Hi,
> What kind of arrangements do you take to secure your wamp installation?
I often say the same things, but Wampserver is designed to be a local development server.
Open a server to the outside world should be performed by specialists aware of security issues and blocking access.
This is why with Wampserver 3, Option Online / Offline is no longer accessible directly. This is to prevent neophytes open their server (and at the same time their PC) to the world, with a single click.
I'm not a specialist in Internet security, but some basic rules apply.
- We do not touch the prohibitions in httpd.conf
- The VirtualHost must imperatively be used.
- The VirtualHost localhost should always be "Require local".
- Only the VirtualHost can be accessed from outside can have a "Require all Granted"
- On an intranet must be limited permissions to network IP range.
- A password must be assigned to root MySQL.
- VirtualHost for authorized external access, site configuration files must be in a folder with a .htaccess file with Require all denied
- ihe scripts to perform tests must also be in a folder with a .htaccess file with "Local Require" and whether those test files should be used in a hosting it allows access to your IP by
<RequireAny>
Require local
Require my_ip
</RequireAny>
They are easy rules to implement.
On my router, the port forwarding rules are activated only when I have to perform tests from the outside.
- network administrator is a profession.
- CIO is a job.
- hosting claim skills.
This is not because Wampserver makes it all that anyone can do it without risk.
And finally, I recall that the best anti-virus, anti-malware, anti-hacking, anti-phishing, is the interface between the chair and the keyboard.
---------------------------------------------------------------
Documentation Apache -
Documentation PHP -
Documentation MySQL -
Wampserver install files & addons