Zen Cart Security Recommendations

theme — Wed, 29 Jul 2009 01:39:40 +0000

Recently, there are many zen cart shopping store were attacked by hackers, for example, main page has been changed to add a lot of garbage link(fix this please refer step 5), here list some of important security recommendations.

1. Rename your “/admin” folder and install the latest zen cart security patch

Renaming the “admin” folder makes it much harder for would-be hackers to get into your admin area.

(Before making the following changes, make sure to have a current backup of your files and your database.)

A- Open your admin/includes/configure.php, using a simple text editor like notepad.

Change all instances of /admin/ to your chosen new admin folder-name.

Change this section:

define(’DIR_WS_ADMIN’, ‘/admin/’);

define(’DIR_WS_CATALOG’, ‘/’);

define(’DIR_WS_HTTPS_ADMIN’, ‘/admin/’);

define(’DIR_WS_HTTPS_CATALOG’, ‘/’);

And this section:

define(’DIR_FS_ADMIN’, ‘/home/mystore.com/www/public/admin/’);

define(’DIR_FS_CATALOG’, ‘/home/mystore.com/www/public/’);

B- Find your Zen Cart /admin/ directory, using your FTP software or your webhost File Manager.

Rename the directory to match the settings you just made in your admin/includes/configure.php.

C - To login to your admin system you will now have to visit a new URL that matches the new name used in steps A and B above. For example instead of visiting http://www.example.com/admin/ visit http://www.example.com/NeW_NamE4u/.

D - You should also protect your admin area by using a .htaccess file similar to the one shown below, and placing it into /admin/includes. (This should already exist in Zen Cart versions 1.2.7 and greater.)

E- Install the security patch on your Zen Cart? 1.3.x store

2. Set configure.php files read-only

It’s important that you CHMOD (set permissions) on the two configure.php files as read-only.

Typically this means setting it to “644″, or in some cases “444″.

The configure.php files are located in:

//includes/configure.php

//admin/includes/configure.php

Quite often setting permissions on a file to read only via FTP will not work. Even if the permission looks like it was set to read only, it really may not have been. You must verify the correct setting by entering the store and seeing if there is a warning message on the top of the screen. “Warning: I am able to write to the configuration file:…” In this case you will need to use the “File Manager” supplied with your webhosting account.

If you’re using a Windows server, simply set the file as Read-Only for Everyone and especially the IUSR_xxxxx (Internet Guest Account) user if running IIS, or the System account or apache user if running Apache.

3. Delete any unused Admin accounts

Admin->Tools->Admin Settings

In your admin area, open the Tools menu, and choose Admin Settings

- Check for any unused admin accounts, and delete them. Especially the “Demo” account, if it exists.

4. Admin Password Security

It is wise to use complicated passwords so that a would-be hacker cannot easily guess them.

You can change your admin password in Admin->Tools->Admin Settings, and click on the “Reset Password” button, or click on the icon that looks like a recycle symbol.

We recommend that you use passwords that are at least 8 characters long.

Making them alpha-numeric (including letters, numbers, upper-and-lower-case, etc) helps too.

If you are going to use normal words it is a good idea to join together two normal words that don’t normally go together.

5. Protect your “define pages” content in “html_includes”

After you have finished editing your define pages (Admin->Tools->Define Pages Editor), you should protect them:

A. Download a copy of them to your PC using your FTP software. They are located in the /includes/languages/english/html_includes area.

B. Make them CHMOD 644 or 444 (or

How to change zen cart tagline text

theme — Mon, 27 Jul 2009 07:42:35 +0000

In Zen Cart, to change the

How to delete zen cart congratulations messages

theme — Mon, 27 Jul 2009 07:36:00 +0000

This article teach you how to remove zen cart congratulation messages.

If you want to replace “Congratulations! You have successfully installed your Zen Cart?; E-Commerce Solution” with your own text open the includes/languages/ENGLISH/index.php file and find the following code:

// This section deals with the “home” page at the top level with no options/products selected

/*Replace this text with the headline you would like for your shop. For example: ‘Welcome to My SHOP!’*/

define(’HEADING_TITLE’, ‘Congratulations! You have successfully installed your Zen Cart™ E-Commerce Solution.’);

} elseif ($category_depth == ‘nested’) {

// This section deals with displaying a subcategory

/*Replace this line with the headline you would like for your shop. For example: ‘Welcome to My SHOP!’*/

define(’HEADING_TITLE’, ‘Congratulations! You have successfully installed your Zen Cart™ E-Commerce Solution.’);

}

Replace the text starting

How to remove zen cart greeting message

theme — Mon, 27 Jul 2009 07:08:36 +0000

This article teach you how to delete zen cart greeting messages.

If you want to remove

Zen Cart Blank Page

theme — Mon, 27 Jul 2009 06:24:19 +0000

Getting a zen cart blank page or blank part of a page

If you’re getting a blank page when trying to browse to a certain page on your store, or after clicking to have it do something, you’ve almost certainly got a PHP error in one or more of your files.
Blank pages can be caused by a number of things, and often occur just after installing, upgrading, or customizing your store. Any time you touch a PHP file, you must be sure to not introduce syntax problems(even worse you have a blank space after a

E-Commerce Templates,Addons,Plugins » Troubleshoot