Featured Sites: A-Z Index

H

Composr CMS: Content management meets social mediaComposr CMS: Content management…

Composr CMS: Content management meets social media

Earth & Sky

Legends of Nor'Ova

Legends of Nor'Ova

PDStig, LLC

supertilted.com

supertilted.com

Saving Wallden

Newest 10 Entries

Question	What is the purpose of "confirmed" and "non-confirmed" sessions?
Answer	Composr distinguishes between confirmed and non-confirmed sessions for added security: Confirmed: When you actively log in with your credentials. Non-confirmed: When you return to the site and are automatically logged in via cookies. You can configure zones to require confirmed sessions, preventing access from cookie-based logins alone. The Admin Zone uses this by default.

Question	How can I enhance the security of my Composr installation on shared hosting?
Answer	Shared hosting environments can be inherently less secure. Here are some tips: Choose a Secure Host: Opt for hosts that offer suEXEC and open_basedir for better account isolation. Test Security: Verify the host's security measures with the provided filesystem_browser.php script. Restrict _config.php: Remove world-writable permissions from _config.php after installation.

Question	How does Composr protect against Cross-Site Scripting (XSS) attacks?
Answer	Composr utilizes multiple layers of defense against XSS attacks: HTML Filtering: Configurable levels of filtering prevent malicious script injection. Content Security Policy (CSP): Restricts the sources from which scripts and other resources can be loaded. Input Sanitization: Data is sanitized before being processed to prevent malicious code execution. Output Encoding: Data displayed to users is properly encoded to prevent interpretation as active code.

Question	What are the different types of security alerts in Composr?
Answer	Composr has a variety of hack-attack codenames that trigger security alerts and logging. Some common examples include: DODGY_GET_HACK: Suspicious URLs with potentially harmful characters. EVIL_POSTED_FORM_HACK: Possible CSRF attempts via malicious form submissions. SCRIPT_UPLOAD_HACK: Attempts to upload PHP scripts, potentially malicious. DOWNLOAD_PRIVATE_URL_HACK/TRY_TO_DOWNLOAD_SCRIPT: Attempts to download sensitive files. BRUTEFORCE_LOGIN_HACK: Repeated failed login attempts. SQL_INJECTION_HACK: Attempts to exploit SQL queries for data extraction. You can customize alert handling for each type in data_custom/xml_config/advanced_banning.xml (Admin Zone > Security > Configure advanced banning).

Question	What are some tips for secure website maintenance?
Answer	Avoid FTP: Use secure alternatives like SFTP or SSH for file transfer. Secure Email: Enable SSL for IMAP and POP3 email protocols. Strong Passwords: Use unique and complex passwords for different services. Secure Computers: Keep your own devices patched and secure. Maintenance Password: Remove the maintenance password from _config.php when not in use.

Question	What are the main security features of Composr?
Answer	Composr has a robust set of security features to protect your website, including: Passwords: Visual representation of password quality and enforcement of complexity rules. Password expiry and prevention of re-use. Secure password hashing, even if the database is compromised. Temporary passwords for staff setup. Login Restrictions: Two-factor authentication via IP address approval. IP address banning, including wildcard banning. Session locking to IP addresses. Configurable session expiry times. Ability to prevent privileged actions from auto-logged in sessions. Optional member approval process. Auditing Systems: Comprehensive audit logging of administrative actions. Logging of user actions and IP address history. Tools to analyze audit logs. Failed login logging. Hack attack detection, logging, and banning. Email notifications for changes to user credentials. Framework Security: Protection against CSRF attacks. Click-jacking prevention via CSP implementation. Secure coding standards and scanning techniques. Configurable HTML filtering to prevent XSS attacks. Secure code modularization standards. Other features: Granular privileges and access permissions. Content submission validation process. Rootkit detection system. Spam prevention systems. Web application firewall rules. Moderation systems.

Question	Why are my searches slow, and how can I improve search speed?
Answer	Slow searches can occur when dealing with large amounts of content. Here are some workarounds and solutions: MySQL timeout setting: For MySQL 5.7+, set a query timeout to prevent searches from locking up your database. Composr automatically sets this, but you can configure it manually if needed. Use InnoDB tables: Switching to InnoDB tables in MySQL can prevent slow queries from affecting other users on your website. Note that InnoDB is not officially supported by Composr yet. Enable the fast custom index: As mentioned earlier, the fast custom index is optimized for handling large datasets and filtered searches, potentially leading to significant speed improvements.

Question	How does the search engine handle different languages?
Answer	Composr's fast custom index supports multiple languages. Content is indexed based on its translated version, ensuring that you get relevant results even when searching in a different language.

Question	What are quoted phrases and how do they work?
Answer	Quoted phrases allow you to search for an exact sequence of words. For example, searching for "red apple" will only return results containing that exact phrase. Keep in mind that enabling quoted phrases can increase disk space usage.

Question	How do stop words affect search results?
Answer	Stop words are common words (like "the", "a", "is") that are ignored by the search engine because they add noise and don't contribute to the meaning of the search query. You can customize the list of stop words for the fast custom index. See the search tutorial for more information.

Top 10 Entries

Question	How do I restore my Composr website from a backup?
Answer	Composr backups come as .tar or .tar.gz files. Extract the archive using an extraction program like 7-zip or your web hosting control panel. To restore a full backup: Upload the extracted files to your webserver, overwriting the existing files. Run the included restore.php script in your browser. This script will restore the database from the restore_data.php file. To restore incremental backups: Restore the initial full backup. Sequentially extract and overwrite files from each incremental backup over the restored full backup. The last extracted restore_data.php will contain the latest database state. Run restore.php to restore the final database version.

Question	What alternative backup strategies are available?
Answer	Many web hosting control panels include built-in backup features that operate at the system level, often offering higher reliability than web-based scripts. Ensure you back up both files and the database. For database backups, you can use tools like phpMyAdmin, which allows you to export your database as a .sql file.

Question	How do I create a backup of my Composr website?
Answer	Composr offers a built-in backup addon accessible from Admin Zone > Tools > Backups. You can choose between full, incremental, and database-only backups. Full backup: Backs up all files and folders within the Composr installation directory, including the database. Incremental backup: Backs up only new or changed files since the last backup, resulting in smaller backup files. Database backup only: Backs up only the database. The addon allows scheduled backups or manual backup generation. It is recommended to download backups to a location outside your web server for better security. Note: The Composr backup addon is limited by server-side PHP capabilities and might not always be reliable. Consider using alternative backup strategies offered by your web hosting control panel for increased reliability.

Question	Why are backups necessary for my Composr website?
Answer	Disasters like hard disk failures, data corruption, and unexpected errors can happen at any time. A good backup strategy helps you recover your website and its data in case of such events. Backups can also help you roll back to a previous state if needed, such as after a failed upgrade or accidental changes.

Question	How can I control the privacy of member profile fields?
Answer	You can control the privacy of member profile fields through the "Member privacy controls" configuration option. If you enable the "Extended privacy option control", you can fine-tune visibility settings for each field. Otherwise, you can set simple access levels (e.g., not at all, to members, to friends, to everyone) for each field.

Question	What is the difference between a Composr member and an author?
Answer	A member is someone who has created an account on your Composr website and can log in. They have a unique member ID and username, and can interact with the site's features. An author is someone who creates content for the site. They may or may not be a member. For example, you might have an author who submits articles via email but never actually visits or joins the website.

Question	What advanced techniques are available for dealing with persistent spammers who repeatedly create new accounts?
Answer	Composr's advanced banning features target sophisticated human spammers. Automatic bans can be configured to block users based on specific strings in their posts, while reasoned bans display customized messages to banned users, potentially deterring them. These measures, coupled with the ability to investigate users via IP address analysis, offer robust tools for managing persistent threats. You can configure advanced banning under Admin Zone > Security > Configure advanced banning.

Question	How does Composr handle user banning and what options are available?
Answer	Composr offers various banning mechanisms. You can ban members by editing their accounts (ban member tick box), preventing logins while still allowing guest access. IP address banning blocks access from specific IP addresses or ranges (Admin Zone > Security > Members > Investigate user to see their IP addresses and flag certain ones for banning). You can also restrict member submissions, or you can effectively "suspend" users by assigning them to a usergroup with minimal privileges (e.g. probation).

Question	What is the "Warn Member" form and how can I use it to handle rule violations?
Answer	The "Warn Member" form provides a centralized interface for addressing user misconduct. You can issue formal or off-the-book warnings, apply punitive actions like IP bans, usergroup changes, or probation, and even delete content or charge points. This form allows you to document reasons for actions, improving transparency and consistency in moderation. This tool can be accessed on a member's profile as staff, under Audit > Warn member. You can also review their warnings history on their "Standing" tab.

Question	How does Composr track user activity?
Answer	Composr logs IP addresses for various actions like guest posting, page views, and content submissions. This data helps identify potential spammers and track user behavior. The "Investigate user" module provides tools to analyze IP addresses and gather additional information about suspicious activity.

Statistics

Forum statistics:	45 topics, 14 posts, 2 members Our newest member is test