Securing the accounts that control your forum

The four accounts that control your forum

Whoever holds any one of these can take over or take down your forum, so they deserve more care than an ordinary login:

1. Your domain registrar account. Controls where your address points.
2. Your Traxio client area and DirectAdmin logins. Control the hosting, files, databases and email.
3. The email account those logins use. Password resets for everything else go there.
4. Your forum admin account, and every other administrator and moderator.

Passwords: unique, long, stored

• Unique for every account above. Reused passwords leak from other sites and get tried on yours.
• Long rather than clever. A password manager can generate and remember them for you.
• Don’t call the admin account “admin”. It’s the first username bots try.
• Separate everyday and admin use if you post a lot: an ordinary account for posting, the admin account only for administration.

Two-factor authentication

Two-factor authentication (2FA) asks for a code from an app on your phone as well as your password, so a stolen password alone isn’t enough.

• SMF 2.1 has it built in. Make sure it’s enabled in the security settings (admins can require it), then set it up from your profile. SMF guide.
• MyBB 1.8 supports 2FA for the Admin CP, set up from the Admin CP preferences. See the MyBB 2FA documentation.
• phpBB 3.3 doesn’t include it in the core; it’s available through extensions in the phpBB customisation database. phpBB does already require you to re-enter your password before opening the ACP.
• Your registrar and email provider almost certainly offer 2FA. Turn it on there first; they’re the keys to everything else.

Moderators and other admins

• Give the least access that works. Most helpers need moderator rights on some boards, not administrator rights.
• Ask staff to use 2FA where your software supports it.
• Remove access promptly when someone steps down, and review the staff list every few months.
• Watch the logs. All three packages keep admin and moderator logs. A glance now and then shows anything unexpected.

Site-level habits

• Always use https://. Your free SSL certificate protects logins and private messages. Forcing HTTPS.
• Keep the software and add-ons updated. Updating forum software.
• Remove what you don’t use: old test installs, disabled add-ons, unused FTP accounts.
• Keep a clean backup so a compromise is an inconvenience, not a disaster. Backing up your forum.

If something has gone wrong

1. From a device you trust, change the passwords of the affected accounts, starting with email and the hosting account.
2. In the forum, check the list of administrators and moderators for anyone you don’t recognise, and review recent admin log entries.
3. Look for changes you didn’t make: new add-ons, edited templates, unfamiliar files.
4. If in doubt, restore a backup from before the problem, then update the software.
5. For anything involving your hosting account, go to the help desk.