I'm looking to write a web app for storing/accessing sensitive data... Think of an eWallet or a specialized version of Evernote. I could custom write it in php but securing *any* web app these days is such a daunting task... The myriad of ways it could be hacked are overwhelming and I'm not sure I'm up to the task of truly locking it down.
I'm looking at MODX/Revo specifically for its reputation for security - and yet within the first 10 forum topics, two of them talk about being hacked. Are these users doing something wrong that I can avoid? Can Revo be configured to automatically apply security updates as they're released? Is there a checklist of MODX-specific best practices that might make it easier for me to lock my app down? Would hosting it in MODX Cloud provide additional layers of security such that I should seriously consider that?
Would you, personally, feel safe/confident that a Revo app that stores sensitive data was secure enough?
Yes, I would. MODX has some excellent built-in protections and is relatively easy to lock down further. You can't update automatically, but you can subscribe to a security feed that alerts you to any known vulnerability and you can upgrade easily from the Manager with the UpgradeMODX extra. You'll also see security notices in the Manager Dashboard unless you turn that feed off.
The vast majority of hacking reports, in my experience, are from people who let their sites get several versions behind, and/or didn't follow the advice here:
https://docs.modx.com/revolution/2.x/administering-your-site/security/hardening-modx-revolution
and here:
http://bobsguides.com/blog.html/2015/05/05/hardening-your-modx-site/
There are a lot of MODX sites out there where the core directory is accessible via the web, the manager directory is called 'manager' the username of the main admin is 'admin', and the admin's password is in the dictionary. That's kind of asking for trouble.
Bob- Thank you so much for the response and all the links! So helpful! I'm reading your MODX guides and just signed up with A2 based on your recommendation. I'll be converting all my websites over from Wordpress and, once I get everything properly hardened, I'll get started on the app mentioned in my original post. Again, thank you - not only for your advice in this thread, but for your many contributions to MODX newbies like me!
Glad I could help.
