Welcome to the Treehouse Community

Want to collaborate on code errors? Have bugs you need feedback on? Looking for an extra set of eyes on your latest project? Get support with fellow developers, designers, and programmers of all backgrounds and skill levels here with the Treehouse Community! While you're at it, check out some resources Treehouse students have shared here.

Looking to learn something new?

Treehouse offers a seven day free trial for new students. Get access to thousands of hours of content and join thousands of Treehouse students and alumni in the community today.

Start your free trial

PHP

Andrew Rickards
Andrew Rickards
18,877 Points
Posted by Andrew Rickards
Andrew Rickards
18,877 Points

Security concerns for simple PHP site (no input, no database, no membership).

I have been using WordPress to built all my sites for the last few years and now want to try my hand at building a site from scratch. The site will be a very simple content based site with no input fields, no database, and no memberships. It will essentially be a static site using PHP to serve up the header, footer, menu, etc.

I'm concerned about security however and want to know what the main security concerns are for a site like this. Almost everything I have learnt about security involves user input, memberships, and databases - not of which my site will have - but I keep hearing that ANY site can be 'hacked'

Thanks.

1 Answer

miguelcastro2
miguelcastro2
Courses Plus Student 6,573 Points

PHP is not the only entry point for a potential hacker. You can have a web server that due to lack of upgrades may be vulnerable to an exploit. Also, certain versions of PHP may be vulnerable to exploits as well which just requires a hacker to send a maliciously crafted request. Otherwise, I wouldn't worry too much as long as you keep your server up to date with the latest patches, make sure SSH is only accessible via keys, and chroot the web server processes. Security is usually an issue of being proactive and being informed with the latest information and doing the necessary server maintenance.

Andrew Rickards
Andrew Rickards
18,877 Points
Andrew Rickards
Andrew Rickards
18,877 Points

Thanks for the reply. I don't really know about servers so I'll be relying on my host for that side of things. From what you've said though, I take it I'll be pretty safe as far as the code is concerned. Is .htaccess something I should be looking at too?