Move manager? Non-standard manager location?

You can't have the manager above the web root: it must be accessible via HTTP.

We are thinking about moving the manager-folder above the root and assign this moved manager-folder to another domain or to a subdomain of our website the manager belongs to. But we are not sure if this approach makes sense de facto.

Moving the core directory above web root [ ... ] but yes, it makes updating more time-intensive.

Did you only move the core-folder above web root or is it useful to move the connectors-folder, too?

And some of the Add-Ons (and sometimes even the setup process itself) have incorrectly referenced paths, so once I had to move things to the standard locations, then run the updates, then move them back to a custom location.

That doesn´t sound very promising. Do you remember which Add-Ons have to be updated in this way? Even wayfinder, formit and others of these standard-add-ons? I guess this point could prevent us to not move the core-folder above the web root ...

Again, be very clear with how you describe this: you cannot move "manager-folder above the root". You can move it to a different web root, but it must be accessible via HTTP. Likewise, the connectors folder must be accessible via HTTP, so it cannot be moved outside of web root. Be clear with your verbiage.

Re recommendations, as I said, it's a balance: if security is THE TOP priority, then you'll harden the #@%!#% out of your site. If it's only a reasonable concern, then plan accordingly. See the article I wrote for the docs: http://rtfm.modx.com/display/revolution20/Hardening+MODX+Revolution

Quote from: Everettg_99 at Feb 03, 2013, 06:26 PM

Again, be very clear with how you describe this: you cannot move "manager-folder above the root". You can move it to a different web root, but it must be accessible via HTTP.

Correct, that´s what I were trying to say. Thanks for clarification. And do you think it make sense to move the manager-folder away to another domain or to a subdomain of our website we were currently thinking about? I am not sure if this is really an additional improvement regarding security and therefore a good idea ...

If security is your TOP priority, then yeah, you'd make access to the manager very restricted. It'd be very hard to find it if it's blocked by firewall rules and on a separate domain.

Just renaming the Manager, which is fairly easy, would make it *much* more secure.