I just ran across info about hardening on the DOCs and it sounds like a prudent thing to do. However, I am trying to envision how a future update might go. I've done 3 version updates in the past month or so and possibly getting ready to do one more. Once hardening is done it seems as though the standard process for doing an update might not be possible — or is it? Am I just renaming the various folders and merging into their new "secret" locations? Is the setup going to follow the new, altered core paths I've established, or default to the standard install paths.
As well—with all this hardening as a method of protecting and disguising my site as being a MODx site.... it makes me wonder. Should I not put a powered by MODx icon on my site's page? Maybe I should not comment my code with some of the standard, familiar MODx lingo — <!-- outerTpl --> for starters.
I would be curious to know how much if any of the hardening steps some on the forum are using, and does it impede or cause major hiccups when trying to perform an update.
When you say 'hardening' I assume you mean using the 'advanced' MODX install with custom core and connector paths? If so then rest assured, updating is just as simple as the 'traditional' version and yes setup will follow your new custom core paths.
Hi David:
Thanks for your feedback. I have done the Traditional install with each of my sites.
So.. would I have to redo all of my installs using advance mode, or can I perhaps, make the suggested hardening updates to an existing site, and then used the "Advanced" whenever the next update to MODx needs to be made?
Hey David:
Thanks for the link, I will review. The questions are now beginning to compound exponentially in my brain.
I guess if I were to follow this process, I would need to figure out how to get from a current site running 2.2.12 Traditional, to an advanced install running 2.2.12.
I did navigate to my core folder on one of the sites I have and received a 403-Forbidden. Maybe that would not be the case though if someone familiar with MODx know the name of the actual php file they are looking for.
Fortunately, the sites I work on are small and contain no sensitive private or financial data. A hack that disrupts the site would just be a time consuming frustrating ordeal to resolve. So in that sense, my level of panic and urgency has lowered a bit.
Marc
I see. Was just reading through that. Thanks again for sending that link. I may give it a try on my own site which is essentially empty, but does contain MODx. At least if I mess it up, I'll learn something, and no big deal if the site goes down.
