My site build with Magento 1.9.3.4.
someone sends me a mail with an attached image which is my listed directory. My question is how they fetch this. Did any setting to avoid this type of access.
asked Nov 2, 2017 at 5:51
Add a comment
|
2 Answers
Hiding directory listing is quite simply adding below line to .htaccess:
Options All -Indexes
This is normally the case for public facing folders like media where users will need access for product images however you still do not want them listing files when accessing domain.com/media
For many folders within magento there should already be .htaccess set up for which should not have public access. This will then just show the folder as Forbidden when browsed e.g. /var driectory:
Order deny,allow
Deny from all
Check your .htaccess are all present similar to magento 1 base code.
-
What is the directory you got listed? I have improved my explanation. Media needs access but not listing the later completely blocks access to files within that folder e.g. var– harriNov 2, 2017 at 9:37
-
That is looking better i was just looking at all your var directory cached configs and then you blocked that atleast.– harriNov 2, 2017 at 9:43
-
-
Yeah that's what i said in the answer. Use the Option All -indexes on media. There should already be a htaccess present with this in there however. But yeah dont deny access on folders like media– harriNov 3, 2017 at 11:59
-
As far as i know, below points can be considered of the hacking possibilities.
Few of the security patches are not installed : https://www.magereport.com/scan/?s=https://www.yourshop.com/
Check the proper folder permissions, maintain strong passwords and reset all old/previous settings.
- Contact your hosting provider on what are the possibilities for causing this. they may have clear tracking on ftp ssh/ftp log-ins with ip's.
Hope this helps.
answered Nov 2, 2017 at 6:06
