• twitter image
  • facebook image
  • youtube image
  • linkedin image
Language: CMS Made Simple Czech CMS Made Simple France CMS Made Simple Spain CMS Made Simple Hungary CMS Made Simple Russia CMS Made Simple, the Netherlands

Securing CMS Made Simple

We need your assistance to make the documentation accurate, user friendly and understandable. Therefore we welcome any tips or suggestions regarding documentation. Thank you in advance for your contribution.

However, we will not respond to technical support questions submitted using this form. If you are having difficulty with CMSMS and cannot find the solution on this website, please submit your question appropriately on our support forum at: http://forum.cmsmadesimple.org. Please remember to follow the forum rules when posting.


This is a captcha-picture. It is used to prevent mass-access by robots. (see: www.captcha.net) Please confirm that you are not a script by entering the letters from the image

Despite the fact that CMSMS has a good reputation in terms of safety, you can still do more to protect your website. Some examples:

Open anchor to this point in the page Securing the Admin panel

Open anchor to this point in the page Renaming the admin folder

You can open the admin panel of all default CMSMS websites at www.website.com/admin.
Changing the foldername of the admin would be good to prevent blunt force attacks.

The first step is renaming the admin folder to i.e. "myadmin658".
The second step is adding this line to your config.php file:

  1. $config['admin_dir'] ="myadmin658";

The third step would be to change the admin name in your robots.txt file (if you use one...) in the root of the website

You must open the admin panel of your CMSMS website now at www.website.com/myadmin658

Important: Before upgrading your CMS, change the admin foldername and config.php setting back to "admin".
After the successful upgrade you can change it to your own secure name.

Open anchor to this point in the page Root .htaccess file

In the default website root .htaccess file which is stored for optional use in the /doc folder (htaccess.txt) there are two lines that can be used by removing the hash (#). If your webhost permit these settings please do!

  1. # (this is important, so uncomment if your host permits)
  2. #Options -Indexes
  3. #ServerSignature Off

Open anchor to this point in the page Third party modules

Third party add-on modules to secure your website:

  • CGSmartImage
    Hide the websites folder hierarchy and add watermarks to the images
  • Frontendusers (and CustomContent)
    Protect your websites frontend pages

Open anchor to this point in the page Third party (user defined) tags

Open anchor to this point in the page Mail UDT

Add the following UDT to the event "LoginFailed" and you will receive an email with the used username and IP Address of the one who failed to login in your admin panel.

  1. $cmsmailer = cms_utils::get_module('CMSMailer');
  2. // Receiver
  3. $cmsmailer->AddAddress('admin@website.com','Name');
  4. // Sender
  5. $cmsmailer->SetFrom('noreply@website.com');
  6. $cmsmailer->SetFromName('CMS Website.com');
  7. // Subject
  8. $username = $_SESSION['login_user_username'];
  9. $ipaddress = cms_utils::get_real_ip();
  10. $cmsmailer->SetSubject('Failed login: ' . $username . ' ' . $ipaddress);
  11. // Content
  12. $content = 'There has been a failed login in your admin panel!';
  13. $cmsmailer->SetBody($content);
  14. $cmsmailer->IsHTML(true);
  15. // Send mail
  16. $cmsmailer->Send();

Open anchor to this point in the page Ban IP-address UDT

Add in the top of your template or page {ip_ban}.

  1. $banned = array ("xxx.xxx.xxx.xxx","yyy.yyy.yyy.yyy","zzz.zzz.zzz.zzz");
  2. $ipaddress = cms_utils::get_real_ip();
  3. if (in_array($ipaddress, $banned))
  4.    die ("You are banned from this website!");

Open anchor to this point in the page Using SSL (https)

To force a page to use Secure Software Layer, go to the 'options' tab when creating a new page. Check 'Use HTTPS for this page'. To make all new pages default to this setting, go to Site Admin >> Page Defaults and check 'Use HTTPS for this page'.