Basic security guidelines for the shared hosting server

 

  • Make sure your local computer is safe. For this purpose use reliable updated antivirus software such as:
    • Norton Internet Security, offering Antivirus, Antispyware, Two-way firewall, Antiphishing, etc.
      or
    • Kaspersky Internet Security, offering Integrated protection from all Internet threats, such as Parental Control, a personal firewall, an anti-spam filter, Privacy Control and more.
  • Check whether all of your web applications are up-to-date. This includes any modules, components and addons you have added and / or integrated;
  • Pick up strong passwords for the main cPanel account, MySQL, FTP and mail users. Never use the same passwords for different users. For example a MySQL user should not have the same password as your cPanel user or an FTPuser. It is essential that your cPanel user's password is not found in any file on your account by any means;
  •  Avoid having directories with permissions above 755. If your applications require such directories, try to put them outside your webroot (public_html) or place a .htaccess file in them containing "deny from all" to restrict public access to these files.
  • Use only secure / encrypted connections when logging in cPanel (https://yourdomain.com/cpanel).
  •  Configure your site to use the latest PHP 5.3 by adding the following line to your .htaccess file:

AddHandler application/x-httpd-php53 .php .php3 .php4 .php5 .phtml

 

PHP 5.2 has an improved handling of remote code which reduces greatly security problems.

  • Tweak your local PHP settings for better security. This can be done by disabling unnecessary functions and options. Here are some sample recommended directives:

allow_url_fopen=off

disable_functions = proc_open , popen, disk_free_space, set_time_limit, leak, tmpfile, exec, system, shell_exec, passthru

 

Note that the above directives can cripple your code's functionality. They have to be pasted in a php.ini file in each directory you'd like to have them applied.

  • Deny perl and other bots from accessing your site. This can be easily done with the following rules in your .htaccess:

SetEnvIfNoCase User-Agent libwww-perl bad_bots
order deny,allow
deny from env=bad_bots

  • If you are not using Perl scripts, add a bogus handler for these files. In your home directory create a .htaccess file with the following content: 

##Deny access to all CGI, Perl, Python and text files
<FilesMatch "\.(cgi|pl|py|txt)">
Deny from all
</FilesMatch>
##If you are using a robots.txt file, please remove the
# sign from the following 3 lines to allow access only to the robots.txt file:
#<FilesMatch robots.txt>
#Allow from all
#</FilesMatch>

 

The above will prevent Perl scripts to be executed. Many exploits / backdoors are writtent in Perl and the above will prevent them from running. This directive will apply to all your subdirectories.

Filter possible intrusions with Apache's Mod Security. Mod Security is an Application firewall integrated with Apache.

 

  • 14 Els usuaris han Trobat Això Útil
Ha estat útil la resposta?

Articles Relacionats

Where do I go to login to my cpanel control panel?

Please follow the URL provided in your activation email, then go to...

I can't access cPanel. What could cause this problem?

The main reason is you have a firewall blocking the port that cPanel is set to. That may our...

What is the difference between parked, addon, and subdomains?

An addon domain is a fully functional domain that can be created from your cpanel. Once it's...

How do I make sub-domains?

There are many reasons why you may want to create a sub-domain, you could create someone a small...

How to access my email accounts?

You can try one of the following options: 1. Login to your cPanel, select email accounts and...