Difference between revisions of "How to Secure"
PeterRobert (talk | contribs) |
PeterRobert (talk | contribs) |
||
| Line 1: | Line 1: | ||
| − | Secure the Website | + | '''Secure the Website''' |
| − | + | Warnings as shown below are given as reminders both on the admin dashboard and on the Security Checks page - go to Tools => Security Checks. | |
| − | Warnings as shown below are given as reminders both on the | ||
[[File:securewarnings1.png]] | [[File:securewarnings1.png]] | ||
Add a second level of password protection to the "youradmin" folder/directory on the server. | Add a second level of password protection to the "youradmin" folder/directory on the server. | ||
| − | + | From the admin dashboard go to Configuration => Administrators, click Edit, tick the Protect With htaccess/htpasswd box then click Save. | |
Alternative: A second level of password protection also be done on some host server accounts or use a htaccess password file generator e.g. htaccesstools.com | Alternative: A second level of password protection also be done on some host server accounts or use a htaccess password file generator e.g. htaccesstools.com | ||
Revision as of 15:08, 3 October 2019
Secure the Website
Warnings as shown below are given as reminders both on the admin dashboard and on the Security Checks page - go to Tools => Security Checks.
Add a second level of password protection to the "youradmin" folder/directory on the server.
From the admin dashboard go to Configuration => Administrators, click Edit, tick the Protect With htaccess/htpasswd box then click Save.
Alternative: A second level of password protection also be done on some host server accounts or use a htaccess password file generator e.g. htaccesstools.com
Optional: Password protection can also be added in a similar way to the whole website to prevent visitors or internet search engines finding the website before it is ready
Ensure both configure.php files have their file permissions set so only owner can read and write - right click on file and set File permissions to 644 or 444 dependent on server host.
Important: Our server only allows a 644 setting which causes the error message to remain on admin page - providing the setting is 644 this can be ignored.
Presuming a SSL certificate is installed - edit both includes/configure.php and youradmin/includes/configure.php on the server
In Filezilla - right click file - click View/Edit - change line 4 to define('ENABLE_SSL', true); - save and then back to Filezilla and click Yes to upload the file back to the server.
Important: includes/configure.php and youradmin/includes/configure.php are different files in different locations, never open both at once to avoid confusion and ensure they are transferred to the correct locations.
Delete this folder/directory from the server - right click and delete.
Delete this folder/directory from the server - right click and delete.
NOTE: If the Install page is still shows instead of your shop, ensure Install folder/directory has been deleted, ensure your browser cache is cleared - note some servers also have a cache so if still showing contact your host server to request they clear your server cache.
The README text file is no longer required.
Delete this file from the server - right click and delete.
