Difference between revisions of "Security Checks"

From Phoenix Cart User Guide
Line 11: Line 11:
 
[[File:securitychecks2.png|link=]]
 
[[File:securitychecks2.png|link=]]
 
</div>
 
</div>
−
*Instructions forSee <big>'''[[How to Secure]]'''</big>
+
[[File:securewarnings1.png|link=]]
 +
 
 +
*Add a second level of password protection to the '''youradmin''' folder/directory on the server.
 +
**From the admin dashboard go to '''Configuration &rarr; Administrators''' to see this:
 +
<div class="mainpage_box">
 +
[[File:administrators1.png|link=|1500px]]
 +
</div>
 +
 
 +
 
 +
*Click <span class="btn-blue">Edit</span> to see this:
 +
<div class="mainpage_box">
 +
[[File:administrators3.png|link=|1500px]]
 +
</div>
 +
 
 +
 
 +
*Enter a different '''Username:''' and '''New Password:'''
 +
*Tick the '''Protect With htaccess/htpasswd''' box.
 +
*Click <span class="btn-blue">Save</span> to see this:
 +
<div class="mainpage_box">
 +
[[File:administrators2.png|link=|1500px]]
 +
</div>
 +
 
 +
 
 +
<div class="mainpage_box">
 +
<big>'''TIP:'''</big>
 +
*It is advisable to password protect the whole website to prevent visitors or internet search engines finding the website before it is ready - go to <BIG>[[How to Create a Test Shop#password protect|'''PASSWORD PROTECT''']]</BIG> - this can also be done on the cpanel in some host server accounts.
 +
</div>
 +
 
 +
 
 +
----
 +
[[File:securewarnings2.png|link=]]
 +
 
 +
*Ensure both '''configure.php''' files have their file permissions set so only owner can read and write - set file permissions to 644 or 444 dependent on server host. This can be done in your server account control panel or using FTP software e.g. using WinSCP select file, click properties.
 +
**Important: Our server only allows a 644 setting which causes the error message to remain on admin page - providing the setting is 644 this can be ignored.
 +
*Presuming a SSL certificate is installed:
 +
**Edit '''includes/configure.php''' and '''youradmin/includes/configure.php'''
 +
**The files on the host server can be edited using FTP software.
 +
**E.g. using FileZilla - right click on the file and click '''View Edit''' in the popup menu.
 +
**Change Line 4 in both files to <code>define('ENABLE_SSL', true);</code> - save file back to the server.
 +
**Important: '''includes/configure.php''' and '''youradmin/includes/configure.php''' are different files in different locations, never open both at once to avoid confusion and ensure they are transferred to the correct locations.
 +
 
 +
 
 +
----
 +
[[File:securewarnings3.png|link=]]
 +
 
 +
*Delete this folder/directory from the server - right click and delete.
 +
 
 +
 
 +
----
 +
[[File:securewarnings4.png|link=]]
 +
 
 +
*Delete this folder/directory from the server.
  
  

Revision as of 13:58, 25 October 2019

<historylink type="back">🠈 Back</historylink> 🠉 ADMINISTRATION

From admin go to Tools → Security Checks to see this:

Securitychecks1.png

  • This shows security messages that require attention.
  • This screenshot is from a new installation that shows items requiring attention marked with:

Securitychecks2.png

Securewarnings1.png

  • Add a second level of password protection to the youradmin folder/directory on the server.
    • From the admin dashboard go to Configuration → Administrators to see this:

Administrators1.png


  • Click Edit to see this:

Administrators3.png


  • Enter a different Username: and New Password:
  • Tick the Protect With htaccess/htpasswd box.
  • Click Save to see this:

Administrators2.png


TIP:

  • It is advisable to password protect the whole website to prevent visitors or internet search engines finding the website before it is ready - go to PASSWORD PROTECT - this can also be done on the cpanel in some host server accounts.


Securewarnings2.png

  • Ensure both configure.php files have their file permissions set so only owner can read and write - set file permissions to 644 or 444 dependent on server host. This can be done in your server account control panel or using FTP software e.g. using WinSCP select file, click properties.
    • Important: Our server only allows a 644 setting which causes the error message to remain on admin page - providing the setting is 644 this can be ignored.
  • Presuming a SSL certificate is installed:
    • Edit includes/configure.php and youradmin/includes/configure.php
    • The files on the host server can be edited using FTP software.
    • E.g. using FileZilla - right click on the file and click View Edit in the popup menu.
    • Change Line 4 in both files to define('ENABLE_SSL', true); - save file back to the server.
    • Important: includes/configure.php and youradmin/includes/configure.php are different files in different locations, never open both at once to avoid confusion and ensure they are transferred to the correct locations.


Securewarnings3.png

  • Delete this folder/directory from the server - right click and delete.


Securewarnings4.png

  • Delete this folder/directory from the server.


Construction.png
This page is in progress
Please visit again soon for additions and changes

Phoenix Cart User Guide, like CE Phoenix Cart, is free to use but is maintained by unpaid volunteers.

Code references are licensed under a Commons Attribution-NonCommercial-ShareAlike 2.0 UK: England & Wales License.
All other content is the reserved Intellectual Property and Copyright of phoenixcart.org
Retrieved from ‘https://phoenixcart.org/phoenixcartwiki/index.php?title=Security_Checks&oldid=2282’