Guide to hardening phpList

[samtuke]

Here is another suggestion for hardening:

Brute force protection with fail2ban

I think it´s going to be difficult without creating a way to log loging attempts to a file. But if you want you can create a little hardening. Rename the default installation folder (lists) and change the location of the admin folder. Remember to edit the config.php $pageroot = '/lists'; $adminpages = '/lists/admin'; Add this lines to the admin .htaccess so only you can log in… order allow,deny allow from xxx.xx.xxxx deny from all

Having a section in the phpList manual is still a great idea. Anyone can create pull requests on the GitHub repository that contains the manual files.