Difference between revisions of "How to Secure"

From Phoenix Cart User Guide
 
(93 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
<span class="btn-grey" style="color:#0088dd;">'''&#x1F809; [[SET UP SHOP]]'''</span>
+
<div class="btn btn-grey btn-back">{{#fas:arrow-left}} Back</div> <div class="btn btn-grey btn-download">{{#fas:download}} Download & Install</div>
 
<hr>
 
<hr>
−
<BIG>'''Secure the Website'''</BIG>
 
  
−
Warnings as shown below are given as reminders both on the admin dashboard and on the Security Checks page - from admin dashboard go to '''''Tools => Security Checks'''''.
+
==='''Secure the Website'''===
  
−
[[File:securewarnings1.png]]
+
When you have logged into Admin you will see the Admin Dashboard, see - <big>'''[[Admin Dashboard]]'''</big> for a complete guide.
  
−
Add a second level of password protection to the '''''youradmin''''' folder/directory on the server.
+
Security warnings are given as reminders on the Admin Dashboard (highlighted in the screenshot).
 +
 
 +
<div class="mainpage_box">
 +
[[File:admin.png|link=|1500px]]
 +
</div>
 +
 
 +
These warnings are also shown on the '''Security Checks''' page.
 +
 
 +
So, clicking the <span style="color:blue">'''It has been over 30 days...'''</span> link goes to '''Security Checks''' (also found from admin go to [[File:adminnavbartools.png|link=]] '''Tools &rarr; Security Checks''')
 +
 
 +
This will be seen:
 +
 
 +
<div class="mainpage_box">
 +
[[File:securitychecks1.png|link=]]
 +
</div>
 +
*This shows a new installation with security messages that require attention (highlighted in the screenshot).
 +
 
 +
Deal with each one in sequence.
 +
 
 +
----
 +
 
 +
==='''Admin HTTP Authentication'''===
 +
 
 +
*Add a second level of password protection to the '''youradmin''' folder/directory on the server.
 +
**From the admin dashboard go to [[File:adminnavbarconfig.png|link=]] '''Configuration &rarr; Administrators''' to see this:
 +
<div class="mainpage_box">
 +
[[File:securitychecks3.png|link=]]
 +
</div>
  
−
From the admin dashboard go to '''''Configuration => Administrators''''', click Edit, tick the '''''Protect With htaccess/htpasswd''''' box then click '''''Save'''''.
 
  
 +
*Click <span class="btn-yellow">Edit</span> to see this:
 
<div class="mainpage_box">
 
<div class="mainpage_box">
−
<BIG>'''TIP'''</BIG>
+
[[File:administrators3.png|link=|1500px]]
 +
</div>
  
−
Password protection can also be added in a similar way to the whole website to prevent visitors or internet search engines finding the website before it is ready - go to <BIG>[[How to Create a Test Shop#password protect|'''PASSWORD PROTECT''']]</BIG> - this can also be done on the cpanel in some host server accounts.
+
 
 +
*Enter '''Username:''' and '''New Password:'''
 +
*Tick the '''Protect With htaccess/htpasswd''' box.
 +
*Click <span class="btn-green">Save</span> to see this:
 +
<div class="mainpage_box">
 +
[[File:administrators2.png|link=|1500px]]
 
</div>
 
</div>
−
[[File:securewarnings2.png]]
 
  
−
Ensure both '''''configure.php''''' files have their file permissions set so only owner can read and write - right click on file and set File permissions to 644 or 444 dependent on server host.
 
  
−
Important: Our server only allows a 644 setting which causes the error message to remain on admin page - providing the setting is 644 this can be ignored.
+
When you next access the admin you will see something like this to sign in:
 +
 
 +
[[File:signin.png]]
 +
 
 +
 
 +
<div class="mainpage_box">
 +
<big>'''TIP:'''</big>
 +
*It is advisable to password protect the whole website to prevent visitors or internet search engines finding the website before it is ready - go to <BIG>[[How to Create a Test Shop#password protect|'''PASSWORD PROTECT''']]</BIG> - this can alternatively be done on the control panel in some host server accounts.
 +
</div>
 +
 
 +
 
 +
----
 +
<!--
 +
 
 +
<big>'''config_file_catalog'''</big>
 +
 
 +
[[File:securitychecks4.png|link=]]
 +
 
 +
*Ensure both '''configure.php''' files have their file permissions set so only owner can read and write - set file permissions to 644 or 444 or 400 dependent on server host. This can be done in your server account control panel or using FTP software e.g. using WinSCP select file, click properties.
 +
**Important: Our server does not allow the 644 setting to be changed using the control panel or FTP which causes the error message to remain on admin page - in this case contact your server host to change it for you.
 +
 
 +
 
 +
----
 +
-->
 +
 
 +
==='''Github Directory'''===
 +
[[File:securitychecks5.png|link=]]
 +
 
 +
*Delete this folder/directory from the server using your FTP software or server host control panel.
 +
 
 +
 
 +
----
 +
==='''install_directory'''===
 +
 
 +
[[File:securitychecks6.png|link=]]
 +
 
 +
*Delete this folder/directory from the server using your FTP software or server host control panel.
 +
 
 +
 
 +
----
 +
 
 +
==='''Version Check'''===
 +
 
 +
[[File:securitychecks7.png|link=]]
  
−
Presuming a SSL certificate is installed - edit both '''''includes/configure.php''''' and '''''youradmin/includes/configure.php''''' on the server
+
*Click the message - it is linked to [[File:adminnavbartools.png|link=]] '''Tools &rarr; Version Checker''' to see this:
 +
<div class="mainpage_box">
 +
[[File:versionchecker.png|link=|1500px]]
 +
</div>
  
−
In Filezilla - right click file - click '''''View/Edit''''' - change line 4 to <code>define('ENABLE_SSL', true);</code> - save and then back to Filezilla and click '''''Yes''''' to upload the file back to the server.
 
  
−
Important: '''''includes/configure.php''''' and '''''youradmin/includes/configure.php''''' are different files in different locations, never open both at once to avoid confusion and ensure they are transferred to the correct locations.
+
----
  
−
[[File:securewarnings3.png]]
+
==='''README'''===
 +
The '''README''' text file is no longer required.
 +
*Delete this file from the server.
  
−
Delete this folder/directory from the server - right click and delete.
 
  
−
[[File:securewarnings4.png]]
+
----
  
−
Delete this folder/directory from the server - right click and delete.
+
==='''Make a test purchase'''===
  
−
The '''''README''''' text file is no longer required.
+
Though not an essential part of securing the shop, now is a good time to browse around the shop and make a test purchase to familiarise yourself with how it works. It is good practice to browse the shop through the eyes of a customer and you should do this every time you make any changes to your website to ensure customers can make a purchase.
  
−
Delete this file from the server - right click and delete.
+
*From admin click (or maybe right click and Open link in new tab) on the <span style="color:#007bff;"><big>'''Your Shop'''</big></span> link to go to the shop.
  
−
NOTE: If the Install page is still shows instead of your shop, ensure '''''Install''''' folder/directory has been deleted from the server, ensure your browser cache is cleared - note some servers also have a cache so if still showing contact your host server to request they clear your server cache.
 
 
<div class="mainpage_box">
 
<div class="mainpage_box">
−
<BIG>'''TIP'''</BIG>
+
[[File:adminlinks.jpg|link=|]]
 +
</div>
  
−
To bypass your browser's cache:
+
You will see similar to this.
 +
<div class="mainpage_box">
 +
[[File:shop.jpg|link=|]]
 +
</div>
 +
 
 +
NOTE: If the Install page still shows instead of your shop, ensure '''Install''' folder/directory has been deleted from the host server and ensure your browser cache is cleared.
 +
NOTE: Some host servers also have a cache so don't worry if the Install page is still showing. If temporarily frustrated by the link taking you to '''yoursite/install/index.php''' simply change the link in your browser address bar to '''yoursite/index.php''' - the host server's cache will eventually clear, usually within 24 hours.
 +
 
 +
 
 +
<div class="mainpage_box">
 +
<BIG>'''TIP:'''</BIG>
 +
*To bypass your browser's cache:
 
*Firefox / Safari: Hold Shift while clicking Reload, or press either Ctrl-F5 or Ctrl-R (⌘-R on a Mac)
 
*Firefox / Safari: Hold Shift while clicking Reload, or press either Ctrl-F5 or Ctrl-R (⌘-R on a Mac)
 
*Google Chrome: Press Ctrl-Shift-R (⌘-Shift-R on a Mac)
 
*Google Chrome: Press Ctrl-Shift-R (⌘-Shift-R on a Mac)
Line 50: Line 137:
 
*Opera: Go to Menu → Settings (Opera → Preferences on a Mac) and then to Privacy & security → Clear browsing data → Cached images and files.
 
*Opera: Go to Menu → Settings (Opera → Preferences on a Mac) and then to Privacy & security → Clear browsing data → Cached images and files.
 
</div>
 
</div>
 +
 +
<!--
 +
----
 +
 +
<BIG>'''[https://www.youtube.com/watch?v=pVssGbpLoCs Watch on YouTube]'''</BIG>
 +
-->
 
<hr>
 
<hr>
 
<span class="btn-grey">[[How_to_Install|&#129032; Previous Step]]</span>
 
<span class="btn-grey">[[How_to_Install|&#129032; Previous Step]]</span>
 
<span class="btn-grey">[[How to Back Up|Next Step &#129034;]]</span>
 
<span class="btn-grey">[[How to Back Up|Next Step &#129034;]]</span>
 +
<hr>
 +
{{Forum}}
 +
{{Pro}}
 +
{{Contribute}}

Latest revision as of 05:57, 2 September 2024

Back
Download & Install

Secure the Website

When you have logged into Admin you will see the Admin Dashboard, see - Admin Dashboard for a complete guide.

Security warnings are given as reminders on the Admin Dashboard (highlighted in the screenshot).

Admin.png

These warnings are also shown on the Security Checks page.

So, clicking the It has been over 30 days... link goes to Security Checks (also found from admin go to Adminnavbartools.png Tools → Security Checks)

This will be seen:

Securitychecks1.png

  • This shows a new installation with security messages that require attention (highlighted in the screenshot).

Deal with each one in sequence.

Admin HTTP Authentication

  • Add a second level of password protection to the youradmin folder/directory on the server.
    • From the admin dashboard go to Adminnavbarconfig.png Configuration → Administrators to see this:

Securitychecks3.png


  • Click Edit to see this:

Administrators3.png


  • Enter Username: and New Password:
  • Tick the Protect With htaccess/htpasswd box.
  • Click Save to see this:

Administrators2.png


When you next access the admin you will see something like this to sign in:

Signin.png


TIP:

  • It is advisable to password protect the whole website to prevent visitors or internet search engines finding the website before it is ready - go to PASSWORD PROTECT - this can alternatively be done on the control panel in some host server accounts.


Github Directory

Securitychecks5.png

  • Delete this folder/directory from the server using your FTP software or server host control panel.


install_directory

Securitychecks6.png

  • Delete this folder/directory from the server using your FTP software or server host control panel.


Version Check

Securitychecks7.png

  • Click the message - it is linked to Adminnavbartools.png Tools → Version Checker to see this:

Versionchecker.png


README

The README text file is no longer required.

  • Delete this file from the server.


Make a test purchase

Though not an essential part of securing the shop, now is a good time to browse around the shop and make a test purchase to familiarise yourself with how it works. It is good practice to browse the shop through the eyes of a customer and you should do this every time you make any changes to your website to ensure customers can make a purchase.

  • From admin click (or maybe right click and Open link in new tab) on the Your Shop link to go to the shop.

Adminlinks.jpg

You will see similar to this.

Shop.jpg

NOTE: If the Install page still shows instead of your shop, ensure Install folder/directory has been deleted from the host server and ensure your browser cache is cleared. NOTE: Some host servers also have a cache so don't worry if the Install page is still showing. If temporarily frustrated by the link taking you to yoursite/install/index.php simply change the link in your browser address bar to yoursite/index.php - the host server's cache will eventually clear, usually within 24 hours.


TIP:

  • To bypass your browser's cache:
  • Firefox / Safari: Hold Shift while clicking Reload, or press either Ctrl-F5 or Ctrl-R (⌘-R on a Mac)
  • Google Chrome: Press Ctrl-Shift-R (⌘-Shift-R on a Mac)
  • Internet Explorer: Hold Ctrl while clicking Refresh, or press Ctrl-F5
  • Opera: Go to Menu → Settings (Opera → Preferences on a Mac) and then to Privacy & security → Clear browsing data → Cached images and files.

🠈 Previous Step Next Step 🠊

Many Addons and Extensions available in the CE Phoenix Cart Addons Library

If help is needed, support is available in the CE Phoenix Cart Support Forum

Phoenix Cart User Guide, like CE Phoenix Cart, is free to use but is maintained by unpaid volunteers.

Code references are licensed under a Commons Attribution-NonCommercial-ShareAlike 2.0 UK: England & Wales License.
All other content is the reserved Intellectual Property and Copyright of phoenixcart.org
Retrieved from ‘https://phoenixcart.org/phoenixcartwiki/index.php?title=How_to_Secure&oldid=4987’