On Wed, Oct 9, 2013, at 01:04 AM, Andy Smith wrote: Although all the other suggestions below are sensible and relatively easy to do, this one would have stopped I think every compromise I've seen in recent times. Get yourself on the security mailing lists and apply updates ASAP - which is trivial these days for most popular bits of software I've used. The only other thing I'd really add is to make sure you keep good backups and be prepared to nuke from orbit and start again as quickly as you can if the worst happens. -- Richard Dignall richard(a)dignall.co.uk www.bebackedup.co.uk

On 2013-10-09 08:48, Kai Hendry wrote: I have set up both Magento and OpenCart, I would recommend OpenCart for ease of use and good community support. I recently had a user switch back to OpenCart because they didn't get on with Magento.

On 09/10/13 01:04, Andy Smith wrote: <snip> <snip> I'd like to concur. You don't need to outrun the lion, you just need to outrun your companion. So as long as there are plenty of insecure sites that are easier to hack than yours, you are very unlikely to get hit. Bearing in mind therefore that a lot of attacks are dumb scripts, it's a good idea to change default locations and names where possible, e.g. use /adm111 rather than /admin, or change the default database table prefix e.g. qz-users rather than wp-users (for wordpress). Similarly, no harm in putting an htauth password around any admin areas, to work in addition to the existing password protection. A (slightly trendy) phrase kicking around these days is "the swiss cheese model": basically, things go wrong when the holes line up [0]. So although your username / password pairs should be strong enough [1] if you inadvertently create a weak one ('test' / 'test') then either an obfuscated URL or an additional password will keep you safe - and both together should ensure it. [2] Interestingly I got passed a list of things to be done to a wordpress site that is going to use Paypal Pro to take credit card details on site and therefore needs PCI compliance. They include: * Resolving OpenSSL problem * Configuring an SSL cert for FTP. * Update PHP to be above 5.5.2 | 5.3.28 * Maybe update Apache to be > 2.2.25 * Add SSL for 'www.domain.net' * Remove the phpinfo.php file from 'http://www.domain.net' * Disable cPanel user URLs (~user) * Disable networking on MySQL. I've commented that it's like padlocking the second floor windows when on the ground floor there's a load that will open with a quick shove... the site has no less than 40 wordpress plugins. IMO it's just a matter of when, not if, one of them is found to have an injection flaw or similar. [0] http://taranevenmrt.wordpress.com/2013/05/03/when-the-holes-line-up-its-tim… [1] Strong enough can actually be quite simple. You don't NEED 15 character passwords in most situations. [2] A useful aviation concept from the world of aerobatics - always practice at least "two mistakes high", i.e. you can mess up twice in a row and *still* not hit the ground.