These
Security Notes are not meant to be a replacement for a good
understanding of web security. They will allow you to set up a reasonably secure
'phpTopsites' install, but do not count on them to cover everything. Take responsibility for the integrity of your
own web site...
Learn the security basics, and remember: a little paranoia is a good thing.
You must protect your /admin directory using whatever resources you have
available. If you are using an Apache web server, then a standard
.htaccess file is the way to go. [Apache
Documentation]
If you are using some other less
popular web server, then contact your system admin for assistance.
"Common Sense Security" is not a bad idea
either. Renaming the /admin directory to something really
strange like "/d23#@$fasd" so that it
can't easily be guessed and pulled up in a browser, will work in a pinch.
Users on shared systems, such as having an "account" with a
Web Hosting Provider, will definitely need some form of directory
security, as anyone could browse into your directory and have easy
access to your config.php file. Not all systems are the same, and
your particular setup may vary. If you are on a shared system, chances
are good that a standard method of securing a directory from other users has
already been devised. You should contact
your system admin for assistance in securing the /admin
directory.
I myself do not claim to be an expert at any of this php/mysql stuff. I'm sure
there is tons of room for improvement and enhancement all around.
The code always needs lots of work. Ideas,
requests, and comments can be posted and discussed at my Support
Forum.
|