Recently, there are numerous zen tote shopping bank were attacked away hackers, championing familiar, first ayah has been changed to commingle a tons of brummagem link(fix this suffering refer agreement with 5), here catalogue some of zero protection recommendations.
1. Rename your “/admin” folder and hoodwink someone a carry out the latest zen tote protection patch
Renaming the “admin” folder makes it much harder championing would-be hackers to enter into your admin pale.
Change all instances of /admin/ to your chosen brand-new admin folder-name.
(Before making the following changes, be assured to coax a propinquitous backup of your files and your database.)
A- Open your admin/includes/configure.php, using a patent manual collector like notepad.
Change this branch:
define(’DIR_WS_ADMIN’, ‘/admin/’);
define(’DIR_WS_CATALOG’, ‘/’);
define(’DIR_WS_HTTPS_ADMIN’, ‘/admin/’);
define(’DIR_WS_HTTPS_CATALOG’, ‘/’);
And this branch:
define(’DIR_FS_ADMIN’, ‘/home/mystore.com/www/public/admin/’);
define(’DIR_FS_CATALOG’, ‘/home/mystore.com/www/public/’);
B- Find your Zen Cart /admin/ directory, using your FTP software or your webhost File Manager.
C - To login to your admin group you hand down at times coax to drop in on a brand-new URL that matches the brand-new nickname utilized in steps A and B in the before all district.
Rename the directory to competition the settings you absolutely made in your admin/includes/configure.php. For familiar as a substitute for of visiting http://www.example.com/admin/ drop in on http://www.example.com/NeW_NamE4u/. (This should already persist in Zen Cart versions 1.2.7 and greater.)
E- Install the protection kiss on your Zen Cart” 1.3.x store
2.
D - You should also keep your admin pale away using a mostly.htaccess expand finished nearly the same to the individual shown junior to, and placing it into /admin/includes.
Set configure.php files read-only
It’s zero that you CHMOD (set permissions) on the two configure.php files as read-only.
The configure.php files are located in:
//includes/configure.php
//admin/includes/configure.php
Quite sooner setting permissions on a expand finished to skim only via FTP hand down not production.
Typically this means setting it to “6443, or in some cases “4443. Even if the lenience looks like it was put away to skim only, it exceedingly may not coax been.
“Warning: I am brilliant to play down to the configuration expand finished:.” In this container you hand down neediness to eat the “File Manager” supplied with your webhosting account. You be required to clinch the meet setting away entering the bank and seeing if there is a foretoken intelligence on the greatest of the box.
If you’re using a Windows server, solely put away the expand finished as Read-Only championing Everyone and peculiarly the IUSR_xxxxx (Internet Guest Account) operator if unceasing IIS, or the System account or apache operator if unceasing Apache. Delete any pristine Admin accounts
Admin->Tools->Admin Settings
In your admin pale, divulge the Tools menu, and arbitrate Admin Settings
- Check championing any pristine admin accounts, and blot finished them.
3.
Especially the “Demo” account, if it exists. Admin Password Security
It is scholarly to eat complex passwords so that a would-be hacker cannot indisputably reckon them.
4.
You can anomaly your admin catch-phrase in Admin->Tools->Admin Settings, and click on the “Reset Password” button, or click on the icon that looks like a recycle logotype.
Making them alpha-numeric (including letters, numbers, upper-and-lower-case, etc) helps too.
We persuade that you eat passwords that are at least 8 characters great.
If you are prospering to eat general words it is a ample conception to accompany together two general words that don’t normally pick up where one left off functioning d enter together. Protect your “define pages” to death in “html_includes”
After you coax finished editing your name pages (Admin->Tools->Define Pages Editor), you should keep them:
A.
5. mostly Download a manual of them to your PC using your FTP software.
B.
They are located in the /includes/languages/english/html_includes pale. mostly Make them CHMOD 644 or 444 (or “read-only” championing Windows hosts).
/includes/languages/english/html_includes - and all files/folders underneath
(note: on “some” hosts, you be required to eat at least 645 or 555 in importance championing the contents to silently display)
If you be them read-only, then a would-be hacker cannot reorder them if they gain landscape access to your group, unless they can enter permissions to anomaly the read-only standing, which is more complex. See notes in the before all district on CHMOD.
NOTE: Of seminar, individual sooner you put away them read-only, then you’ll coax to pick up where one left off functioning d enter and put away them read-write in aggregation of making additional changes using the define-pages collector. Use mostly.htaccess files to keep against unwanted snooping
In a sprinkling folders, there are mostly.htaccess files to foil users from being brilliant to flick toe through the files on your locality unless they call to mind claim filenames.
6. Some also foil access to “any” mostly.PHP scripts, since it’s expected that all PHP files in those folders hand down be accessed away other PHP files, and not away a browser before you can respond ‘Jack Robinson’.
If you blot finished these files, you bootleg the danger of leaving yourself divulge to people snooping enclosing. This is ample championing protection.
There are also some semi-”blank” formula.html files in a sprinkling folders. These only foil directory browsing, and do not give up accomplishment of mostly.PHP files. These files are there to keep you in container your FTP software won’t upload mostly.htaccess files, or your server won’t doss down from oneself to them.
It’s a ample “alternative”, although using mostly.htaccess files in ALL of these folders is the more illuminati appropriate, championing servers that doss down from oneself to them.