A Brief Discussion on Security Settings for Virtual Host Websites

Published: 2014-09-05

```html

In today's online world, every website faces various network threats, the most common of which include:cc attacks, Ddos attacks, xss attacks, sql injection, upload vulnerabilities, web page trojan injection, tampering, etc. Next, let us briefly discuss how to protect against such attacks, mainly from two aspects: first, website programs; second, virtual host settings.

I. Website Program Security Recommendations

1.If you use a well-known system, such as DedeCMS, pay attention to upgrading patches to the latest program in time.

2.The backend login address cannot use conventional ones such as/admin, /system, etc.; it is recommended to change it to a slightly more complex path.

3.Backend management usernames and passwords need to be changed to complex ones. Many hacked sites are caused by the initialadmin/admin username and password.

4.Manage the website regularly and handle abnormalities promptly. If web page trojan injection or Trojan infection occurs, clean it up promptly and apply security settings.

II. Virtual Host Security Settings. (The main idea is to set the entire site to read-only state, separately grant write permissions to upload directories that require write access, but use the directory protection function to disable script execution permissions for that directory.)

For common web page trojan injection, tampering, upload vulnerabilities, etc., virtual hosts provide a large number of security setting functions, which will be explained one by one below.

If you are using a windows host, please perform the following operations:

(1)Read-only settings. It is recommended to set the read-only attribute only for directories that do not need updating or important files, to prevent hackers from tampering. For example, homepage files and database connection files that generally do not need updating can be set to read-only. It is not recommended to set the entire site to read-only, as it will make later maintenance more troublesome.

Windos host: Log in to our backend - Business Management - Virtual Host Management - Manage - File Management

After selecting the directory or file you need to set, click the Permissions button.

After confirmation, click [Confirm Settings]. After setting, you can check whether the setting is successful through the permissions function in File Management.

(2)Directory protection, which provides good protection against upload vulnerabilities. It is recommended to set directory protection for high-risk directories; after setting, the execution permissions of the corresponding directory will be cancelled. (Especially upload directories with write permissions, such as dedecms's plus,upload and other directories)

Windows host: Click Host Control Panel-Website Security Management - Directory Protection

After selecting the directory to be set through Browse - click [Add]. After setting, you can upload a program file to this directory to test whether it can run normally

If you are using a linux system virtual host, please follow the settings below:

Linux system host: Log in to our backend - Business Management - Virtual Host Management - Manage - File Management

Select the directory to be set - Permission Settings - Owner and Group read-only, and apply to subdirectories at the same time.

(2)Directory protection, which provides good protection against upload vulnerabilities.

Set directory protection for high-risk directories to disable script execution permissions. (Especially upload directories with write permissions, such as dedecms's plus,upload and other directories)

DedeCMS security settings http://www.west.cn/faq/list.asp?unid=729

At this point, common security settings have been completed. If your website contains access database, it is recommended that you set a relatively complex file name; the file cannot use .mdb as the suffix, and can be changed to, for example, test.test, test@3.asp, etc.

Friendly reminder:The above website security settings can only prevent your website from being hacked to the greatest extent possible; they are not a once-and-for-all solution. As a diligent webmaster, you also need to regularly back up your website yourself in case of need.

Additionally: West.cn provides a backup once every 7 days for all virtual hosts (only one copy). Log in to our backend - Business Management - Virtual Host Management - Manage - Restore Backup, where you can view and operate the restoration of the backup provided by our company.

```