phpTopsites Admin - Security Notes

phpTopsites Security Notes

These Security Notes are not meant to be a replacement for a good understanding of web security. They will allow you to set up a reasonably secure 'phpTopsites' install, but do not count on them to cover everything. Take responsibility for the integrity of your own web site... Learn the security basics, and remember: a little paranoia is a good thing.

You must protect your
/admin directory using whatever resources you have available.  If you are using an Apache web server, then a standard .htaccess file is the way to go. [Apache Documentation] If you are using some other less popular web server, then contact your system admin for assistance.

"Common Sense Security" is not a bad idea either.  Renaming the
/admin directory to something really strange like "/d23#@$fasd" so that it can't easily be guessed and pulled up in a browser, will work in a pinch.

Users on shared systems, such as having an "account" with a Web Hosting Provider, will definitely need some form of directory security, as anyone could browse into your directory and have easy access to your config.php file. Not all systems are the same, and your particular setup may vary. If you are on a shared system, chances are good that a standard method of securing a directory from other users has already been devised.  You should contact your system admin for assistance in securing the
/admin directory.

I myself do not claim to be an expert at any of this php/mysql stuff.  I'm sure there is tons of room for improvement and enhancement all around.  The code always needs lots of work.  Ideas, requests, and comments can be posted and discussed at my Support Forum.

Copyright © 1999 phpTopsites All Rights Reserved - code v1.3