diff --git a/graphics/src/main/java/uk/ac/rdg/resc/edal/graphics/style/sld/StyleSLDParser.java b/graphics/src/main/java/uk/ac/rdg/resc/edal/graphics/style/sld/StyleSLDParser.java
index baa5869f1..aeb8b70ce 100644
--- a/graphics/src/main/java/uk/ac/rdg/resc/edal/graphics/style/sld/StyleSLDParser.java
+++ b/graphics/src/main/java/uk/ac/rdg/resc/edal/graphics/style/sld/StyleSLDParser.java
@@ -271,6 +271,8 @@ private static Document readXMLString(String xmlString) throws ParserConfigurati
             SAXException, IOException, IllegalArgumentException {
         DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
         builderFactory.setNamespaceAware(true);
+        builderFactory.setXIncludeAware(false);
+        builderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
         // Uncomment to turn on schema validation
         // builderFactory.setValidating(true);
         try {
diff --git a/wms/src/main/java/uk/ac/rdg/resc/edal/wms/GetMapStyleParams.java b/wms/src/main/java/uk/ac/rdg/resc/edal/wms/GetMapStyleParams.java
index 7f48fdb51..4043e1b5b 100644
--- a/wms/src/main/java/uk/ac/rdg/resc/edal/wms/GetMapStyleParams.java
+++ b/wms/src/main/java/uk/ac/rdg/resc/edal/wms/GetMapStyleParams.java
@@ -128,6 +128,11 @@ public GetMapStyleParams(RequestParams params, WmsCatalogue catalogue) throws Ed
             URL url;
             try {
                 url = new URL(xmlLoc);
+                String protocol = url.getProtocol();
+                if (!protocol.startsWith("http")) {
+                  throw new EdalException(
+                      "Reading SLD using protocol " + protocol + " is not supported");
+                }
                 InputStream is = url.openStream();
                 StringWriter writer = new StringWriter();
                 IOUtils.copy(is, writer);