Thread

Most sites I build follow the advanced steps to move system files above the web root.  I also rename system folder and rename/move the CP Access file to a new location (masked).

http://ellislab.com/expressionengine/user-guide/installation/installation.html 

I am working with a hosting company now that will not allow me to move the system folder above the web root.  I just built a site using EE 2.1.3.  I renamed the system folder and renamed/moved the CP Access file to a new location (masked).  What else can I do to secure this site since I can’t get teh system files above web root?  They also won’t let me remove the index.php file with URL Rewrite module but that is a whole other issue.  Any way to do this without that module on a Windows 2008 server?

What else should I do to secure the site, short of changing hosting companies which is not an option as the customer had them in place first and the hosting company hired me to do the project?  Anything else I can do from my side?  Should I even need to worry if I have the other steps in place?

Anyone have any advice?

Can anyone give me some advice?  Should I move this to another forum?

Have you seen Securing ExpressionEngine 2 by Mark Huot?  That would be a good place for you to start. =)

I have the guide and have used all steps other than moving system files above the root as this host will not allow it.  I have renamed my system folder, but is there anything else I can do to protect the files and the critical config files?  Do I have to worry with the system files in the web root or do many people set it up this way?

If I can’t move the system files above the web root, what is best I can do to secure my EE system?

Many people run EE that way, and most people on EE 1 did since we didn’t have published instructions (or an easy way) to handle putting those files above web-root.  As long as you’ve renamed the system older (security through obscurity) that’s about the best that you can do to secure EE and still use all of its features.

The host did say they could remove HTTP access to a folder for me?  Would this work in same way or should I just move my config.php and have them do it on that file?

I think they remove Anonymous Access or remove Read Access or something in IIS.

I will also rename the system folder to some odd name like 11sh!99s%js^he!_system or something.  Can I use symbols I assume?