From 1a65c4774bb13795e03473daf0fc3d5feacd1b46 Mon Sep 17 00:00:00 2001 From: dpeca Date: Thu, 29 Aug 2019 00:05:23 +0200 Subject: [PATCH] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 93e11917..e62e6aa8 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,7 @@ Features + You can totally "lock" VestaCP so it can be accessed only via https://serverhost:8083/?MY-SECRET-URL + During installation you will be asked to choose secret URL for your hosting panel - + Literally no PHP scripts will be alive (won't be able to get executed), unless you access the URL with that parameter. Thus, when it happens that, let's say, some zero-day exploit pops up - hacker will not be able to access it without knowing your secret URL. PHP scripts from VestaCP will be simply dead - no one will be able to interact with your panel unless he has the secret URL. + + Literally no PHP scripts will be alive on hosting panel (won't be able to get executed), unless you access the hosting panel with secret URL parameter. Thus, when it happens that, let's say, some zero-day exploit pops up - hacker will not be able to access it without knowing your secret URL. PHP scripts from VestaCP will be simply dead - no one will be able to interact with your panel unless he has the secret URL. + You can see for yourself how mechanism was built by looking at: + https://github.com/myvesta/vesta/blob/master/src/deb/for-download/php/php.ini#L496 + https://github.com/myvesta/vesta/blob/master/web/inc/secure_login.php