Ecommerce Security Checklist

I work with LAMP-based websites, in particular Drupal, and wondered if anyone knows about a good security checklist that helps to check new and existing trading sites for security vulnerabilities?

Greetings.

+4
source share
2 answers

OWASP Top 10 is undoubtedly the best resource for web application security. OWASP is a non-profit, technology agnostic organization dedicated to improving the security of web applications. They create a document called The Ten Most Important Web Application Security Threats, which is very easy to use and should cover every corner you need to understand for an e-commerce application.

I suggest that you read each of the Top 10 carefully (the PDF version is very convenient - 1 risk per page), understanding the risk and impact, and then ensuring that you know how to mitigate this correctly in PHP. Good luck

+2
source

Database log line limit (admin / settings / logging / dblog)

I found that the default limit of 1000 can quickly wrap up, leaving you without important debugging information when you need it most. The average row length is usually around 1 kB, so even raising to 100,000 rows will still have a watchdog table managed.

User registration settings (admin / user / settings)

The default value for visitors can create accounts and does not require administrator approval, is easily overlooked and often undesirable.

Disable modules devel admin / build / modules

Not only evolving, but other other utilities (such as masquerade, tracing, or encoder) may have been installed that you do not need at the production site. Providing additional modules can interfere with your site or even create security vulnerabilities if configured incorrectly.

Set a service theme (settings.php)

By default, the Drupal standalone page uses the Minnelli theme. Switching is a nice improvement if you ever need to use maintenance mode, or if you fail, you experience unplanned downtime. In most cases, your site theme will work fine; just add $ conf ['maintenance_theme'] = 'mytheme'; to settings.php. You may also need to add maintenance-page.tpl.php to your topic; if you are using Zen, this is already done for you.

Confirm Email Settings

Often, placeholder email addresses are populated during development and must be updated prior to deployment. I try to start with the right addresses from the very beginning, whenever possible, but sometimes you do not have this information longer in the life of the project. In addition to the global site_mail Drupal site, addresses can be stored in various places: administrator user account, contact forms, web forms, ubercart, triggers or CiviCRM settings.

For Zen users - disable theme registry recovery (admin / build / themes)

If you developed your theme using Zen, be sure to turn off the Rebuild theme registry on each page. This is a huge performance penalty.

Error Reporting (admin / settings / error-reporting)

In the workplace, it is best to suppress error reports on the screen by selecting logging errors.

Performance Settings (admin / settings / performance)

The best performance settings depend on your site. Also, do not change the cache settings at the last moment without thoroughly testing the capabilities of your site. Ideally, I like to complete the cache settings about 2/3 of the way through the project, so the last stages of development and testing are performed with cache settings that will correspond to production.

Redirecting to / from 'www. * '(.htaccess)

The Drupal.htaccess file contains an example RewriteRule showing how to redirect from example.com to www.example.com or vice versa. Providing a single domain name is important if your site uses SSL, and even with simple HTTP, I like the consistency of a single URL. In addition, since the RewriteCond declaration refers to a specific host, you can add multiple domains to the same .htaccess file, either for installation on multiple sites or for multiple test / production host names.

Check proxy settings

If your production server uses a proxy server or a load balancer, Drupal needs additional configuration to accurately record remote IP addresses. This affects error logging and some modules, such as Mollom.

$ conf ['reverse_proxy'] = TRUE; $ conf ['reverse_proxy_addresses'] = array ('10 .10.20.100 ', '10 .10.30.100',);

+1
source

All Articles