on every manager page — for a queue that is always empty.

Parser

Setting	Default	Description
pageblocks_elements_path	{core_path}App/elements/	Where file chunks and templates live.
pageblocks_fenom_auto_reload	on	Recompile a template when its source changes. Turn it off on a busy production site — but remember to clear the cache after every template change.
pageblocks_file_elements_only	off	Resolve templates from files only, ignoring MODX chunks.

JavaScript

Class names the front-end scripts put on elements. They default to Bootstrap 5; change them to match your CSS framework rather than fighting it.

Setting	Default	Description
pageblocks_load_scripts	on	Load the component's scripts on the front end.
pageblocks_hidden_class	d-none	Class that hides an element.
pageblocks_field_error	is-invalid	Class added to a field that failed validation.
pageblocks_field_msg_error	invalid-feedback	Class of the error text under such a field.
pageblocks_msg_error	text-error,text-danger	Classes of an error message.
pageblocks_msg_success	text-success	Classes of a success message.

Images

Applied when an image goes through the component's image pipeline.

Setting	Default	Description
pageblocks_image_format	webp	Output format.
pageblocks_image_quality	82	Compression quality.
pageblocks_image_max_width	0	Downscale to this width. 0 means no limit.

Cache

Setting	Default	Description
pageblocks_http_cache	off	Cache whole responses.
pageblocks_http_cache_ttl	3600	Lifetime in seconds.

Mail

Setting	Default	Description
pageblocks_admin_email		Address that still receives mail while the site is in dev mode.
pageblocks_dev_mail_groups	Administrator	User groups that still receive mail in dev mode.

This pair is a safety catch, not a preference

With pageblocks_site_mode = dev, mail only goes to pageblocks_admin_email and to the listed groups; everything else is dropped and the fact is written to the MODX log.

It matters most on a copy of a production database. A staging site restored from a dump inherits prod from that dump, the catch is off, and one cron run mails every user in the table. After restoring a dump, set the mode back to dev before anything else.

API

CORS for the REST API. Off while pageblocks_cors_origins is empty.

Setting	Default	Description
pageblocks_cors_origins		Allowed origins. Empty means CORS is off.
pageblocks_cors_paths	api/*	Paths the headers apply to.
pageblocks_cors_methods	GET,POST,PUT,PATCH,DELETE,OPTIONS	Allowed methods.
pageblocks_cors_headers	Authorization,Content-Type,X-Requested-With,X-API-Key	Allowed request headers.
pageblocks_cors_expose_headers		Response headers exposed to the browser.
pageblocks_cors_credentials	off	Allow credentials.
pageblocks_cors_max_age	86400	Preflight cache lifetime, in seconds.

Blocks

Setting	Default	Description
pageblocks_block_groups		Groups blocks are sorted into in the constructor.

Security

Headers the component adds to the response. In full: Security headers.

Setting	Default	Description
pageblocks_security_headers	on	Send security headers at all. Turning it off disables every header below, filled in or not.
pageblocks_security_frame_options	SAMEORIGIN	X-Frame-Options: who may open the site in a frame. DENY means nobody.
pageblocks_security_referrer_policy	strict-origin-when-cross-origin	Referrer-Policy: how much of the address another site sees on a click-through.
pageblocks_security_permissions_policy		Permissions-Policy: which browser features are denied. Empty means do not send — denying geolocation breaks maps.
pageblocks_security_hsts	0	Strict-Transport-Security, in seconds. 0 is off. Sent over https only.
pageblocks_security_csp		Content-Security-Policy: where the page may load scripts, styles and images from.

An empty value means "do not send this header". The three that are filled in work right after installation because they break nothing; the three empty ones need a deliberate decision.

HSTS and CSP can take a working site down

Browsers remember HSTS for a long time and will not fall back to http — enable it only once https works across the whole site. CSP breaks inline scripts and third-party widgets. Tune both on a copy, not in production.

Maps

The provider for the Map field is chosen once per site.

Setting	Default	Description
pageblocks_map_type	leaflet	leaflet — OpenStreetMap, works without a key. ymaps — Yandex Maps.
pageblocks_yandex_apikey		The key for ymaps, from the Yandex developer dashboard. Without it the map stays blank.

ReCAPTCHA

Keys for the recaptcha middleware — see Middleware.

Setting	Default	Description
pageblocks_recaptcha_service	Google reCAPTCHA	The anti-spam service in use.
pageblocks_recaptcha_public_key		Site key, rendered into the front-end form.
pageblocks_recaptcha_secret_key		Secret key, used to verify the token on the server.

The settings switch nothing on by themselves: an empty secret key is what the middleware reads as "verification off", and the request passes through.

License

There is one field to fill in here. The component maintains the rest — see Editions.

Setting	Default	Description
pageblocks_license_api_key		The key from your purchase email. Paste it and the component takes a licence for the current domain — you do not name the domain when buying.
pageblocks_license_key		Filled in for you: the issued licence key, PB1.xxx.yyy.
pageblocks_license_server	https://boshnik.com/…	Where licences are issued. Change it only if asked to.
pageblocks_license_try		Internal, filled in automatically.
pageblocks_license_state		Internal, filled in automatically.

Translation is not here

API keys, models and prompts for machine translation are not system settings. Each translator is a row with its own key and model — see Translators.