Hello Philip. My brain hurts. I tried various things like hard coding the base href tag in and putting little messages in html_header.php (which did pass through) but Worldpay ARE definitely filtering out the base href tag due to the new security standards. They say that until the 30th September 2009 you can disable the "Enable whitelisting?" setting in your Worldpay Installation Administration page. I did this and BINGO the "Thank you" and "Order Cancelled" pages display properly... the base href tag is there in the source code. I tried looking at the various sites they point you to for information (www.owasp.org and www.pcisecuritystandards.org) but I got a bit bewildered. I have sent an email to [email protected] (because their stupid contact form doesn't work!) I have explained what the problem is and that it will become a big problem unless they can provide a solution. Something needs to be done or we simply can't use Worldpay with Zencart I imagine.