Security and backups

Keep the site safe

  1. Point your domain to the public folder (cPanel → Domains → Manage → document root /home/you/pagemint/public). The included .htaccess protects the other setup, but this one exposes nothing else.
  2. Use HTTPS (cPanel → SSL/TLS Status → Run AutoSSL). Behind Cloudflare, choose the Full (strict) SSL mode: with Flexible, the site cannot tell that visitors use HTTPS.
  3. Keep debug mode off. The package ships with APP_DEBUG=false; Site Doctor warns if it is ever turned on.
  4. Strong passwords and two-factor authentication for every staff account (Profile → Two-factor authentication), and give each person the smallest role that fits: Editor for content, Support for members and messages.
  5. Custom code and ad code run on every page. Only administrators can change them; paste code only from services you trust.
  6. File permissions: folders 755, files 644. Never 777.
  7. Stay up to date: install new versions from their ZIP (see Updating), and keep PHP on a supported version.
  8. If /.env could ever be downloaded (Site Doctor checks it), fix the document root first, then change the database password and the gateway and e-mail passwords stored in the admin.

What Pagemint already does for you: forms are protected against cross-site requests, sign-in, contact and every endpoint that does work are rate-limited, uploads to the server are checked by their content and stored outside the web root, and gateway and API keys are stored encrypted.

Back up

Back up these four things — your host's daily backups (cPanel → Backup, or JetBackup) usually cover them:

What Where Why
The database MySQL/MariaDB (cPanel → phpMyAdmin → Export), or database/database.sqlite members, plans, payments, settings, content
The .env file the site's main folder holds the database login and the APP_KEY, which unlocks the encrypted gateway keys — keep a copy somewhere safe
storage/app the site's main folder server conversions in progress (and, with one-click updates, the license and update backups)
public/media inside public your logos, icon and blog pictures

Back up before every update you install (see Updating).

Restore

  1. Upload the files (or the whole folder) back, including .env with the same APP_KEY.
  2. Import the database (phpMyAdmin → Import), or put database.sqlite back.
  3. Open System → Site Doctor: it checks the rest and tells you what to fix.