119 votes
Accepted

How secure is Craft and why is it secure?

Updated Answer for Craft 3 I've updated and consolidated the technical parts of this for Craft 3 and placed them in a security FAQ for easier referencing: https://craftcms.com/guides/security-faq ...
user avatar
  • 66.4k
16 votes
Accepted

How to handle the SECURITY_KEY?

First a bit of history: Craft 2 has a similar concept where it would store a unique random security key in craft/storage/runtime/validation.key. Alternatively, you could set the validationKey config ...
user avatar
  • 66.4k
14 votes

Password protect a single page

Yes. Use the RequireLogin tag at the top of a page: {% requireLogin %} This tag will ensure that the user is logged in. If they aren’t, they will be redirected to the Login page, and returned to ...
user avatar
9 votes
Accepted

Creating partials outside of the templates folder

So a few potential things to consider: You do not want to be serving static assets like Javascript, CSS, etc. out of the templates directory. I realize you're planning to put them "elsewhere", but ...
user avatar
  • 10.9k
8 votes

Forms are triggering CSRF Protection. Why would CSRF Protection trigger false positives?

We got this sorted before I finished my Stack Exchange question so I figured I'd share if anyone else runs into similar behavior. After some troubleshooting, we learned that the issue here was that ...
user avatar
  • 13.2k
8 votes

What are useful guidelines for Craft CMS security on VPS (virtual private servers)?

This morning a couple of postings on Craft Slack #devops area linked good descriptions of basic server security, led by @merlingore there. Their instructions are tilted towards Ubuntu as far as ...
user avatar
  • 1,697
7 votes
Accepted

Is it a security risk to put Craft templates inside public root?

If you’re running Apache, you can put a .htaccess file in your templates/ folder with this in it: Deny from all and any HTTP traffic to that folder will be given an Apache 403 error. Even better, ...
user avatar
7 votes
Accepted

How do _you_ protect input against XSS? ("HtmlPurifier"?)

When dealing with XSS concerns, it's important to stay focused on the fact that this is a client-side issue... So in regards to Craft, Twig is the star of the show. Fortunately, Twig takes measures ...
user avatar
  • 23.6k
7 votes
Accepted

Is it safe to have PHP files in the public directory of a craft cms website?

As long as the PHP files themselves don't introduce any security holes, having them in your web root is perfectly fine. That's not uncommon at all. How they were written makes all the difference, of ...
user avatar
6 votes

Creating partials outside of the templates folder

I've been making use of macros to create a component based architecture in a recent project. I've found this way of working useful in a few different ways: Jumping around your codebase is much easier ...
user avatar
  • 3,833
5 votes

Login attempts limit

There are several config settings which should help... maxInvalidLogins - The number of invalid login attempts Craft will allow within the specified duration before the account gets locked. ...
user avatar
  • 23.6k
5 votes
Accepted

Content Security Policy CSP

I implemented this recently and what I ended up doing is return the content security headers using PHP. Depending on the request path (is it a CP URL or not?), we send CSP headers with unsafe-inline ...
user avatar
  • 496
5 votes
Accepted

Security Key and Boilerplate

You can run the craft setup/security-key console command after cloning the repo. That'll generate a security key for that Craft install and put it in the local .env file. Or for that matter, craft ...
user avatar
  • 66.4k
4 votes

Is it possible to have secure (private) assets?

I ran into this requirement today and initially assumed a plugin would be required, but then I spotted that the native Assets action menu already included a Download File option and it was working ...
user avatar
4 votes

Minimum database privileges for Craft front-end?

Short answer, no. You'll want to make sure that your DB user has all of the necessary privileges. Just because you're not entering your data into the database doesn't mean that Craft isn't writing ...
user avatar
  • 23.6k
4 votes

Is it possible to restrict access to a page based on a visitor's country?

Luke Holder has created a plugin that would help you in this situation. Geo Plugin for Craft CMS
user avatar
4 votes
Accepted

Is there a 2-factor auth plugin?

Is there a 2-factor authentication plugin for Craft? I've heard of one in private testing, but I'm not aware if they plan to release it publicly or not. Until the official Craft plugin store becomes ...
user avatar
  • 66.4k
3 votes

Restrict control panel by ip address?

If you're looking to only allow certain IP addresses to access the entire control panel, you're best bet would be to whitelist them via an .htaccess file. Something like: <Limit GET POST> ...
user avatar
  • 66.4k
3 votes
Accepted

How should I set an arbitrary session value in a plugin?

Try this: $cookie = new HttpCookie('myCookieName', $data, [ 'expire' => time() + 3600 ]); craft()->request->getCookies()->add( $cookie->name, $cookie ); Your code for reading the ...
user avatar
3 votes

Is it possible to have secure (private) assets?

There is a plugin from Jeroen Kenters called Member Assets which denies access when logged out. If you really need a random url, you could extend his plugin.
user avatar
  • 8,316
3 votes

Is it a security risk to put Craft templates inside public root?

It depends on what kind of secure infos you write into your templates. I wouldn't put my credit card infos into a twig comment for example, if the template is not above the root. But normally all one ...
user avatar
  • 35.8k
3 votes

Can we log both access & content changes?

Craft does some basic logging in the form of when an entry was updated/created and the last time a user logged in and from what IP address, etc. If you want anything more detailed than that, you'd ...
user avatar
  • 66.4k
3 votes
Accepted

Removing x-powered-by and changing cookies names for security?

Will it be against the terms and agreements of craft to remove those headers? Will writing a plugin for it be the best way No to both questions – just add the following config values to your /config/...
user avatar
3 votes

Encrypt ID on front-end and decrypt on back-end

<input type="hidden" name="foo" value="{{ 'bar'|hash }}"> and then in your controller: if (($foo = craft()->request->getPost('foo')) !== null) { $foo = craft()->security->...
user avatar
  • 6,637
3 votes

Creating partials outside of the templates folder

Some good answers already by Luke and khalwat. I wouldn't try to load any templates outside of the normal Craft folder... you get into plugin territory there and it's not necessary. Your templates ...
user avatar
  • 6,442
3 votes

Is it safe to have PHP files in the public directory of a craft cms website?

You should always be careful with PHP source files in a public folder. Typically it's fine, however a small mistake in the server's configuration can lead to big problems. It might cause .php files ...
user avatar
3 votes
Accepted

How long does a CSRF token lasts?

Each session gets it's own CSRF token, so technically it will be valid as long as a session is valid.
user avatar
  • 2,947
3 votes
Accepted

Enabling CSRF Protection for Mailchimp Subscribe plugin and other forms

Enable CSRF protection in your config again and add {{ getCsrfInput() }} right after the <form> opening tag on all forms on your site, regardless if they are amforms or mailchimp subscribe. I ...
user avatar
  • 1,887
3 votes
Accepted

How can I make Sprout Invisible Captcha plugin works using AJAX submission?

Based on your code - and our comments - you need something like this: <form id="someFormId"> <input type="hidden" name="action" value="sproutForms/entries/saveEntry"> <input ...
user avatar
3 votes

Temporarily access to an entry

You can share a temporary link to an unpublished entry by clicking on the "Share" button, right next to the "Live Preview" button. Craft 2: Craft 3: This creates a link with a token that will ...
user avatar
  • 23.6k

Only top scored, non community-wiki answers of a minimum length are eligible