Securing your installation

Staff accounts#

• Turn on two-step sign-in for every member of staff, and keep the recovery codes somewhere safe.
• Give each person a role with only the permissions they need. Keep full access for one or two owners.
• Remove staff who leave on the day they leave; review Sessions and end the ones you do not recognise.

The admin area#

• Rename the admin folder to something only your staff know, and set AdminDir as described in the Administrator Guide.
• Add your office addresses to Addresses never banned, and keep the failed sign-in limits on.
• If your hosting allows it, limit the admin folder to your office or VPN addresses in the web server.

HTTPS and the server#

• Serve the site only over HTTPS, with a valid certificate.
• Keep PHP and the database server up to date.
• Make only storage/ writable by the web server; keep configuration.php readable only by your account.

The encryption key#

Every stored secret is encrypted with the encryption_key in configuration.php. Keep a copy of that file off the server. Without it, a database backup can be restored but the gateway keys, server passwords and saved card references in it cannot be read.

The API#

Give each integration its own API credential with only the scopes it needs and an expiry date. Remove credentials you no longer use. The API log records every call.

Logs and updates#

Read the activity log now and then for failed sign-ins and unexpected changes. Install updates soon after they are released; security fixes are announced in the release notes.