many questions

not sure where should I post the questions, so I post here
I am using 1.3.9h on a linux host

1. the default setting of sending email is by php, but the documentation said it is not secure, as it can expose the admin folder's name.
   so what should I use? is sendmail secure? (it works), I cannot use SMTP somehow

2. there is the "powered by zen cart" at the bottom, personally I don't mind leaving this part there. Only that, would this be a security risk by telling people what program you use for your online business, and thus some of them will figure out ways to attacks the site accordingly?
   it seems to me that not showing the name out is more secure

any comments?

1. You should work with your host to sort out your SMTP problems.

2. If you're paranoid about it, you can remove it. But it shouldn't be necessary. Besides, if someone knows how ZC works, just looking at the raw HTML of your website pages one can tell whether it's a ZC site or not, even if Zen Cart isn't mentioned anywhere. There's little point in spending a lot of energy unbranding it. Better to spend time properly securing your site instead.

yeah, I suppose you are right
and after I take the steps described in the security recommendations page, the site should pretty secure, right?

the only thing bugs me is, I have to treat the admin folder's name like a password, can be a hassle
If I do SSL on the admin page, do I still need a complicated folder name?

as for the SMTP, I don't have problem using it in email clients, no idea why it doesn't work here

As for the admin foldername, it doesn't have to be complicated. Just should be something not easily guessed, such as "admin".

For the SMTP, what's your hosting company saying about it? Have you tried SMTPAUTH and specified all the SMTP/Auth settings properly? Including the appropriate port number?

good, I don't need to treat the admin folder name like a freaking password

I don't know, I can use SMTP in the email clients, it shouldn't be a problem on the email option using the same setting
what's the different between SMTP and SMTPAUTH?

SMTPAUTH sends a password to the SMTP server as part of the login request for sending an email. This is essential if your email SMTP server sits on a physically different server than your website does.

they are on the same host
by the way, does the SMTP support SSL?

If you specify an SSL port number, then yes, although it probably won't be necessary if they're on the same server.

one of the SMTP's SSL port is 465
so when I use this port, it will automatically uses SSL?

good, I don't need to treat the admin folder name like a freaking password

No you don't. But I do recommend that you use the Password Protection feature in your web hosting control panel to add an extra .htaccess login to your renamed 'admin'folder. The reason for this is that failed attempts to get past a .htaccess login should trip server security and automatically block the ip address of the offender.

Vger

would this be a security risk by telling people what program you use for your online business, and thus some of them will figure out ways to attacks the site accordingly?Only for novice script kiddies; anyone who is a real threat will know how to find Zen Carts no matter what you do.

so it would be like, a double login?
first the .htaccess login, then the admin page login?

Yes, that would give a double login.

nah, a double login would drive me, as the admin, crazy, let alone other staffs that will also be accessing the admin control
different admin folder name, good passwords with SSL should be enough for now

nah, a double login would drive me, as the admin, crazy

1.3.9h is (at this time) secure - but hackers are always finding new ways to get around security and it's a given that they will eventually find a way around the latest security measures.

So you have to decide whether a double login will drive you more crazy than trying to recover a hacked site will.

Vger

If I clear the credit card info every time after the transaction is completed and the products is shipped, I suppose it will be a lot safer?
there is really not much to hack for besides name and address

If I clear the credit card info every time after the transaction is completed and the products is shipped, I suppose it will be a lot safer?

Not really - if the hacker has (or has had) access to your site and has arranged for copies of orders and emails to be sent to them.

This is why you should not store credit card details on your website at all.

Vger

well, of course it is another story if your system is already compromised
I, being the admin, is just learning about different parts of the system, haven't touch the payment gateway yet (we haven't even decide which gateway to use), so I don't know what the payment procedure is when using one
if I have a choice of not keeping the credit card info at all, that would be an excellent news for security (even if there is a security bleach, that would be the gateway's problem. not our fault) :)

If the site uses an offsite (3rd Party) payment processing company (Pay Pal etc.) then the site does not store credit card information in the site's database at all.

And the latest version of Zen Cart (1.3.9h) does not even have the old Credit Card module as part of the install.

Vger

another question
if I set the root of the site to be, let's say /web instead of /, and put the zen cart root to this /web new root
when I put some files in the / path, I suppose people outside won't be able to access these files except if they do hacking?