Support

Hi,

You can "thank" the majority of template providers for that :( The majority of template providers require that PHP files inside their template directory are accessible over the web. Since most people have no idea about that, the default settings in both the Master .htaccess and Admin Tools Professional's .htaccess Maker is to allow the execution of PHP files inside subdirectories of the templates directory.

With Admin Tools Pro, however, you can increase the security by doing the following:
- Activate all Web Application Firewall settings as per the Quick Setup instructions. These will prevent upload of rogue PHP files and using an arbitrary template in the URL, essentially disabling the attack vector which was used to hack your site.
- In the Server Protection pane of .htaccess Maker, find the "Allow direct access, including .php files, to these directories" and remove "templates" from the list. Note: this is a new feature which is going to be added in version 2.1.11 next week; the current version has the exception for the templates directory hard-coded. This will prevent the execution of PHP files inside the templates directory.

Regarding the Apache log analyzer, that would be like asking for a silver bullet :D First we have the objective difficulty in obtaining access to Apache's access log. Not all hosts allow PHP to read it. Then, we have the size issue. My access logs are in the order of several dozens of Megabytes long and I only have a medium traffic website. Loading and analyzing such a big file would cause PHP memory outage and timeouts. Then, we have the question "what to look for". This is not as easy as you might think. That's why it's hard and you need a human to assess the information. Having software to track each session by IP could yield some results, but if I were a clever hacker I would use TOR to effectively randomise my IP on each request, making tracking me down nigh impossible without much effort. That's why there is no such feature in ATPRO.