Composr Tutorial: Basic configuration and getting started

Once Composr is installed, there is some basic configuration to do before your website is ready to open.

During basic configuration, you will be familiarising yourself with Composr for the first time. Please be patient: there is a lot to Composr, but once you have a mental image of how things work, you will find it a very powerful and malleable system.

Immediately after installing

The Setup Wizard

Security level

On step 3 of the Setup Wizard, one of the options available is Security level. Depending on the selection, a number of security configuration options will be set. You can always change these under Admin Zone > Setup > Configuration at any time.

Generally, we recommend the following security level depending on your use case:

• Minimum should only ever be used for very basic websites which will not utilise social features or public registrations (e.g. informational only sites).
• Low should only be used for websites using very basic social features and will not be handling much personal information. And any personal information handled will not involve children nor will be personally identifiable.
• Medium is recommended for most websites who do not utilise eCommerce functionality or handle highly-sensitive personal information.
• High is recommended for websites using eCommerce or will handle very sensitive personal information (e.g. sensitive custom profile fields or sites geared towards children).
• Ultra high is recommended for websites handling extremely sensitive data or functions (e.g. banks, government departments, cyber-security sites).

Content Security Policy:

• Minimum: Off
• Low: Off
• Medium: On
• High: On
• Ultra high: On

Session expiry time:

• Minimum: 1 day
• Low: 3 hours
• Medium: 1 hour
• High: 30 minutes
• Ultra high: 15 minutes

 
Password reset process:

• Minimum: Reset link e-mailed
• Low: Temporary password e-mailed
• Medium: Temporary password e-mailed
• High: Vague reset e-mail sent
• Ultra high: Vague reset e-mail sent

 
Password expiry days:

• Minimum: Never
• Low: Never
• Medium: Never
• High: 90 days
• Ultra high: 30 days

 
Minimum password length:

• Minimum: No minimum
• Low: 4 characters
• Medium: 8 characters
• High: 12 characters
• Ultra high: 16 characters

 
Minimum password strength*:

• Minimum: None
• Low: Low (2/10)
• Medium: Medium (5/10)
• High: High (8/10)
• Ultra high: Ultra high (10/10)

*Password strength is determined by length, variation in letters, numbers, symbols, upper case and lower case, not using dictionary words, not using repeating characters, and not using text that is also present in usernames and e-mail addresses.

Login error secrecy (whether we just give a general login error message instead of disclosing the specific error):

• Minimum: Off
• Low: Off
• Medium: Off
• High: On
• Ultra high: On

 
IP strict for sessions:

• Minimum: Off
• Low: Off
• Medium: On
• High: On
• Ultra high: On

 
Cryptographic ratchet* (how much computational power is required to hash / verify passwords):

• Minimum: 6, or whichever yields 0.025 seconds computing time (whichever is highest)
• Low: 8, or whichever yields 0.05 seconds computing time (whichever is highest)
• Medium: 10, or whichever yields 0.1 seconds computing time (whichever is highest)
• High: 12, or whichever yields 0.25 seconds computing time (whichever is highest)
• Ultra high: 14, or whichever yields 1 second computing time (whichever is highest)

*Note that the ratchet for the maintenance password is always what yields 0.25 seconds computational time; it ignores this setting.

One guess per CAPTCHA:

• Minimum: No
• Low: No
• Medium: Yes
• High: Yes
• Ultra high: Yes

 
CAPTCHA noise:

• Minimum: Off
• Low: Off
• Medium: On
• High: On
• Ultra high: On

 
Brute force threshold before a hack attack is triggered:

• Minimum: 30 login failures
• Low: 15 login failures
• Medium: 10 login failures
• High: 5 login failures
• Ultra high: 3 login failures

 
Audio CAPTCHA*:

• Minimum: On
• Low: On
• Medium: On
• High: Off
• Ultra high: Off

*Audio CAPTCHA is easier to solve by bots but may be necessary to have enabled if you serve members with visual impairments.

URL Monikers:

• Minimum: On
• Low: On
• Medium: On
• High: On
• Ultra high: Off

 
.htaccess restrictions on maintenance scripts*:

• Minimum: No
• Low: No
• Medium: No
• High: Yes
• Ultra high: Yes

*It is best to have this enabled regardless of security level, or at least to remove the maintenance password from _config.php, when you are not using maintenance scripts.

Enquire on new IP addresses (require e-mail verification when a member tries to log in from a new IP address):

• Minimum: No
• Low: No
• Medium: Administrators only
• High: Administrators and moderators
• Ultra high: Administrators and moderators

Notifications

Chances are that you'll want e-mailing whenever things happen on your site. You can do this through your personal notification settings. Go to your profile, choose the Edit tab, and choose the Notifications sub-tab.

In particular you'll probably want to know about content needing validation, various kinds of messaging activity (e.g. support ticket posting), and eCommerce activity.

This is described in more detail in the Notifications tutorial.

Editing configuration

Editing default Comcode pages

There are a number of default pages on your site. Standalone editable pages within Composr are called "Comcode pages".

For details on how Comcode pages work and what the default ones are, see the Adding standalone pages of content (via Comcode) tutorial.

Default banners

If you are not running a community site, you will almost certainly want to delete the default banners. Three banners are added into the system by default, to give websites a 'leg up' and a working view of the banner rotation: but they may not be appropriate. If you ran the Setup Wizard then you have already been given a choice to remove these banners automatically.

Editing logo theme images

Editing menus

The system scheduler

In order for aspects of Composr that support scheduling to work it is necessary to set up a system level scheduling task to run the data/cron_bridge.php file at least every 10 minutes. By doing this, you tie in Composr's system scheduler with the server's scheduler.

Examples of scheduling scripts:

• Sending out calendar event notifications
• Sending out regular notification digest e-mails
• Sending out birthday notifications
• Running automated backups
• Sending automated welcome e-mails to new members
• Sending catalogue view reports and handling classified ad expirations
• Sending out reminders for registration confirmation mails that were not ever actioned by the joining member
• Sending out automatic newsletters
• Sending newsletters (dripping out e-mails over a period of time, to stop resource spiking)
• Processing tasks that are in the queue (if the task queue is enabled)
• Running purges, such as logs, personal data (privacy), and cache
• Running the Health Check
• Processing statistics
• Updating the sitemap

The data/cron_bridge.php file can either be run by passing the PHP file through the PHP interpreter (common), or by calling the URL (see "Help – my webhost does not support Cron!"). More details are in the following sections. Don't call up the URL by hand then never finish configuring it, because if you do then Composr will start assuming the system scheduler is working from then on which can make testing it a bit harder (once it is called once it is marked 'working' by the system – applicable features will become available, and the todo item will be removed from the checklist on the front page of the Admin Zone).

Specific advice for Linux

Setting up Cron in the cPanel webhosting control panel (different control panels vary in their UI)

(Click to enlarge)

On Linux, the system level scheduler is 'Cron', and the process of adding a task is known as 'setting up a Cronjob'. Many webhosting control panels allow you to do this.

The following command might work for a Composr installation in the /home/examplesite/htdocs directory:
The above command is just an example. Your real path will obviously be different, but also the PHP program may have a different name. Composr may be able to detect the correct command to use for you. Try opening up http://yourbaseurl/data/cron_bridge.php?query_mode=1. The script should output the Cron command for you to use.

A good test is to try running the command you end up choosing manually in a command prompt, to check it is correct.

You should schedule Composr's cron_bridge.php script to be loaded at least every 10 minutes. The manual Cron configuration (if you do it this way) will look like this:

Sandboxed Cron

Some webhosts only allow you to execute Cron commands directly under your home directory. This means you cannot call up the PHP command directory like above.
A workaround is to make a data/cron_bridge.sh file (with execute permissions) containing:
and tell Cron to execute /home/examplesite/htdocs/data/cron_bridge.sh.

Specific advice for Windows

On Windows the following command might work for a Composr installation in the c:\sites\examplesite\www directory where PHP is in c:\php:
On Windows, either the webhosting control panel will provide a similar scheduler to Cron, or you can use the Windows 'Scheduled Tasks' feature as described below (assuming you have access).

The following is a step by step process for scheduling the running of cron_bridge.php every 5 minutes:

1. Open up 'Task scheduler'
2. Click 'Create Basic Task'
3. Give it a name and a description, then click 'Next'
4. Click 'Daily', then click 'Next'
5. Set the Time and to re-occur every 1 Day, then click 'Next'
6. Click 'Start a Program', then click 'Next'
7. Under program/script add the location of php.exe on your system something like "C:\php\php.exe" – also include the double Quote Marks ("") surrounding the file location
8. Under 'Add arguments' add the location to the cron_bridge.php file which for the example above would be "c:\sites\examplesite\www" (note how the PHP command is split across two parameters – step 7 having the php.exe path and step 8 having the PHP file path) – again surround in quote marks.
9. Click 'Next'
10. Tick (check) "Open the properties dialog for this task when I finish", then click 'Finish'
11. Change "Run only when user is logged on" to "Run whether user is logged on or not"
12. Tick (check) "Hidden"
13. Click 'Change User or Group'
14. Set to IIS_IUSRS (or whatever the user your website is configured to use, if you customised that)
15. Click 'OK'
16. Click the 'Triggers' tab
17. Double click the trigger from the list
18. Tick (check) 'repeat task every' box and change the "1 Hour" to "5 Minutes"
19. Click 'OK'
20. Click 'OK'

This should have now added a schedule within Windows scheduler to run the cron_bridge.php file every 5 minutes. This step by step was created using Windows 10, the process may change slightly in other versions of Windows.

Help – my webhost does not support Cron!

In the event your hosting platform does not allow you access to Cron, there are a number of options available to you. One easy option is to have scheduled tasks run in the background when visitors access your site. To do this, you need to go to the Admin Zone > Setup > Configuration > Performance options, and tick (check) "Web requests run scheduled tasks".

There are a couple caveats to using web requests:

• This will only work if your server supports PHP's register shutdown function. Most servers do.
• This is not a reliable way to ensure scheduled tasks run on time. It depends on someone making a page request to your website to trigger making the tasks run in the background.

Alternatively, you can use an external service to call the data/cron_bridge.php script by URL:

• EasyCron provide direct instructions for Composr, and free and paid plans: https://www.easycron.c…t-up-cron-job-for-composr
• Other free options are http://www.setcronjob.com/ (up to every 5 minutes but the schedule needs to be re-set every week) and http://www.onlinecronjobs.com/ (up to 5 jobs twice a day).

Simply sign up and  add the URL i.e. http://yourbaseurl/data/cron_bridge.php to the scheduler and set how often you want it to run.

Parameters

There are a number of parameters you can pass to cron_bridge.php, either as URL parameters, or command line parameters.

• limit_hooks – Pass the name of PHP files in sources[_custom]/hooks/systems/cron to limit to just those scheduler items; useful if you want to force certain items to run more regularly; if you pass just a single item name then normal wait times for processing that item will be ignored
• include_msn – When Composr has multi-site-network sub-sites, whether to run the system scheduler on all those sub-sites
• Debugging:
  • verbose – Whether to put out extra output (not recommended when tied into Cron, as it will likely e-mail you every time it runs – for that enable Cron logging instead from Admin Zone > Audit > Error Log)
  • query_mode – Whether to just spit out a Cron configuration command instead of running the scheduler
  • force – Whether to ignore scheduler item locking (for developers only); can be useful for testing and also clearing out stale locks
• Loop configuration:
  • loop – Whether to not exit and just keep looping, for maximum processing speed (shared webhosts may not like this)
  • loop_wait_seconds – The number of seconds to wait between each loop cycles, to avoid constantly querying the database (default 3 seconds)
  • loop_max_seconds – The number of seconds before finishing the loop, in case memory usage keeps creeping up (default 3595 seconds, which is 5 seconds less than an hour, intended to align with the next Cron call)

For example, to call the system scheduler but only to execute tasks, with verbose info…
Via URL:
http://yourbaseurl/data_custom/cron_bridge.php?limit_hooks=tasks&verbose=1
Via command line:
php cron_bridge.php –limit_hook=tasks –verbose

System scheduler interface

A system scheduler management interface is provided at Admin Zone > Audit > Low-level logging > system scheduler hooks. There, you can get an overview of every system schedule script:

• Number of operations / items queued
• Time between each run
• Last run
• Amount of time the script took to execute
• Errors encountered
• Whether it is enabled
• Whether it is locked (this either means it is running now or it suffered a critical error; in the latter case the hook will not run again for 24 hours unless manually run)
• Action buttons to enable/disable scripts or to execute scripts on-demand individually

Closed site, and opening

See also

• Installation
• Security
• Themeing your site
• Advice for choosing and managing staff
• Legal and social responsibilities
• Comcode and the attachment system
• Adding standalone pages of content (via Comcode)
• Customising what's on the menus
• Advanced configuration
• Notifications

Feedback

Have a suggestion? Report an issue on the tracker.