3

My site build with Magento 1.9.3.4.
someone sends me a mail with an attached image which is my listed directory. My question is how they fetch this. Did any setting to avoid this type of access.

enter image description here

1

As far as i know, below points can be considered of the hacking possibilities.

  1. Few of the security patches are not installed : https://www.magereport.com/scan/?s=https://www.yourshop.com/

  2. Check the proper folder permissions, maintain strong passwords and reset all old/previous settings.

  3. Contact your hosting provider on what are the possibilities for causing this. they may have clear tracking on ftp ssh/ftp log-ins with ip's.

Hope this helps.

1

Hiding directory listing is quite simply adding below line to .htaccess:

Options All -Indexes

This is normally the case for public facing folders like media where users will need access for product images however you still do not want them listing files when accessing domain.com/media

For many folders within magento there should already be .htaccess set up for which should not have public access. This will then just show the folder as Forbidden when browsed e.g. /var driectory:

Order deny,allow
Deny from all

Check your .htaccess are all present similar to magento 1 base code.

  • What is the directory you got listed? I have improved my explanation. Media needs access but not listing the later completely blocks access to files within that folder e.g. var – harri Nov 2 '17 at 9:37
  • That is looking better i was just looking at all your var directory cached configs and then you blocked that atleast. – harri Nov 2 '17 at 9:43
  • images can't load if I put htaccess on skin folder. – Pratik Kamani Nov 3 '17 at 11:48
  • Yeah that's what i said in the answer. Use the Option All -indexes on media. There should already be a htaccess present with this in there however. But yeah dont deny access on folders like media – harri Nov 3 '17 at 11:59
  • @PratikKamani did you fix this? – harri Nov 6 '17 at 10:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.