How to prevent Dedecms from being hacked

How to prevent Dedecms from being hacked?

What troubles many webmasters is that the websites they build using dedecms are often hacked inexplicably, resulting in pages full of black links, which is infuriating; even more seriously, there may be Being punished by search engines, the site that I worked so hard to build saw its weight decrease, its inclusion decrease, and it was even K.

Recommended study: 梦Weavercms

In fact, I am a grassroots person. After being invaded by several sites and actively invading other sites, I came to the experience: for dedecms to hang the horse, We can definitely prevent it before it happens. Today, based on my own experience, the author will talk to the majority of dede enthusiasts about how to prevent dedecms from being hacked:

1 Server security This is the most fundamental prevention.

If you are an independent host, I believe you have taken this into consideration when setting up the server. The latest version of anti-virus and anti-virus software must be installed on the server, updated in time, and the security permissions of the server must be set so that Trojans cannot find the door to invade. As for how to set it up, you can search a lot online; if you are renting a virtual host, you need to keep your eyes open and check carefully. Some current IDC agents only care about money but not people. Choosing a good space provider will give you a safer space to build your website. Even if something goes wrong, it will be solved as soon as possible. You must know that some problems on the site cannot be postponed, especially if the site is maliciously linked. If you pay attention, you may be K-sited. I heard that the A5 console is pretty good, so I’ll give it a try if I get the chance.

2 Dedecms security settings under windows host After downloading and installing the program, the first thing to do is to set the directory permissions, so that even if the Trojan breaks through the server's restrictions, we will not let it find a way to further damage. If you are a Windows host, the directory permissions can be set like this: (1) For the data, templets, uploads, and a directories, set readable, writeable, and non-executable permissions; (2) If you do not need a special topic, it is recommended to delete the special directory. If necessary, you can After generating HTML, delete special/index.php and set the directory to be readable, writable, but not executable; (3) include, member, plus, and background management directories are set to executable scripts, readable, but not writable. (If additional modules are installed, the book, ask, company, and group directories are also set up in this way). In addition, it is recommended to delete the install directory and not directly use the MySQL root user permissions on the website. Set up an independent MySQL user account for each website. The permissions are: SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER, CREATE TEMPORARY TABLES. Since DEDE does not use stored procedures anywhere, be sure to disable FILE, EXECUTE, etc. permissions to perform stored procedures or file operations.

3 After setting the directory permissions for the program update patch, let the website backend, don’t be busy adding columns and documents, check the system homepage to see if there are any patch prompts for upgrading and updating. If there is, don’t hesitate, hurry up. Put it on. If you are using an older version of the program and the patch prompt is for the latest version, it is recommended to reinstall the latest version of the program. Now dede has released V5.6, which is more secure than the previous version. Friendly reminder: Don’t forget to back up important data before upgrading the program, including pictures, templates, etc.

4 Rename the backend directory. After dede is installed, the default backend directory is dede. This makes it easy for people to guess the backend address, which is extremely unsafe. Change it to something more complex, preferably not something easy to guess like a website name.

5 Complicated FTP passwords If your FTP password is very simple, it is easy to be guessed by some FTP weak password software. Therefore, try to make the FTP password as complex as possible, preferably a combination of letters and numbers, more than 10 digits, so that those cracking programs will crash.

6 The last point is data backup. In fact, even if we take strict precautions, we can't completely prevent being hooked. As the saying goes, the higher the road, the higher the devil! Therefore, your website data must be backed up frequently. In this way, even if the website is hacked, the data can be restored by reinstalling the program to minimize the loss. After all, data is the most valuable wealth of webmasters.

Okay, the above 6 points are all summaries of my experience in practice. Next time I will write an article about how to deal with dedecms after it hangs.

The above is the detailed content of How to prevent Dedecms from being hacked. For more information, please follow other related articles on the PHP Chinese website!