• Identify the Cause: Analyze access logs for suspicious activity and pinpoint the vulnerability.
• Clean and Restore: Restore your website from a clean backup and thoroughly remove any malicious code.
• Address Vulnerabilities: Patch security holes, update software, and strengthen security configurations.
• Seek Expert Help: If needed, consult security professionals for assistance with cleanup and prevention.

• SSL: Enable HTTPS for encrypted communication and improved user trust.
• Secure Zones: Configure sensitive zones to require confirmed sessions.
• Restrict Logins: Enforce IP address confirmation for enhanced account security.
• Maintenance Scripts: Restrict access to maintenance scripts like upgrader.php via IP restrictions.
• Server Hardening: Disable unnecessary services, change default ports, enable automatic updates, and more.
• Robots.txt: Use the robots.txt file to prevent search engine indexing of sensitive areas.

• XSS Attacks: By restricting inline scripts and limiting script sources.
• Data Injection Attacks: By controlling the allowed origins for data requests.
• Clickjacking: By specifying allowed framing sources.

• Confirmed: When you actively log in with your credentials.
• Non-confirmed: When you return to the site and are automatically logged in via cookies.

• Choose a Secure Host: Opt for hosts that offer suEXEC and open_basedir for better account isolation.
• Test Security: Verify the host's security measures with the provided filesystem_browser.php script.
• Restrict _config.php: Remove world-writable permissions from _config.php after installation.

• HTML Filtering: Configurable levels of filtering prevent malicious script injection.
• Content Security Policy (CSP): Restricts the sources from which scripts and other resources can be loaded.
• Input Sanitization: Data is sanitized before being processed to prevent malicious code execution.
• Output Encoding: Data displayed to users is properly encoded to prevent interpretation as active code.

• DODGY_GET_HACK: Suspicious URLs with potentially harmful characters.
• EVIL_POSTED_FORM_HACK: Possible CSRF attempts via malicious form submissions.
• SCRIPT_UPLOAD_HACK: Attempts to upload PHP scripts, potentially malicious.
• DOWNLOAD_PRIVATE_URL_HACK/TRY_TO_DOWNLOAD_SCRIPT: Attempts to download sensitive files.
• BRUTEFORCE_LOGIN_HACK: Repeated failed login attempts.
• SQL_INJECTION_HACK: Attempts to exploit SQL queries for data extraction.

• Avoid FTP: Use secure alternatives like SFTP or SSH for file transfer.
• Secure Email: Enable SSL for IMAP and POP3 email protocols.
• Strong Passwords: Use unique and complex passwords for different services.
• Secure Computers: Keep your own devices patched and secure.
• Maintenance Password: Remove the maintenance password from _config.php when not in use.

• Visual representation of password quality and enforcement of complexity rules.
• Password expiry and prevention of re-use.
• Secure password hashing, even if the database is compromised.
• Temporary passwords for staff setup.

• Two-factor authentication via IP address approval.
• IP address banning, including wildcard banning.
• Session locking to IP addresses.
• Configurable session expiry times.
• Ability to prevent privileged actions from auto-logged in sessions.
• Optional member approval process.

• Comprehensive audit logging of administrative actions.
• Logging of user actions and IP address history.
• Tools to analyze audit logs.
• Failed login logging.
• Hack attack detection, logging, and banning.
• Email notifications for changes to user credentials.

• Protection against CSRF attacks.
• Click-jacking prevention via CSP implementation.
• Secure coding standards and scanning techniques.
• Configurable HTML filtering to prevent XSS attacks.
• Secure code modularization standards.

• Granular privileges and access permissions.
• Content submission validation process.
• Rootkit detection system.
• Spam prevention systems.
• Web application firewall rules.
• Moderation systems.

• MySQL timeout setting: For MySQL 5.7+, set a query timeout to prevent searches from locking up your database. Composr automatically sets this, but you can configure it manually if needed.
• Use InnoDB tables: Switching to InnoDB tables in MySQL can prevent slow queries from affecting other users on your website. Note that InnoDB is not officially supported by Composr yet.
• Enable the fast custom index: As mentioned earlier, the fast custom index is optimized for handling large datasets and filtered searches, potentially leading to significant speed improvements.

Versatile: You can strip down to a core system, or build up with 3rd-party addons.

Full API documentation

High coding standards: No PHP notices. Type-strict codebase. MVC framework.

Free online developer's guide book (in the tutorials)

Custom field filters: For example, restrict news posts to a minimum length.

Stack traces for easy debugging

Synchronise data between staging and live sites using Resource-fs

Breadcrumb overrides

Advanced banning: Set your own banning rules for different hack attack codes. Even create your own ban pages (e.g. to mimic law enforcement bans for spammers).

Code overrides: Implement modifications to the Composr code without directly editing the original code by creating _custom files. This makes upgrading much easier. Also supports contentious_overrides hooks and the override_api for more advanced overriding.

Many different hook types allowing for modifying or extending Composr without modifying or overriding the code.

Convert from other software: See our importing tutorial for a list of importers.

Use an existing member system: See our download page for a list of forum drivers.

Convert an HTML site into Composr pages

LDAP support for corporate networks (Conversr only)

HTTP authentication: Tie into an existing HTTP authentication-based login system (Conversr only)

Proxying system: Programmers can integrate any existing scripts using our sophisticated proxying system (which includes full cookie support).

Minimodules and miniblocks: Programmers can port existing PHP code into Composr itself without having to strictly conform it to Composr's framework