Steps in Securing Your Immerce Store

SSL Security Protection Tips

Without applying extra efforts to your connection on the internet you are wandering around an unsecured environment. Before you make administrative modifications to secure Immerce and its database, you need to equip yourself with secure ways to make these modifications. Otherwise if someone is watching/listing to the information you transmit, it might not be long before your private business information becomes public.

The preferred would be to have a dedicated SSL certificate for your store, as it is more professional in appearance than the use of a shared certificate. There will be an expense incurred to obtain a dedicated SSL certificate and dedicated IP address in your hosting account.

Accessing Your Site Files Securely

Instead of using regular FTP to access your server's files, it would be wise to use a program that offers FTP over SSL/TLS. This method will encrypt the information you transmit and receive. This is important especially when you are downloading database backups or configuration files which contain usernames and passwords, etc.

The following is a list of several steps you can take to secure your Immerce site:

1. Remove extra folders from your server after install

REMOVE THE FOLLOWING FOLDERS (and all the files inside them), TO MINIMIZE SECURITY RISKS:

 - /docs  - /extras  -  (this file can be removed, too) 

It is safe to keep these files on your own computer, since they can be used as references/documentation, or used to aid in troubleshooting as diagnostic tools, or for upgrading/installing again in the future. But those folders/files should *not* be on a live webserver.

Optional: Additionally, *IF* you have no intentions of supporting downloadable products or music-media products, you can *also* remove these folders:

 - /download  - /media  - /pub 

(And you'll need to go to your Admin->Configuration->Attribute Settings->Enable Downloads, and set it to False to turn off the warning message about the missing download folder) In the future, if you choose to add downloadable products to your site or music-products, you will want to re-upload these appropriate folders (and their contents) to your server again, and assign appropriate permissions.

2. Rename your admin folder

It is recommended for additional security that you rename your admin directory after installation. This way, it will be significantly harder for hackers to find your admin area or attempt any attack on breaking into it.

(Before making the following changes, make sure to have a current backup of your files and your database.)

Change this section:

And this section:

B - Find your Immerce /adminarea/ directory, using your FTP software or File Manager. Rename the directory to match the settings you just made in step A.

C - To login to your admin system you will now have to visit a new URL that matches the new name used in steps A and B above. For example instead of visiting http://www.example.com/admin/ visit http://www.example.com/new_admin_name/. Use of SSL is highly recommended to protect you and your customers' information. To protect the new admin folder name from packet sniffers, use https in the example link above (this of course depends on your server having an SSL certificate installed).

D - You should also protect your admin area by using an .htaccess file such as the one supplied in the /adminarea/.htaccess in the Immerce distribution files.

3. Use SMTPAUTH or SMTP as your Email Transport method, instead of the generic/default "PHP" setting.

Go to Admin->Configuration->Email Options, and change your Email Transport Protocol to SMTPAUTH, and then fill in all the SMTP credentials in the other settings lower on that same screen.

This will not only help prevent outgoing emails from ending up in spam folders, but will also prevent the disclosure of your admin foldername when sending emails from your admin screens.

4. Set configure.php files read-only

It's important that you CHMOD (set permissions) on the two configure.php files as read-only. Typically this means setting them to 644, or in some cases 444.
The configure.php files are located in:
/<YourStoreFolder>/includes/configure.php
/<YourStoreFolder>/renamed-admin/includes/configure.php

Quite often setting permissions on a file to read only via FTP will not work. Even if the permission looks like it was set to read only, it really may not have been. You must verify the correct setting by entering the store and seeing if there is a warning message on the top of the screen. "Warning: I am able to write to the configuration file:..." In this case you will need to use the "File Manager" in cpanel.

5. Delete any unused Admin accounts

Admin > Tools > Admin Settings

In your admin Users screen, check for any unused Admin accounts, and delete them. Especially the Demo account, if it exists.

6. Admin Password Security

It is wise to use complicated passwords so that a would-be hacker can't easily guess them.

We recommend that you use passwords that are at least eight or more characters long, and a mix of letters and numbers, and even upper-and-lower case. Making it multiple words (of letters-and-numbers) with spaces in between will make it almost impossible to guess or crack.

If you are going to use normal words it is a good idea to join together two normal words that don't normally go together, again separating them with spaces and maybe mixing in some uppercase letters.

Admin passwords should be changed at least every 3 months.

7. Admin Access Protection

It is wise to observe caution while working in your admin area:

- use only one browser tab to access your admin area

- do NOT visit other sites when your browser has an active admin login session enabled -- even in another tab

- always log out of your admin when not using it

8. Disable "Allow Guest To Tell A Friend" feature

You may wish to go to Admin > Configuration > Email Options > Allow Guest To Tell A Friend and set the option to false. This will prevent non-logged-in customers from using your server to send unwanted email messages.

In Immerce this option is set to 'false' by default.

NOTE: Changing this option to 'true' might allow rogue visitors to use your tell-a-friend form to send spam to other email addresses.

If you intend to NOT use the tell-a-friend feature at all, rename the /includes/modules/pages/tell_a_friend/ folder to something random, or delete it altogether.

9. Protect your "images" and other folders

During initial installation, you are advised to set your images folder to read/write, so that you can use the Admin interface to upload product/category images without having to use FTP for each one. Similar recommendations are made to other files for various reasons.

However, leaving the images (or any other) folder in read/write mode means that hackers might be able to put malicious files in this (or other) folder(s) and thus create access points from which to attempt nasty exploits.

Thus, once your site is built and your images have been created/loaded, you should drop the security down from read/write to read. ie: change from CHMOD 777 down to 644 for files and 755 for folders.

File/Folder permissions settings

On Linux/Unix hosts, generally, permission-setting recommendations for basic security are:

• folders/directories: 755
• files: 644

Folder Purposes

The folders for which installation suggests read-write access for setup are these. If your site supports .htaccess protection, then you should use it for these folders.

• /cache
  This is used to cache session and database information. The BEST security protection for this is to move it to a folder "above" the public_html/htdocs/www area, so that it's not accessible via a browser. (Requires changes to DIR_FS_SQL_CACHE setting in configure.php files as well as Admin > Configuration > Sessions > Session Directory.
• /images
  This is discussed earlier in this article.
• /includes/languages/english/html_includes
  This is discussed earlier in this article.
• /media
  This is only suggested read-write for the sake of being able to upload music-product media files via the admin. Could be done by FTP as an alternative.
• /pub
  This is used on Linux/Unix hosts to have downloadable products made available to customers via a secure delivery method which doesn't disclose the 'real' location of files/data on your server (so that people can't share a URL and have their friends steal downloads from your site)
• /admin/backups
  This is used by automated backup routines to store database backups. Optional.
• /admin/images/graphs
  This is used by the Admin > Tools > Banner Manager for updating/displaying bar graphs related to banner usage. If not writable, this feature is ignored.

10. Remove the print URL feature from your browser

To stop the browser from printing the admin URL (which discloses your Admin foldername) on the invoice follow these steps:.

• Microsoft Internet Explorer
  
  • Click on File then Page Setup
  • At page setup window, remove these two character combination "&u" from the header or footer text box.
• Firefox
  
  • Click on File then Page Setup
  • On page setup window click on the tab "Margins & Header/Footer". In the "Header & Footer" section set all of the drop downs to --blank--. (Or at least remove all instances of "Title" and "URL" from the various boxes.)
• Other browsers offer similar menu choices to change these settings.

11. Things to Check Up on Regularly

1. Be sure you've done all the steps listed in this document.
2. Make recent backups of your website files and database.
   • Backup the database over a secure connection (ie: if you're using phpMyAdmin to backup, then make sure you're using HTTPS addresses in your URLs).
   • Backup the website files over a secure connection (If you're copying files via FTP, be sure to use SECURE-FTP).
   • Store the backed up database and website files into an encrypted file. (You should NOT keep your backups on your server. But if you do, encrypt them securely. See your hosting company for advice.)
3. Check your server's error log regularly for odd or suspicious activity. (Your hosting control panel should give you access to the Apache error_log)
   • Look for any links that went to a page that isn't in your site.
   • Look for links that have http after the index.php.
4. Check your website files regularly to be sure nothing's been added or altered.
5. Ask your web host what they have done to be sure the server you're on is safe and secure so that outsiders cannot do any harm, and so that other websites on your server cannot be used to get to your site and cause any harm (in case they have security holes in them).
6. If your business warrants, or you still want additional assurance (especially if running forum software on your site, or other scripts outside of Immerce), hire a security consultant to check your site regularly and give you peace of mind in exchange for a few dollars.
7. Check your Immerce Cart /cache/ folder for myDebug-XXXXX.log files to see whether any errors are happening which need to be fixed. Delete the log files after you've addressed the errors.