CODEWITHSUNDEEP
c1-cms
niico
niico

Reputation: 12779

Change Composite C1 standard admin URL for security - best practice

As C1 has a standard admin path ~/Composite/top.aspx - this is an easy vector for an attacker to focus efforts.

Is there a best practice way to move this - either by changing the top.aspx file name and or the folder without breaking code, and without breeching the license agreement?

This would seem like a good idea for all installations.

Upvotes: 3

Views: 526

Answers (1)

magnattic
magnattic

Reputation: 13028

This would seem like a good idea for all installations.

Not really. What you propose is security through obscurity and not the best approach.

I'd rather make sure that the /Composite Backend Login is only reachable for specific IP adresses (i.e. the IP adress of the site admin and any editors) or set up an additional HTTP password authentication in the webserver for that area.

Upvotes: 2

Related Questions