Difference between revisions of "How to Secure"
PeterRobert (talk | contribs) |
PeterRobert (talk | contribs) |
||
| Line 3: | Line 3: | ||
Warnings as shown below are given as reminders both on the Administration Dashboard page (yoursite/youradmin/index.php - you can go to this page by clicking Administration in the header bar at the top of the screen) and on the Security Checks page - go to Tools -> Security Checks. | Warnings as shown below are given as reminders both on the Administration Dashboard page (yoursite/youradmin/index.php - you can go to this page by clicking Administration in the header bar at the top of the screen) and on the Security Checks page - go to Tools -> Security Checks. | ||
[[File:securewarnings1.png]] | [[File:securewarnings1.png]] | ||
| − | |||
| − | |||
| − | |||
| − | |||
Add a second level of password protection to the "youradmin" folder/directory on the server. | Add a second level of password protection to the "youradmin" folder/directory on the server. | ||
| Line 16: | Line 12: | ||
Optional: Password protection can also be added in a similar way to the whole website to prevent visitors or internet search engines finding the website before it is ready | Optional: Password protection can also be added in a similar way to the whole website to prevent visitors or internet search engines finding the website before it is ready | ||
| − | + | [[File:securewarnings2.png]] | |
Ensure both configure.php files have their file permissions set so only owner can read and write - right click on file and set File permissions to 644 or 444 dependent on server host. | Ensure both configure.php files have their file permissions set so only owner can read and write - right click on file and set File permissions to 644 or 444 dependent on server host. | ||
| Line 28: | Line 24: | ||
Important: includes/configure.php and youradmin/includes/configure.php are different files in different locations, never open both at once to avoid confusion and ensure they are transferred to the correct locations. | Important: includes/configure.php and youradmin/includes/configure.php are different files in different locations, never open both at once to avoid confusion and ensure they are transferred to the correct locations. | ||
| − | + | [[File:securewarnings3.png]] | |
Delete this folder/directory from the server - right click and delete. | Delete this folder/directory from the server - right click and delete. | ||
| − | + | [[File:securewarnings4.png]] | |
Delete this folder/directory from the server - right click and delete. | Delete this folder/directory from the server - right click and delete. | ||
Revision as of 05:38, 3 October 2019
Secure the Website
Warnings as shown below are given as reminders both on the Administration Dashboard page (yoursite/youradmin/index.php - you can go to this page by clicking Administration in the header bar at the top of the screen) and on the Security Checks page - go to Tools -> Security Checks.
Add a second level of password protection to the "youradmin" folder/directory on the server.
Go to Configuration -> Administrators, click Edit, tick the Protect With htaccess/htpasswd box, click Save.
Alternative: A second level of password protection also be done on some host server accounts or use a htaccess password file generator e.g. htaccesstools.com
Optional: Password protection can also be added in a similar way to the whole website to prevent visitors or internet search engines finding the website before it is ready
Ensure both configure.php files have their file permissions set so only owner can read and write - right click on file and set File permissions to 644 or 444 dependent on server host.
Important: Our server only allows a 644 setting which causes the error message to remain on admin page - providing the setting is 644 this can be ignored.
Presuming a SSL certificate is installed - edit both includes/configure.php and youradmin/includes/configure.php on the server
In Filezilla - right click file - click View/Edit - change line 4 to define('ENABLE_SSL', true); - save and then back to Filezilla and click Yes to upload the file back to the server.
Important: includes/configure.php and youradmin/includes/configure.php are different files in different locations, never open both at once to avoid confusion and ensure they are transferred to the correct locations.
Delete this folder/directory from the server - right click and delete.
Delete this folder/directory from the server - right click and delete.
NOTE: If the Install page is still shows instead of your shop, ensure Install folder/directory has been deleted, ensure your browser cache is cleared - note some servers also have a cache so if still showing contact your host server to request they clear your server cache.
The README text file is no longer required.
Delete this file from the server - right click and delete.
