DedeCMS dedecms program security settings

```html

1. Upgrade to the latest version of dedecms

   The dedecms backend generally supports online upgrades. If it does not work, please check the official website for manual upgrade methodswww.dedecms.com

2. Permission settings:

   In the hosting control panel, click "File Management", select the wwwroot directory, then click the "Permissions" button, and set all files of the entire site to read-only. Older versions may prompt a verification code error when logging into the backend. Enter the wwwroot directory, select the data directory, then click "Permissions" to separately set data to Full Control (readable and writable) permissions. The directory for generating documents can also be set separately to Full Control permissions, or set the wwwroot directory to Full Control when documents need to be updated. Note: After updating documents, set it back to read-only again.

3. Directory protection:

   To prevent Trojans from being uploaded and executed, please click the "Directory Protection" function in the control panel, and sequentially select the three directories templates, uploads, and data to add protection (to prohibit script execution and prevent hackers from uploading Trojans)

4. Add SQL injection protection script:

   Reference:http://faq.myhostadmin.net/faq/listagent.asp?unid=645 If you use our company's pre-installed 360 Security version, you can skip this step.

  For websites that have already been compromised, please follow the tutorial below:

   ①. Download a dedicated removal tool to scan and remove:

    http://faq.myhostadmin.net/faq/listagent.asp?unid=673 Then regenerate the files.
   ②. Manually analyze and identify abnormal files. If severely hacked, it is recommended to back up the current database and important files, then clear and re-upload/install and restore the database.

   Related files: A Brief Discussion on Virtual Host Website Security Settings

   Set website permissions to Full Control (readable and writable):

    http://www.west.cn/faq/list.asp?unid=286

5. Use pseudo-static to disable script execution in directories

Linux system:

Create a new txt text file, open it with a text editor, copy the following rules and save, upload to the website root directory, and rename the file to .htaccess (note the dot)

RewriteEngine on

#Security settings: prohibit the following directories from running specified PHP scripts

RewriteCond % !^$

RewriteRule a/(.*).(php)$ – [F]

RewriteRule data/(.*).(php)$ – [F]

RewriteRule images/(.*).(php)$ – [F]

RewriteRule css/(.*).(php)$ – [F]

RewriteRule js/(.*).(php)$ – [F]

RewriteRule style/(.*).(php)$ – [F]

RewriteRule skin/(.*).(php)$ – [F]

RewriteRule templets/(.*).(php|htm)$ – [F]

RewriteRule uploads/(.*).(php)$ – [F]

Windows system:

Create a new txt text file, open it with a text editor, copy the following rules and save, upload to the website root directory, and rename the file to web.config.

If the website directory originally has a web.config file, only copy the red part below and add it after the <rules> line

<?xml version="1.0" encoding="UTF-8"?>

<configuration>

<system.webServer>

<rewrite>

<rules>

<rule name="Block a" stopProcessing="true">

<match url="^a/(.*).php$" />

<conditions logicalGrouping="MatchAny">

<add input="{USER_AGENT}" pattern="a" />

<add input="{REMOTE_ADDR}" pattern="" />

</conditions>

<action type="AbortRequest" />

</rule>

<rule name="Block data" stopProcessing="true">

<match url="^data/(.*).php$" />

<conditions logicalGrouping="MatchAny">

<add input="{USER_AGENT}" pattern="data" />

<add input="{REMOTE_ADDR}" pattern="" />

</conditions>

<action type="AbortRequest" />

</rule>

<rule name="Block skin" stopProcessing="true">

<match url="^skin/(.*).php$" />

<conditions logicalGrouping="MatchAny">

<add input="{USER_AGENT}" pattern="skin" />

<add input="{REMOTE_ADDR}" pattern="" />

</conditions>

<action type="AbortRequest" />

</rule>

<rule name="Block style" stopProcessing="true">

<match url="^style/(.*).php$" />

<conditions logicalGrouping="MatchAny">

<add input="{USER_AGENT}" pattern="style" />

<add input="{REMOTE_ADDR}" pattern="" />

</conditions>

<action type="AbortRequest" />

</rule>

<rule name="Block css" stopProcessing="true">

<match url="^css/(.*).php$" />

<conditions logicalGrouping="MatchAny">

<add input="{USER_AGENT}" pattern="css" />

<add input="{REMOTE_ADDR}" pattern="" />

</conditions>

<action type="AbortRequest" />

</rule>

<rule name="Block js" stopProcessing="true">

<match url="^js/(.*).php$" />

<conditions logicalGrouping="MatchAny">

<add input="{USER_AGENT}" pattern="js" />

<add input="{REMOTE_ADDR}" pattern="" />

</conditions>

<action type="AbortRequest" />

</rule>

<rule name="Block images" stopProcessing="true">

<match url="^images/(.*).php$" />

<conditions logicalGrouping="MatchAny">

<add input="{USER_AGENT}" pattern="images" />

<add input="{REMOTE_ADDR}" pattern="" />

</conditions>

<action type="AbortRequest" />

</rule>

<rule name="Block templets" stopProcessing="true">

<match url="^templets/(.*).php$" />

<conditions logicalGrouping="MatchAny">

<add input="{USER_AGENT}" pattern="templets" />

<add input="{REMOTE_ADDR}" pattern="" />

</conditions>

<action type="AbortRequest" />

</rule>

<rule name="Block uploads" stopProcessing="true">

<match url="^uploads/(.*).php$" />

<conditions logicalGrouping="MatchAny">

<add input="{USER_AGENT}" pattern="uploads" />

<add input="{REMOTE_ADDR}" pattern="" />

</conditions>

<action type="AbortRequest" />

</rule>

</rules>

</rewrite>

</system.webServer>

</configuration>

```