One of the ways to prevent hackers from gaining access to your PHP administrative logins is to restrict access to the administrative directory. Using a web server directive called, deny all and allow from the web server can be configured to only allow access to a directory by a specific IP address or a range of IP addresses.
While using this method of blocking access by an IP address you are able to successfully login and access your web site while at the same time you are protecting your administrative login from unwanted users or hackers.
A folder or directory on your web site is the container used to hold files and sub folders or sub directories. Using a more proactive method of preventing hackers from attacking your web site. You can simply block access to any given directory by placing a ".htaccess" file into a specific directory location and then enter the web server directives into the access file which will tell the server what IP address to accept and which IP address to block.
If we use the approach to block everyone from the administrative directory and then only to allow a specific set users access we are then effectively blocking all users except for those we wish to have access to a given directory. This method can be used both for administrative logins as well as any other directory which you may want to control access.
The code below is an example of what you would need to enter into an access file. The ".htaccess" file is used to configure how a web site functions or responses to a given request. This access file is a hidden file on a Linux web server. There are many commands you can place in your access file however, I will only cover how to, allow a specific IP address or how to, allow a range of IP addresses access to a directory where the ".htaccess" file has been placed.
Content of this configuration file should look something like the following:
AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName "Access Control"
AuthType Basic
order deny,allow
deny from all
# white list a specific address
allow from 208.111.12.1
allow from 168.34.77.15
# white list a range of addresses
allow from 191.16.
Any line that starts with a pound sign is ignored. Only the specific IP addresses listed in the code above will have access to the directory structure where the ".htaccess" file has been placed, this same restriction applies to all sub folders or sub directories.
The settings of the ".htaccess" file flows downward. This means that you only want to place the access file at the root level of the directories you wish block. If you place this file too high in your directory structure you will also block the traffic that you want to have access to your web site.
No web site is a hundred percent secure. With all the security measures you place on your web sites you should always backup your account to insure that you will be able to restore your web site in case of an unforeseen event.
However using this method you can block access to any given directory and thus have a greater peace of mind knowing that you have implement a more proactive method to secure your web site than simply keeping your PHP scripts up to date.
About The Author
I have been doing web design for many years now. As a web designer I build web sites using HTML, JavaScript and CSS or by using a PHP based site such as Joomla or WordPress. I code my web sites by hand and may use a WYSIWYG type editor to adjust CSS Elements on a web page.
Come visit my Web Design site by coming to: BooneWebMaster.com
No comments:
Post a Comment