diff --git a/src/sbbs3/ftpsrvr.c b/src/sbbs3/ftpsrvr.c
index 1ae545c2d07809fcc83534f47fff540286ae7b85..c52021bbca6199f9fa3f2e5145bb2238a87caa27 100644
--- a/src/sbbs3/ftpsrvr.c
+++ b/src/sbbs3/ftpsrvr.c
@@ -496,11 +496,11 @@ js_initcx(JSRuntime* runtime, SOCKET sock, JSObject** glob, JSObject** ftp)
 			break;
 
 		if((*ftp=JS_DefineObject(js_cx, js_glob, "ftp", &js_ftp_class
-			,NULL,0))==NULL)
+			,NULL,JSPROP_ENUMERATE|JSPROP_READONLY))==NULL)
 			break;
 
 		if((server=JS_DefineObject(js_cx, js_glob, "server", &js_server_class
-			,NULL,0))==NULL)
+			,NULL,JSPROP_ENUMERATE|JSPROP_READONLY))==NULL)
 			break;
 
 		sprintf(ver,"%s %s",FTP_SERVER,revision);
diff --git a/src/sbbs3/js_bbs.cpp b/src/sbbs3/js_bbs.cpp
index 5fa7ffb17d0512096af612ba2a4ff26eb864aab2..b216d24e882ee316a34e6fbf839259f46d6d587b 100644
--- a/src/sbbs3/js_bbs.cpp
+++ b/src/sbbs3/js_bbs.cpp
@@ -2745,7 +2745,8 @@ JSObject* js_CreateBbsObject(JSContext* cx, JSObject* parent)
 {
 	JSObject* obj;
 
-	obj = JS_DefineObject(cx, parent, "bbs", &js_bbs_class, NULL, JSPROP_ENUMERATE);
+	obj = JS_DefineObject(cx, parent, "bbs", &js_bbs_class, NULL
+		,JSPROP_ENUMERATE|JSPROP_READONLY);
 
 	if(obj==NULL)
 		return(NULL);
diff --git a/src/sbbs3/js_client.c b/src/sbbs3/js_client.c
index ee6996f39ebaff0e3205bfe7fc2cb216f0a3ac45..20758ac51172e000723fcb94bfd706b102985066 100644
--- a/src/sbbs3/js_client.c
+++ b/src/sbbs3/js_client.c
@@ -145,7 +145,8 @@ JSObject* DLLCALL js_CreateClientObject(JSContext* cx, JSObject* parent
 {
 	JSObject*	obj;
 
-	obj = JS_DefineObject(cx, parent, name, &js_client_class, NULL, JSPROP_ENUMERATE);
+	obj = JS_DefineObject(cx, parent, name, &js_client_class, NULL
+		,JSPROP_ENUMERATE|JSPROP_READONLY);
 
 	if(obj==NULL)
 		return(NULL);
diff --git a/src/sbbs3/js_console.cpp b/src/sbbs3/js_console.cpp
index 4ca11fd01d9b2c9d464a2901eca97ebf21dedbbb..d5b67002ba1dc82ebbcea835ca738ac1a5885c95 100644
--- a/src/sbbs3/js_console.cpp
+++ b/src/sbbs3/js_console.cpp
@@ -1199,7 +1199,8 @@ JSObject* js_CreateConsoleObject(JSContext* cx, JSObject* parent)
 	if((sbbs=(sbbs_t*)JS_GetContextPrivate(cx))==NULL)
 		return(NULL);
 
-	if((obj=JS_DefineObject(cx, parent, "console", &js_console_class, NULL, JSPROP_ENUMERATE))==NULL)
+	if((obj=JS_DefineObject(cx, parent, "console", &js_console_class, NULL
+		,JSPROP_ENUMERATE|JSPROP_READONLY))==NULL)
 		return(NULL);
 
 	if(!JS_DefineProperties(cx, obj, js_console_properties))
diff --git a/src/sbbs3/js_file.c b/src/sbbs3/js_file.c
index 2c2347116024521fc3366fccef12032b6bbc8a87..d91ca002cb21926e9d0ac71c388f5780f72f436b 100644
--- a/src/sbbs3/js_file.c
+++ b/src/sbbs3/js_file.c
@@ -1123,7 +1123,8 @@ JSObject* DLLCALL js_CreateFileObject(JSContext* cx, JSObject* parent, char *nam
 	JSObject* obj;
 	private_t*	p;
 
-	obj = JS_DefineObject(cx, parent, name, &js_file_class, NULL, JSPROP_ENUMERATE);
+	obj = JS_DefineObject(cx, parent, name, &js_file_class, NULL
+		,JSPROP_ENUMERATE|JSPROP_READONLY);
 
 	if(obj==NULL)
 		return(NULL);
diff --git a/src/sbbs3/js_file_area.c b/src/sbbs3/js_file_area.c
index 541f84eb2dd543be33246094acfa2dd82a5904f7..ad0168c3152ceb51acf6d4fad178f511ea8fea92 100644
--- a/src/sbbs3/js_file_area.c
+++ b/src/sbbs3/js_file_area.c
@@ -72,7 +72,7 @@ JSObject* DLLCALL js_CreateFileAreaObject(JSContext* cx, JSObject* parent, scfg_
 		areaobj = JSVAL_TO_OBJECT(val);
 	else
 		areaobj = JS_DefineObject(cx, parent, "file_area", &js_file_area_class
-								, NULL, JSPROP_ENUMERATE);
+								, NULL, JSPROP_ENUMERATE|JSPROP_READONLY);
 	if(areaobj==NULL)
 		return(NULL);
 
diff --git a/src/sbbs3/js_msg_area.c b/src/sbbs3/js_msg_area.c
index 6ff9395a43df8f69591b1e632f91c83908b83f9f..47ae73dfb247fa258b0590de803862644cc66d7f 100644
--- a/src/sbbs3/js_msg_area.c
+++ b/src/sbbs3/js_msg_area.c
@@ -161,7 +161,7 @@ JSObject* DLLCALL js_CreateMsgAreaObject(JSContext* cx, JSObject* parent, scfg_t
 		areaobj = JSVAL_TO_OBJECT(val);
 	else
 		areaobj = JS_DefineObject(cx, parent, "msg_area", &js_msg_area_class
-									, NULL, JSPROP_ENUMERATE);
+									, NULL, JSPROP_ENUMERATE|JSPROP_READONLY);
 
 	if(areaobj==NULL)
 		return(NULL);
diff --git a/src/sbbs3/js_socket.c b/src/sbbs3/js_socket.c
index 586b34a81da892bb15e7f433c9f2833c633d3fe7..62430991746a21e4f50e2721907dd350ce439203 100644
--- a/src/sbbs3/js_socket.c
+++ b/src/sbbs3/js_socket.c
@@ -1325,7 +1325,8 @@ JSObject* DLLCALL js_CreateSocketObject(JSContext* cx, JSObject* parent, char *n
 	JSObject* obj;
 	private_t*	p;
 
-	obj = JS_DefineObject(cx, parent, name, &js_socket_class, NULL, JSPROP_ENUMERATE);
+	obj = JS_DefineObject(cx, parent, name, &js_socket_class, NULL
+		,JSPROP_ENUMERATE|JSPROP_READONLY);
 
 	if(obj==NULL)
 		return(NULL);
diff --git a/src/sbbs3/js_system.c b/src/sbbs3/js_system.c
index 1b46da84533fe71d433bfe0ae16a41782ad210c8..a488628d741374628f52edc208fc254318399cb6 100644
--- a/src/sbbs3/js_system.c
+++ b/src/sbbs3/js_system.c
@@ -1411,7 +1411,8 @@ JSObject* DLLCALL js_CreateSystemObject(JSContext* cx, JSObject* parent
 	JSObject*	node_list;
 	JSString*	js_str;
 
-	sysobj = JS_DefineObject(cx, parent, "system", &js_system_class, NULL, JSPROP_ENUMERATE);
+	sysobj = JS_DefineObject(cx, parent, "system", &js_system_class, NULL
+		,JSPROP_ENUMERATE|JSPROP_READONLY);
 
 	if(sysobj==NULL)
 		return(NULL);
@@ -1526,7 +1527,8 @@ JSObject* DLLCALL js_CreateSystemObject(JSContext* cx, JSObject* parent
 	if(!JS_SetProperty(cx, sysobj, "uptime", &val))
 		return(NULL);
 
-	statsobj = JS_DefineObject(cx, sysobj, "stats", &js_sysstats_class, NULL, JSPROP_ENUMERATE);
+	statsobj = JS_DefineObject(cx, sysobj, "stats", &js_sysstats_class, NULL
+		,JSPROP_ENUMERATE|JSPROP_READONLY);
 
 	if(statsobj==NULL)
 		return(NULL);
diff --git a/src/sbbs3/js_user.c b/src/sbbs3/js_user.c
index 26ae85ffd769f688360994b816bed1f20640b44a..08772c2c62c76327a287f660c4d3d65cedaa5c47 100644
--- a/src/sbbs3/js_user.c
+++ b/src/sbbs3/js_user.c
@@ -807,14 +807,14 @@ js_user_constructor(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval
 
 	/* user.stats */
 	if((statsobj=JS_DefineObject(cx, obj, "stats"
-		,&js_user_stats_class, NULL, JSPROP_ENUMERATE))==NULL) 
+		,&js_user_stats_class, NULL, JSPROP_ENUMERATE|JSPROP_READONLY))==NULL) 
 		return(JS_FALSE);
 
 	JS_DefineProperties(cx, statsobj, js_user_stats_properties);
 
 	/* user.security */
 	if((securityobj=JS_DefineObject(cx, obj, "security"
-		,&js_user_security_class, NULL, JSPROP_ENUMERATE))==NULL) 
+		,&js_user_security_class, NULL, JSPROP_ENUMERATE|JSPROP_READONLY))==NULL) 
 		return(JS_FALSE);
 
 	JS_DefineProperties(cx, securityobj, js_user_security_properties);
@@ -864,7 +864,7 @@ JSObject* DLLCALL js_CreateUserObject(JSContext* cx, JSObject* parent, scfg_t* c
 		userobj = JSVAL_TO_OBJECT(val);
 	else
 		userobj = JS_DefineObject(cx, parent, name, &js_user_class
-								, NULL, JSPROP_ENUMERATE);
+								, NULL, JSPROP_ENUMERATE|JSPROP_READONLY);
 	if(userobj==NULL)
 		return(NULL);
 
@@ -891,7 +891,7 @@ JSObject* DLLCALL js_CreateUserObject(JSContext* cx, JSObject* parent, scfg_t* c
 
 	/* user.stats */
 	statsobj = JS_DefineObject(cx, userobj, "stats"
-		,&js_user_stats_class, NULL, JSPROP_ENUMERATE);
+		,&js_user_stats_class, NULL, JSPROP_ENUMERATE|JSPROP_READONLY);
 
 	if(statsobj==NULL) {
 		free(p);
@@ -909,7 +909,7 @@ JSObject* DLLCALL js_CreateUserObject(JSContext* cx, JSObject* parent, scfg_t* c
 
 	/* user.security */
 	securityobj = JS_DefineObject(cx, userobj, "security"
-		,&js_user_security_class, NULL, JSPROP_ENUMERATE);
+		,&js_user_security_class, NULL, JSPROP_ENUMERATE|JSPROP_READONLY);
 
 	if(securityobj==NULL) {
 		free(p);
diff --git a/src/sbbs3/js_xtrn_area.c b/src/sbbs3/js_xtrn_area.c
index a977c8640a475bc963de5ff0685318382c800870..d5e09f7c69f619435a89717ae4fe58c02dcdd27a 100644
--- a/src/sbbs3/js_xtrn_area.c
+++ b/src/sbbs3/js_xtrn_area.c
@@ -146,7 +146,7 @@ JSObject* DLLCALL js_CreateXtrnAreaObject(JSContext* cx, JSObject* parent, scfg_
 		areaobj = JSVAL_TO_OBJECT(val);
 	else
 		areaobj = JS_DefineObject(cx, parent, "xtrn_area", &js_xtrn_area_class
-									, NULL, JSPROP_ENUMERATE);
+									, NULL, JSPROP_ENUMERATE|JSPROP_READONLY);
 
 	if(areaobj==NULL)
 		return(NULL);
diff --git a/src/sbbs3/main.cpp b/src/sbbs3/main.cpp
index 84133d32fe7888f405509e1b8dc5b0f4159ad0e4..e123c199b41292685564de0418a4dac584dcdd6a 100644
--- a/src/sbbs3/main.cpp
+++ b/src/sbbs3/main.cpp
@@ -735,7 +735,7 @@ bool sbbs_t::js_init()
 
 		/* Server Object */
 		if((server=JS_DefineObject(js_cx, js_glob, "server", &js_server_class
-			,NULL,JSPROP_ENUMERATE))==NULL)
+			,NULL,JSPROP_ENUMERATE|JSPROP_READONLY))==NULL)
 			break;
 
 		js_DescribeObject(js_cx,server,"Server-specifc properties");
diff --git a/src/sbbs3/services.c b/src/sbbs3/services.c
index 1ba8bda48b6ce3c76b57c687d714aa792f4e9ba1..7300efc1ac96f0da1f0151aa976cce36bb172e42 100644
--- a/src/sbbs3/services.c
+++ b/src/sbbs3/services.c
@@ -609,7 +609,7 @@ js_initcx(JSRuntime* js_runtime, SOCKET sock, service_client_t* service_client,
 		
 		/* server object */
 		if((server=JS_DefineObject(js_cx, js_glob, "server", &js_server_class
-			,NULL,JSPROP_ENUMERATE))==NULL)
+			,NULL,JSPROP_ENUMERATE|JSPROP_READONLY))==NULL)
 			break;
 
 		if(!JS_DefineProperties(js_cx, server, js_server_properties))
diff --git a/src/sbbs3/websrvr.c b/src/sbbs3/websrvr.c
index 6c43e06253acb9e66e4e946a4c911a36389af6e8..0628ed28c3396acd1c3f21746b44718586e715f7 100644
--- a/src/sbbs3/websrvr.c
+++ b/src/sbbs3/websrvr.c
@@ -1786,7 +1786,7 @@ JSObject* DLLCALL js_CreateHttpReplyObject(JSContext* cx
 	}
 	else
 		reply = JS_DefineObject(cx, parent, "http_reply", NULL
-									, NULL, JSPROP_ENUMERATE);
+									, NULL, JSPROP_ENUMERATE|JSPROP_READONLY);
 
 	if((js_str=JS_NewStringCopyZ(cx, "200 OK"))==NULL)
 		return(FALSE);
@@ -1800,7 +1800,7 @@ JSObject* DLLCALL js_CreateHttpReplyObject(JSContext* cx
 	}
 	else
 		headers = JS_DefineObject(cx, reply, "header", NULL
-									, NULL, JSPROP_ENUMERATE);
+									, NULL, JSPROP_ENUMERATE|JSPROP_READONLY);
 
 	if((js_str=JS_NewStringCopyZ(cx, "text/html"))==NULL)
 		return(FALSE);
@@ -1826,7 +1826,7 @@ JSObject* DLLCALL js_CreateHttpRequestObject(JSContext* cx
 	}
 	else
 		request = JS_DefineObject(cx, parent, "http_request", NULL
-									, NULL, JSPROP_ENUMERATE);
+									, NULL, JSPROP_ENUMERATE|JSPROP_READONLY);
 
 	if((js_str=JS_NewStringCopyZ(session->js_cx, methods[session->req.method]))==NULL)
 		return(FALSE);
@@ -1845,7 +1845,7 @@ JSObject* DLLCALL js_CreateHttpRequestObject(JSContext* cx
 	}
 	else
 		query = JS_DefineObject(cx, request, "query", NULL
-									, NULL, JSPROP_ENUMERATE);
+									, NULL, JSPROP_ENUMERATE|JSPROP_READONLY);
 
 	
 	/* Return existing object if it's already been created */
@@ -1855,7 +1855,7 @@ JSObject* DLLCALL js_CreateHttpRequestObject(JSContext* cx
 	}
 	else
 		headers = JS_DefineObject(cx, request, "header", NULL
-									, NULL, JSPROP_ENUMERATE);
+									, NULL, JSPROP_ENUMERATE|JSPROP_READONLY);
 
 	session->js_query=query;
 	session->js_header=headers;
@@ -1990,7 +1990,8 @@ js_initcx(JSRuntime* runtime, SOCKET sock, JSObject** glob, http_session_t *sess
 		if(js_CreateSystemObject(js_cx, js_glob, &scfg, uptime, startup->host_name)==NULL) 
 			break;
 
-		if((server=JS_DefineObject(js_cx, js_glob, "server", NULL,NULL,0))==NULL)
+		if((server=JS_DefineObject(js_cx, js_glob, "server", NULL,NULL
+			,JSPROP_ENUMERATE|JSPROP_READONLY))==NULL)
 			break;
 
 		sprintf(ver,"%s %s",server_name,revision);