Just moved my shop to root level - what security?

[LukeH]

Hi

For a few months now I have been configuring my shop in a sub-folder to keep it away from direct internet links. I have just moved it to the root level so that my website url goes straight into the shop. I have checked the chmod permissions and I can confirm that folders are 755 and files 644.

What else should I do to secure?

I will be installing an SSL cert soon, and do I need to do anything with an .htaccess file?

Thanks,

Luke.

[rocky]

You can add the following to your .htaccess file to prevent your TPL files being downloaded:

  Order deny,allow
   Deny from All

Otherwise, there isn't anything else you need to do for security.

[robkwal]

Handy piece of code! Thanks.

[LukeH]

You can add the following to your .htaccess file to prevent your TPL files being downloaded:

  Order deny,allow
   Deny from All

Otherwise, there isn't anything else you need to do for security.

Thanks rocky, I will implement this today.

Cheers.

[jgk-dk]

where is the .htaccess file located?

[rocky]

In the root directory of PrestaShop. If one doesn't exist, create one with chmod 666 permissions, then go to Tools > Generators to generate a .htaccess file, then add the above code to it.

[glenns]

Rocky, can that bit of code be added to anywhere in the .htacess file or does it need to reside in a certain place/order?

[rocky]

I think it can be placed anywhere, except inside another statement. I have the code at the top of my file.

[mandrin]

@ Rocky,
can I set the htaccess file with chmod 644 permissions or must it be 666?

Regards,

[rocky]

I'm not sure. PrestaShop instructions say chmod 666, but they are wrong about the chmod 777 permissions, so they might be wrong again. Try giving it chmod 644 permissions, then check whether the friendly URLs still work and that you are able to regenerate the .htaccess file.

[mandrin]

Ye, I have set to 644 and there does not seem to be any hassles...

What is the test I can do so see if friendly url's are working?


Regards,

[rocky]

Just go to a product page and check whether the URL is in the form /category_name/product_id-product_name.

[mandrin]

Ok, yup it is. No extra mess in the url.

Thanks again Rocky!

Regards,