I am no pro. Not one bit. Just posting what I know how to fix, and the ways I know how. If you can improve on it, PLEASE, be my guest.
TIPS AND TRICKS FOR NEW ADMINS
1. Don't tell anyone you are new. This instantly makes you a target.
2. Keep your site a secret from the community if you are new. Ironically most of the vandals and hackers lurk around for new folks.
PASSWORDS
1. Use a good password for your cpanel, ftp, ssh, mysql database, and admin panel. LONG password. Uppercase and lowercase letters, numbers, and symbols. Maybe use a password generator. The longer the password, the less success of a brute force attack.
http://www.thebitmill.com/tools/password.html#passwordbuilderDAILY BACKUP
1. In my opinion, just an opinion. THE MOST IMPORTANT SECURITY.
If someone hacks your game, so what? You got a copy from the day before. Simple enough. But I also can't stress this one enough. This is a great way to have at least SOME security, especially if you are new and learning how to code. Also comes in handy if you make a tragic mistake or error. Cpanel should have a backup setting in it (not sure, i don't use Cpanel)
Or if you use SSH to login to your bash shell, find a simple bash shell script to make a daily back up for you. Tons of them out there. Google is your friend!
Learn how to use the Export command on your phpmyadmin panel. Exporting your database to a file is simple. Just a click of a button and save the file.
After all, not sure about your games, but my entire game with the sql database is about 10mb of files. You can worry about doing a more advanced backup system in the future, when you learn a little bit more. Some files don't need a daily backup, others do.
SLOW DOWN THE BOTS
1. Use a captcha on at least your registration.php. I can't find the link to the program I use. But there are tons of free captchas out there. Captchas slow down bots. This stops bots from creating 100,000 players on you site in an afternoon.
2. Some people use the captcha on the gym.php and criminal.php to stop auto clicker scripts. The handicapped use auto clicker scripts, and so do game cheaters, and it is readily available to have a script record your clicks, and then go on a timer. There are also more simpler validate if you are human scripts. You will have to shop around. No one said securing your game would be easy!
EMAIL VALIDATOR
1. Validate the players email address. This slows down bots, and annoys hackers. There is a good one for sale on the cronwerks forums, but maybe the price should be dropped or it should be made free. Just a suggestion, after all it is a free market. I purchased the one from here, I like it, I use it.
USE LOGS
1. Ok, there are way to many log scripts out there for mccodes. You will also have to search on your own for these. Search "log" and "logs" here or at makewebgames.com. That should point you in the right direction. Logging user activity helps you spot the vandals, hackers, and cheaters. Choose wisely though, some logs are pointless and bog down your server.
FIND THE FREE FIXES.
Ones that I know of:
1. Secured Crystal Market
http://www.cronwerks.com/forum/cronwerks-free-mccode-mccodes-mods/%28mccode%29-secured-crystal-market/2. Secured Forums
http://www.cronwerks.com/forum/cronwerks-free-mccode-mccodes-mods/%28mccode%29-secured-advanced-forums/SECURE YOUR ADMIN PANEL
1. Move your admin files to a folder. An easy way to secure them is using .htaccess
You can password protect your admin folder using .htaccess.
I'm sure there is more than one way to password protect them, but this is the way I know. Here is an instructional guide to use .htaccess to password protect a folder.
http://www.javascriptkit.com/howto/htaccess3.shtml2. Rename your admin files! Go through each and everyone and rename them, and adjust the code accordingly to point in the right direction. The hackers out there know the names of the admin files, slow them down by renaming them.
3. Secure your admin files so only YOU can view them.
if(($ir['userid'] != 1) && ($ir['userid'] != 2) { echo 'You are not allowed in here!'; $h->endpage(); exit; }This snippet of code says you have to be user #1 or #2 to access the admin file. Post it at the top of your admin files, or learn how to do it in globals.
4. Auto log them out if they make themselves staff level:
Find in header.php
global $db,$c,$userid, $set;
$ip = $_SERVER['REMOTE_ADDR'];underneath paste:
//check if really an admin
if($ir['user_level'] > 1 && !in_array($userid, array('1','2','16')))
{ die("DEAD");}
//end checkand since we're on header.php, right under that, get a ban list going on. You don't like someone BAN em. Most of these script kiddies have no idea how to use a proxy.
$ban = array('00.000.000.000','00.000.00.000');
$count = count($ban);
for ($i=0; $i<$count; $i++)
if($ip == $ban[$i]) { die("You are banned from this server. $ip");}Ok, there is more stuff. I'm out of time for today.
I hope this helps some of the new folks out there.
You guys who know more than me should be posting some fixes please.
To be continued....
