What is the proper procedure for changing to Dedicated Server and upgrade zencart?

Hi,

I have a live site using 1.3.8a, it is always being hacked. Till now it is not completely solved.

Therefore I decided to have build a new one with 1.3.9h, at the same time upgrade to dedicated server + SSL

The problem now is, should I upgrade the server first? Or should I upgrade the site first, concerning there are still holes or hacked files in my hosting.

I have already set up a testing cart in another directory under the same domain. What should I do next (and the proper procedure) to best protect the new cart?

Thanks

If you are being hacked, your live install is not fully clean from the hacker intrusion, or your local is compromised or???

There is some hole/vulnerability that you have not found & closed and moving to another host or server is not going to make things any better

First get your live cart & all access points clean before moving and relocating the problem in a new home

kobra:

If you are being hacked, your live install is not fully clean from the hacker intrusion, or your local is compromised or???

There is some hole/vulnerability that you have not found & closed and moving to another host or server is not going to make things any better

First get your live cart & all access points clean before moving and relocating the problem in a new home

I have actually followed every steps of the recovering from hack. But I still got hacked. I though it was because I am using shared hosting. So what do you suggest me to do next? I have prepared a clean 1.3.9h version already

my concern is:

1. if I upgrade first, since it is a shared hosting, I will still vulnerable for hackers and bring the hackers to new server

2. if I move the old cart to new server first, I am also risk myself for bringing hacked files

So which one of above will have less risk?

thanks

1.3.8a if not patched is extremely vulnerable to known exploits as of July 2009

Install/upgrade yours to 1.3.9h on your shared platform

If it gets hacked it is something that you have missed

thanks, so I will upgrade to 1.3.9h first. If everything is alright, even it is a shared hosting without SSL, hacker is not easy to hack into it, rite?

Not if you follow ALL and I mean ALL the steps in the recovering from a hack wiki article

I suspect that you have not and they have remamnants that you have not cleaned

Dedicated server and shared server are pretty much the same except you can block or disable more third party modules on a dedicated server.

Dedicated server cost a lot more money than Shared unless your site performance is affected you should stick with Shared.

It would be a good idea to use SSL if you are doing business online. A lot of educated customers will not make a purchase on none secure pages.

Follow the Hack recovery wiki like Kobra suggested and make sure you never shared your server or cPanel access with anybody.

CoolCarPartsOnline:

Dedicated server and shared server are pretty much the same except you can block or disable more third party modules on a dedicated server.

Dedicated server cost a lot more money than Shared unless your site performance is affected you should stick with Shared.

It would be a good idea to use SSL if you are doing business online. A lot of educated customers will not make a purchase on none secure pages.

Follow the Hack recovery wiki like Kobra suggested and make sure you never shared your server or cPanel access with anybody.

Thanks, I am trying every attempt to follow the recovering wiki

But I always heard the guys in forum said that shared web hosting is highly vulnerable to hackers. They said, if other user from my shared hosting being hacked, the hacker can hack me easily too. Is it true?

I am currently using a Linux shared web hosting from godaddy of less than USD10 a month. If I did not get you wrong, you mean that this cheap shared hosting is not a lot different to dedicated server in terms of protection against hacker. My traffic is still low (maybe about 150Gb consumed bandwidth), so you do not suggest me to use dedicated server, rite?

You do not need a dedicated server!!!

Read this about the host you are using
http://www.zdnet.com/blog/ou/godaddy-hosting-customers-victim-to-massive-hack/239

And Google "godaddy hacks" for more

Their security is lax other hosts take measures to prevent a server level hack but can not insure that each and every script is not vulnerable

kobra:

You do not need a dedicated server!!!

Read this about the host you are using
http://www.zdnet.com/blog/ou/godaddy-hosting-customers-victim-to-massive-hack/239

And Google "godaddy hacks" for more

Their security is lax other hosts take measures to prevent a server level hack but can not insure that each and every script is not vulnerable

Thanks for your reply. So you mean I just need to change a hosting company and stick with shared hosting rite? (of coz I will still need to go through the recovering wiki)

That would be my suggestion