»How to protect your phpBB forum against hackers«

TIP A: Force an ADDITIONAL login to access the admin panel.

I think one of the best ideas is to password-protect your admin folder.

I have written a .php script that will do that for you.

•	Upload htaccess-protectthisfolder.zip (see below) into your admin folder and call it.

TIP B: Rename the folder "admin/" to something else. This is ONE OF THE BEST things you can do to keep crackers out .
After doing so you will most probably get an error message the next time you log in. Most probably you will have to

•	Open "includes/functions.php"

•	Update include($phpbb_root_path . 'admin/  with your new foldername.

•	Open "admin/pagestart.php"

•	Find if ($HTTP_GET_VARS['sid'] != $userdata['session_id'])

•	Before add: if ($HTTP_GET_VARS['sid'] != $userdata['session_id'])     {     redirect(append_sid(     basename(dirname($HTTP_SERVER_VARS['PHP_SELF']),"/").'/'.basename($HTTP_SERVER_VARS['PHP_SELF'])     ));     }

TIP C: If you want you can trick an attacker even more after you have renamed your admin/ folder (TIP B). Simply create a new "admin/" (= an empty folder) with only 1 ".htaccess" file inside. I have attached such a .htaccess file. It will annoyingly ask the intruder for a username and password. The intuder will think that the admin/ folder is password protected and will give up his attacks and will not search for the real admin folder.

TIP D: Delete the admin link at the bottom of each page: You can do this usually by editing "page_tail.php":

•	Open "includes/page_tail.php"

•	Replace 'ADMIN_LINK' => $admin_link  by 'ADMIN_LINK' => ''

Combined with the renaming of the "admin" folder (Tip B) it's an easy yet very effective measure.