Secure AdminCP XenForo

[Admin]

Both rogue members, guest, and cyber bots want to desperately gain access and take over your site. While nothing is 100% hack or crack proof, it's always a good idea to make things just a little harder.

1) Mask / Hide your Super Administrator

The idea is the less people who know what your user name is, the less chance anyone can log in as you.

TIP: It is important not to use common name for your Super Administrator.

For example, such names as

• Super Administrator
• Super Admin
• Administrator
• Admin
• Owner
• Founder
• God
• Devil
• Evil Admin
• 666
• 999
• Moderator
• Mod
• Super Moderator
• Super Mod
• The title name of your site
• Your real name

Or generally anything else which maybe common.

You also do not want to keep with user ID 1

/library/config.php

$config['superAdmins'] = '1';

• Change this USER ID to whatever user you plan to use as your Super Administrator.
• CHMOD config.php to 640 to prevent anyone from remotely reading your config.php file.
• Change your Super Administrator's title to Member or to whatever common title is used on your site

TIP:

Do NOT use your Super Administrator account to address anyone, make any announcements, or do anything that could associate it as you or anything officially associated with your site. The point is so that no one knows what your Super Administrator account is. Make a hello thread, post a few simple replies, so it's not just an account with 0 post, then leave it alone.

2) Super Administrator Password - Strong

You want this to be long and as complex as possible, but easy for yourself to remember. You don't want others guessing your password.

TIP:

Do NOT use the same password that you use anywhere else. This is a common mistake and not advised.

3) Password Protect AdminCP ( admin.php )

You will need to make a password protected .htpasswd file. This file will include a user name and password. You can do this using Cpanel,Direct Admin, Web Admin, and many other control panels. There are also some generator tools that you can user (do your homework).

• Open .htaccess from within your XenForo root directory and add this on top.

AuthName "By Invitation Only"
AuthType Basic
AuthUserFile /.htpasswd
<Files "admin.php">
require valid-user
</Files>

CHMOD .htacess to 644 to prevent anyone from directly reading it.

TIP:

Do NOT use the same user name and password as your Super Administrator.

TIP

Do NOT use the path example above. Place your .htpasswd file some place above public access . You do not want anyone being able to directly access it.

Example:

Good = /some-place-else/.htpasswd
Bad = /public_html/some-place-else/.htpasswd

TIP:

If your host supports it or if you can configure it correctly. Do not use the standard name .htpasswd

TIP:

If your host support it or if you can configure it correctly. Do not use AuthType Basic, but rather use AuthType Digest. This will add encryption for better security.

TIP:

If you ever do give someone else access to your AdminCP (developer / hired help); Do NOT give them your user name and password to either your Super Administrator or .htaccess Rather give them their own temporary user name and password.

TIP:

• If you ever give someone FTP access (developer / hired help), be sure to restrict their access to public directory and do not give them access to anything above it.
• Remember to remove access once completed
• You should also backup your database before & after.
• Remember to change your database user name & password after completed (don't forget about your config.php file).
• It may also be a good idea to change the name of your Super Administrator after as well (if they accessed this file, they know now who you are).

This guide was made to support most Apache / Apache2 setups including on basic shared web hosting. More advance methods can be used, but typically require more server access.


4) YOU

• The error between user and keyboard

Even with all the security in the world, all the most powerful security programs, hardware, tweaks, tips, and even following all the above steps...

The biggest known security threat and security flaw in every computer in the world is... You.

• Only YOU can learn how to better secure yourself (although my steps will surely get you started)
• Only YOU can control your own user habits
• Only YOU can remember NOT to ignore important messages (something way to many people seem to do)
• Only YOU can learn what is safe or not safe
• Only YOU can decided who can assess your site & accounts.

YOU are your best friend and your worse enemy. This is the most important advise ANY except or computer wizard could ever give you. Please remember it and apply it