Keep the config file out of every release you ship
A sample committed, the real one ignored, the release built by exclusion, and a web server rule that refuses to serve either.
Tagged “security”
9 entries
Security headers, and which pages must be exempt
A tight Content-Security-Policy breaks ad embeds and pasted network code. Set it globally, exempt the pages that carry third-party markup.
An audit log you will actually be glad you kept
Every admin action and every login, with who, what, from where. Append-only, and never editable from the panel that writes it.
Suspend an account without deleting it
A status column, one check in the session guard, and a shadow-banned tier that keeps working while earning nothing.
Throttle logins by account and by address, separately
One attacker with many addresses and many attackers on one address are different attacks. A single counter catches only one of them.
Two-factor authentication in plain PHP, no library
TOTP is HMAC-SHA1 over a time counter, truncated to six digits. About forty lines, and it works with every authenticator app.
CSRF tokens without a framework
One token per session, compared in constant time, checked on every state-changing POST. Twenty lines and no dependency.
Session cookie settings that survive a security review
Five flags and one call to regenerate. Defaults leave the session cookie readable by scripts and sendable over plain HTTP.
Fetch a user-supplied URL without opening an SSRF hole
Postback URLs, webhook targets and site verification all mean fetching an address someone else chose. This is the guarded version.