Website security...

[cusimar9]

I have some websites which don't need to be db driven but there are some admin pages which I would like to add a little security to.

I've a couple of ideas but they are definitely 'lightweight' security and if someone really wanted to bypass it they could. Whether or not they'd want to is another matter as the admin pages don't exactly contain sensitive information.

Are there any tried and tested methods?

In fact, this was my idea, tell me what you think:

The page will only load if a valid 'authentication code' is passed in the address bar. The validation will simply consist of adding up the ascii values of the characters in the string and comparing this (as well as the string length) with a set number.

So if you read the source and see an ascii total of 2312 and a length of 43 you'll have to write a program to come up with a valid sentence, which would take a very long time if the length was long enough.

Reasonably secure that, I thought :D

[CompGeek01]

For small websites and personal websites, security through obscurity is a fine way to go.

Bear in mind that, with your current set up, 2 + 5 + 6 is the same as 5 + 2 + 6 or any other combination.

A .htaccess file is another way to go. They are easy to set up and make it easy for multiple users. I don't see any problems you'll have in doing what you're doing though. :t

[cusimar9]

Is there definitely no way someone can retrieve a list of files on a server then? If I call my file admin_ue23dijur93.htm its supposed to be safe?

What's a .htaccess file?

[ScaryBinary]

It's a file used by the Apache HTTP Server to determine permissions on files.

.htaccess Documentation (http://httpd.apache.org/docs-2.0/howto/htaccess.html)

From your other posts, it looks like you're using Microsoft IIS as your webserver. A few simple things you can do in IIS are to turn off directory browsing, make sure only scripts can be executed (versus actual executable files), and turn off "enable parent paths". You do all this stuff through the IIS snap-in thingy in the Computer Management dialog (usually Control Panel > Administrative Tools > Computer Management).

A Google Search for "Secure IIS" (http://www.google.com/search?q=secure+IIS) will turn up plenty of information.

[cusimar9]

Our hosts DO use windows servers but are not owned by us, so we have little control over their settings...