Scripts can be either free and some are paid.Many webmasters need scripts either php or cgi with their web site automation. Whatever you install, you need to keep your scripts secure to stop hackers to manipulate your site. Here are few simple things to protect your scripts:
- Upgrade scripts: Always upgrade to new versions of software whatever it is. Because many bugs or security issues will be answered in new versions of software. Subscribe to authors mailing list and keep the script files up to date.
- Passwords: Secure the adminpanels with secure passwords. I have seen many people using regular names/words/simple 5 character passwords.
- File permissions: Avoid 777 permission in script folders. This is not always possible on all software. If scripts are running under your user ID, you may not need 777 permissions. Ask your host to update your server API to CGI.
- Form submissions: Watch out form submissions. You can use Regexp to process the data from forms. You can also define preloaded variables as form data in the form of checkboxes, radiobuttons etc. Use forms that strip off all the html tags from the data before it enters your database.
- Make the folder web inaccessible: Upload index.html/index.php (blank files) in images folder , or other script folders to avoid web accessible of all files in those folders.
- Attachments and uploads: Disable attachments or uploads if you are hosting forums or guestbooks. Because these features need 777 permission for folders.
- Be a subscriber: Subscribe to your host newsletter especially if you have a VPS/dedicated server. They update you with security issues of the server software. Ask your host to update server side programms like mysql, php, cgi etc.
- Free software: If you have installed free scripts like Wordpress, search google for ‘wordpress security’. You will get many tips on how to make your WP blog secure.
- Stop the clutter: Delete unnecessary scripts that you have installed long back and no longer using.
- .htaccess: Use .htaccess in your folders where you don’t want others to access the php script files. You can use this code in htaccess to stop access:
<Files *.php>
Order Allow,Deny
Deny From All
</Files>
