# How to Secure Your Server

## General Recommendations

Often, standard hosting services have limited options for fine-tuning security, so we recommend hosting your exchange service on a Virtual Private Server (VPS/VDS) and configuring it to reduce the risk of hacking. Typically, hosting providers offer paid services for setting up virtual servers. You can hire external specialists for configuration, but only those you trust.

* On the hosting service (billing for managing the service) where your site is hosted, enable SMS authorization for your account. Set up other access restrictions if your hosting provider offers them. For Reg.ru hosting, at a minimum, enable SMS authorization and email notifications for account logins.
* Update the **Ioncube Loader** module to the latest version.
* Install and configure the **fail2ban** module on the server.
* Install antivirus software and a port scanner on the server. Set up regular scans of server files and ports.
* Configure the firewall. Block ports for FTP, SSH, and various shell clients.
* Block standard URLs for server login forms. For example, for Ispmanager, these are: `https://ip_address/manager`, `https://ip_address/manager/ispmngr`, `https://ip_address/ispmngr`.
* Change the default port for the server login form. For Ispmanager, the default port is usually 1500. Set it to any available port number.
* Block access to phpMyAdmin. You can do this by setting the permissions of the phpMyAdmin folder to 444 on the server.
* Block access to webmail clients. For example, `https://ip_address/webmail/`, `https://ip_address/roundcube/`, etc. Again, set the permissions of the mail client folder to 444 on the server.
* For all server users, including **root**, set a password that is at least 15-25 characters long.
* Do not store backups of files and databases on the server, especially in the root directory of the site.

## **Configuring Services and Options**

* Disable the use of [web shells](https://encyclopedia.kaspersky.ru/glossary/web-shell/) through the php.ini file (edit the existing directive or add a new one):

  ```ini
  disable_functions = exec,system,passthru,shell_exec,proc_open,show_source
  ```

<details>

<summary>If you are using Ispmanager, follow these steps:</summary>

1. Log in to Ispmanager as a <mark style="color:red;">**root user**</mark>.
2. Go to the "**Websites**" section, select your website, and click the "PHP Settings for the Site" button.

<figure><img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-3e037e8f0964064f85517119b87a7a4bab804f0b%2Fimage%20(2181)_eng.png?alt=media" alt=""><figcaption></figcaption></figure>

3. Search for the `disable_functions` directive, check it, and click the pencil button ("**Edit Variable**").

<figure><img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-71fdd49dffb571b1fb6a285fc2aa368195be9d56%2Fimage%20(2182)_eng.png?alt=media" alt=""><figcaption></figcaption></figure>

4. Add the specified functions (do not remove the previous values — just append the specified functions): **`exec,system,passthru,shell_exec,proc_open,show_source`** and save the changes.

   <figure><img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-1e470446416f5582617dd8728d1bd716c7b13c5e%2Fimage%20(2183)_eng.png?alt=media" alt="" width="544"><figcaption></figcaption></figure>

</details>

* Disable file uploads through **`allow_url_include` and `allow_url_fopen`** — this will reduce the risk of remote code execution:

  ```ini
  allow_url_fopen = Off
  allow_url_include = Off
  ```

<details>

<summary>If you are using Ispmanager, follow these steps:</summary>

1. Log in to Ispmanager as a <mark style="color:red;">**root user**</mark>.
2. Go to the "**Websites**" section, select your website, and click the "**PHP Settings for the Site**" button.

<figure><img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-3e037e8f0964064f85517119b87a7a4bab804f0b%2Fimage%20(2181)_eng.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

3. Search for the directives containing `allow_url`, check them, and click the pencil button ("**Edit Variable**").

<figure><img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-3879f5801987378eca200eb740e8eb06b0db7fef%2Fimage%20(2185)_eng.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

4. Set `Off` for the variables and save the changes.

<figure><img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-e797b788d6892bdfb62acbbcde6e3160769fdc94%2Fimage%20(2184)_eng.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

</details>

* Disable certain extensions (if they are not needed). For example:

  ```ini
  extension = phar.so ; // if phar is not used
  ```

<details>

<summary>If you are using Ispmanager, follow these steps:</summary>

1. Log in to Ispmanager as a <mark style="color:red;">**root user**</mark>.
2. Go to the "**PHP**" section, select the PHP version [that your website is using](https://premium.gitbook.io/main/en/basic-settings/faq/kak-proverit-versiyu-php-ispolzuyushuyusya-dlya-saita) and click the "Extensions" button.

<figure><img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-f3e8c0643f0dce9ae96b99d97a2f1e6c30ae0c9e%2Fimage%20(2186)_eng.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

3. Search for the extension **`phar`** (for example), check it, and click the pencil button ("**Disable Extension**").

<figure><img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-9934f57b134d86cd3735120852a3cd909c27926f%2Fimage%20(2187)_eng.png?alt=media" alt="" width="531"><figcaption></figcaption></figure>

4. Click the button and confirm the disabling of the extension in the pop-up window.

</details>

* Restrict access to `php.ini` and `wp-config.php` through the `.htaccess` file:

  ```ini
  <FilesMatch "^(php\.ini|wp-config\.php)$">
      Order deny,allow
      Deny from all
  </FilesMatch>
  ```

<details>

<summary>If you are using Ispmanager, follow these steps:</summary>

1. Log in to Ispmanager as <mark style="color:yellow;">**any user**</mark>.
2. Go to the "**Websites**" section, select your website, and click the "**Website Files**" button.

<figure><img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-eaec55497f704d62451e92a1f2648e18342a0bde%2Fimage%20(2188)_eng.png?alt=media" alt=""><figcaption></figcaption></figure>

3. Find the `.htaccess` file and enter edit mode by double-clicking it.

<figure><img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-562da986fdf01d12a2acc3fbbbb498bce75fe3e4%2Fimage%20(2190)_eng.png?alt=media" alt="" width="479"><figcaption></figcaption></figure>

4. Add the text specified above to the file and save the changes.

<figure><img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-1846533464edc28c606d20732dbce3f3c5ad4ca5%2Fimage%20(2191)_eng.png?alt=media" alt="" width="543"><figcaption></figcaption></figure>

</details>

## File Permissions Configuration

<figure><img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-bbe2c28632a218dca92d7ed83650d7cd3c1d7685%2Fimage%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)_eng.png?alt=media" alt="" width="563"><figcaption></figcaption></figure>

If a warning about file permission errors appears in the admin panel as an animated <mark style="color:red;">red circle</mark>, open the section with errors.

If the section displays an error about incorrect file permissions, change the permissions of the specified files to more secure settings (~~struck-through value~~ — <mark style="color:red;">current permissions</mark>, after ➔ <mark style="color:green;">recommended permissions</mark>).

{% hint style="success" %}
[Official instructions](https://developer.wordpress.org/advanced-administration/security/hardening/#file-permissions) from WordPress on configuring file permissions.
{% endhint %}

{% hint style="info" %}
Warnings are also displayed in the "Console" section, under the "Security Check" block.

<img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-8f9757f0ee745b9ba58e32f3bf50faa6e8f84dca%2Fimage%20(2)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)_eng.png?alt=media" alt="" data-size="original">
{% endhint %}

\
When using Ispmanager, go to the "**Websites**" section, select your website, and click the "**Website Files**" button.

<figure><img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-eaec55497f704d62451e92a1f2648e18342a0bde%2Fimage%20(2188)_eng.png?alt=media" alt=""><figcaption></figcaption></figure>

Select the file with incorrect permissions and click the "Attributes" button.

<figure><img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-31f228f14e4ed9b149f1c68897e30a09d17ee3b9%2Fimage%20(2193)_eng.png?alt=media" alt=""><figcaption></figcaption></figure>

Set the recommended permissions in the "Access Rights" field and save the changes.

<figure><img src="https://3137668309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwgP5ZE7DnnlT9DQMSCQz%2Fuploads%2Fgit-blob-3465b1c6e29526a7ecb5da7baaa90ce4dc2fb2ed%2Fimage%20(2197)_eng.png?alt=media" alt="" width="248"><figcaption></figcaption></figure>

After changing the permissions, the warning will disappear from the admin panel.
