[Anarchist]

Most of these steps may already be self-explanatory, especially to those with a lot of experience when it comes to running MyBB forums. If not, these tips can be EXTREMELY useful.


1. Rename your admin directory.

This is really simple, but also effective. It adds a lot of additional security onto your forum.

1. Connect to your forum via your FTP, e.g. FileZilla.
   
2. Rename your /admin directory to whatever you like.
   
3. Open up /inc/config.php.
   
4. Change 'admin' in "$config['admin_dir'] = 'admin';" to your new admin directory.
   
5. Change the '1' to a '0' for showing admin links of forum.
   
6. Upload the file, and you're done.
   

2. Protect your ACP with a password.

Create a file called .htaccess in your admin directory, and put the following in it.

Code:

AuthType Basic AuthName "Authentication Required" require valid-user AuthUserFile "/home/account/.htpasswds/public_html/admindir/passwd"

Obviously your file location will be different. Then, create a file in /home/account/.htpasswds/public_html/admindir/passwd with the password(s) you want to be authenticated. There are many ways to do this, but I use this website to make a password. Just paste them in and save it, and you're done.



3. Protect your Admin Control Panel by IP.

This won't work if your IP changes a lot, but for those of us who that doesn't apply to, it's a VERY secure way to limit hacks. Add the following to your admin directory .htaccess.

Code:

Order Deny,Allow Deny from all # username Allow from your.ip.goes.here

Tip; Add a little note/comment above the allow statement so you can tell which person has which IP address, in case you need to change it.



4. Use a dummy admin account for all your work.

Hackers always target the account of the owner when they use security loopholes, because common sense tells them that is the most powerful account. Well, what you need to do is make your account powerless in the Admin Control Panel, and do all work from a SECRET account, that looks just like any other user. Just remember to keep the password for that account secure, and don't let anyone know which account is a dummy.

Now we're getting crazy...



5. Get rid of the backup module.

If someone gets past the first three methods, likely they will want to download your database so they have access to all of your members' data. Well, we wouldn't want that happening. On MyBB, the script is located at /admindir/modules/tools/backupdb.php. You can move that onto your computer, and re-upload it when you need to take a backup. Or better yet, take backups through cPanel or SSH instead.


It is recommended that everyone performs at least the first four steps.


Credits to the original creator of this tutorial:

• pandaa - ForumHour member

[Sly]

Amazing steps to keeping you ACP secure!
I'll hopefully be implementing most of these onto my forums.

[Exiled]

Though I know most of what has been written in the OP. But you explained it in a more detailed way and was easy to understand. Once again thanks, Uzi!

[Redbull]

Very Nice Guide Uzi, It's very High Quality and easy to understand brother.

[Harvey]

I've actually never done this in the past. Thanks a lot for sharing, will certainly be implementing this.

[Dutch Leader]

Very nice guide, thanks a lot for this!

[Ronnie]

Thanks for this thread Uzi, very helpful.

I will be doing this when I actually use my forums, aha.

[Banadmin]

Great informative thread, Uzi! :'D

Adding a username and password authentication is much more effective rather than an I.P one. As you should all know your I.P address can change multiple times within one day, this then means you have to edit your '.htaccess' file every single time.

This can be done via cPanel. I'll make a tutorial shortly.