Security, backups and updates

Security checklist

• Change the default admin password and use long, unique passwords for every administrator.
• Give staff their own accounts with only the permissions they need (Admin users and permissions).
• Use HTTPS for the whole website - free certificates (Let's Encrypt) are available on almost every hosting.
• Set your own long $SECURITY_SALT in config.php and keep $DEBUG_MODE=false.
• Remove or change the passwords of the demo accounts before launch.
• Delete database/install.sql from the live server after the installation.
• Check Home › Login Logs for unknown logins.

PHP Bid protects its forms against cross-site request forgery, uses prepared database queries, stores passwords hashed, and keeps the internal addresses of the members area out of public links.

Backups

Back up two things, ideally every day with your hosting's backup tool:

1. The database - export it with phpMyAdmin or the hosting backup.
2. The files - above all uploaded_images, thumbnails, languages and config.php.

Test a restore once on a test domain, so you know it works when you need it.

Updating PHP Bid

1. Make a full backup.
2. Read the notes of the new version and run the database changes it includes.
3. Upload the new files, but keep your config.php, uploaded_images, thumbnails and your changed language files and templates.
4. Test bidding, selling and the admin panel.