[RESOLVED] Robots & PHP Security

PHPsites

Hello.

Can anyone tell me a little bit about Robots & PHP Security? Specifically....

1) If I allow robots to access my entire site, can they scan my php files, specifically files such as database connections with passwords and such?

2) What are some common security measures to take to guard against robots?

3) Anything else I should know about robots?

Thanks everyone.

laserlight

PHPsites wrote:
1) If I allow robots to access my entire site, can they scan my php files, specifically files such as database connections with passwords and such?

If those include files are treated as PHP scripts, chances are the viewing of those files, whether by humans or bots, would be harmless, unless for some reason the PHP interpreter is not invoked. However, such include files with sensitive information should be kept outside of your document root anyway (or if they are under the document root directory, then the web server should be configured not to serve them).

PHPsites

Hi laserlight.

Thanks for the response.

How would I best go about moving the php scripts from the document root? Would I host these files on a different server?

or if they are under the document root directory, then the web server should be configured not to serve them

Can you give me more on this? I will Google to learn but not sure exactly what to Google. Is this an .htaccess file mod?

Thanks.

laserlight

PHPsites wrote:
How would I best go about moving the php scripts from the document root?

Move them (e.g., using your FTP client or SSH) and update the scripts that include them.

PHPsites wrote:
Would I host these files on a different server?

No.

PHPsites wrote:
Is this an .htaccess file mod?

That is one option, yes. For example, if you are using Apache, check out their security tips. One of them is "Protect Server Files by Default", and the same idea can be applied to protect include files with sensitive information.

PHPsites

Thanks. I'm almost there.....

laserlight;10905616 wrote:
Move them (e.g., using your FTP client or SSH) and update the scripts that include them.

I am clear on the physical manipulation of the files & adjusting the reference scripts. I am not clear on the structure.

Currently my server setup looks like this.

Site.com folder
Inside Site.com folder are all the files necessary & broken out into subdirectory folders (php_files, images, etc.)

Are you suggesting that, in the directory Site.com folder is currently located, that I create two new folders?

Php_files
Web_files

In php_files, my php code would go.
In web_files, there would be one folder - site.com. Inside site.com would be all the old stuff minus the php stuff.

Is this correct OR am I completely off base on this?

Thanks.

laserlight

PHPsites wrote:
Are you suggesting that, in the directory Site.com folder is currently located, that I create two new folders?

Php_files
Web_files

Yes, and then you change your web server configuration such that everything is not accessible to the public except for everything under Site.com/Web_files.

PHPsites

Thanks. That makes sense and probably should have been doing that all along.