many questions

If you put your Zen Cart website out of the root and into a folder called 'web' (or anything else for that matter), and if you put an index.html page into the root with no links to the folder then how are customers and search engines going to find your website? Hackers will always find it.

Vger

no, I didn't mean to take the cart out of the root
what I meant is, I assign a path, like /web as the new root in my host control, and manage the cart in the /web path
any file that is for "internal use" would be place in / that only the host control and the FTP can access
except, of course, if hackers can find some ways to find this out

no, I didn't mean to take the cart out of the root

Okay, with you, so far.

what I meant is, I assign a path, like /web as the new root in my host control, and manage the cart in the /web path

So not with you now. That is completely contradictory to what you said in the first sentence.

Vger

If your hosting company allows you, and you want to change what the "document root" of your hosting account points to, then you can do that.
Whether that provides you with any different sort of security is up to you and your hosting company to sort out, since it's a function of the configuration of the hosting server, and not a Zen Cart specific question.

I know it can be confusing, vger, sorry about that
You probably know that the host control can let you change the root from the default setting of / to /xxx, or /xxx/xxx, pretty much whatever path you want
if you set the root to /xxx, then when people are accessing the web site, the deepest level they can access is the /xxx path, the / path would be out of their touch (again, excluding hacking)
well, it is and is not "take the cart out of the root". It is if you still consider the root is still /, but since you changed the root to /xxx , this is the new root, for the wage page at least
so may be this trick can provide some sort of short term security or something I think

The web root is what people can access normally; the server folder name is probably irrelevant. Some hosts have the web root in /public_html/, some have it in /htdocs/, etc. Ask your host just what difference it will make to security before insisting on making this change. Are you referring to an .htaccess file to redirect traffic from the root to a subfolder?

Are you referring to an .htaccess file to redirect traffic from the root to a subfolder?

No, kmcheng's referring to changing the actual 'root', so that, for example, instead of the root being:
home/username/public_html/
it would change to:
/home/username/public_html/xxx/

This would mean that files could be stored 'outside' of the new root at /home/username/public_html/ - but this is no different to leaving things as they are and just storing files at /home/username/

Vger

That was my understanding that the web root is the web root regardless of foldername, but as kmcheng was saying that this would make some difference, I was looking for some explanation that would fit that...

You can't "change the web root from / to /xxx", you can just have a different folder as root ( / ).

since we are talking here, I have another question
it is safe to do DB export if the zen cart is not in maintenance mode (aka hot backup)?
but I worry that a hot backup may affect the BD's integrity, you know, exporting the data while some customer may be registering new account or ordering products
it would be like try to copy a file that is in use

is it safe to do DB export if the zen cart is not in maintenance mode (aka hot backup)?

I would advise against that.

Vger

I think it is ok to do so for backing up the folders and files, but not for DB
for DB, I think I have the bring the site down for that. The good news is, the DB exporting process is pretty fast, like less than 30sec (from clicking the export link in phpmyadmin to actually saving the file)
the point is, to make the down time as short as possible

I routinely back up the DB every day without any issues, AFAIK, without going into maintenance mode. I use the mod Backup MySQL Plugin from the downloads. I can't see how there could be any issues of doing a backup while in regular(non-maintenance) mode. I can see problems doing a complete restore on a live site, but have restored or altered specific tables on a live site - things that didn't interfere with sessions which is really all that is a concern.

If the hard drives are reading/writing data to the database at the time you take the backup you will get a corrupted backup. Maybe you've just been lucky so far.

Vger

so far I only tried to export the DB in the phpmyadmin using the recommended options
at first the backup plugin didn't work, later on it worked, but never tried to use the output file to test the restore
it doesn't have options for me to choose from, so I won't know what the heck did it exported

PS: I am pretty much done with all the testing, prepare to build an official one
the problem is, I thought I am going to build one in an existing domain, finish most of the works, and then migrate to a new domain that has SSL and SFTP
there is only one "small" problem - this domain I want to build on doesn't have any security feature at all. I must be insane wanting to do that...

Vger:

If the hard drives are reading/writing data to the database at the time you take the backup you will get a corrupted backup. Maybe you've just been lucky so far.

Vger

Hmmm.... or maybe I never noticed any corruption..... interestingly, the mod is written by none other than our good Dr. Byte and there is no mention in the readme or elsewhere that the backup can be corrupted if the database is being actively used.

In my case, perhaps since I have a dedicated server with a separate SSD hard drive for the database it avoids corruption? I thought the backup took a snapshot of the data at a particular point in time and held it in memory while saving so any changes to the data while the file is being created aren't reflected in the backup.

A "hot backup" is generally considered to be an OS-level copy of potentially open database files. I believe that's what Vger was referring to in her response.

That's very different than doing an "export" using phpMyAdmin or with MySQLdump such as the mentioned addon uses.

so doing a hot backup is ok with the backup plugin, but not ok with doing export in phpmyadmin?

DrByte:

A "hot backup" is generally considered to be an OS-level copy of potentially open database files. I believe that's what Vger was referring to in her response.

That's very different than doing an "export" using phpMyAdmin or with MySQLdump such as the mentioned addon uses.

Thanks for the clarification, Dr. Byte! I didn't think that you would write a module that could cause major issues such as a corrupt DB backup.:smile:

So, for kmcheng, just use the module or export from phpMyAdmin. I'd recommend the module since it's all there in your admin and you don't have to keep going to phpMyAdmin to do an export. I have been using it for about 4 years and have never experienced any problems with the data integrity.

so I can use the plugin to backup the sql without bringing the site down, and can use the file to restore the site without problem?
and I don't need to worry about customers may be entering information when I am doing it?

PS: just tested using the sql file output from the plugin to restore, it is good

kmcheng:

so doing a hot backup is ok with the backup plugin, but not ok with doing export in phpmyadmin?
Exporting using the plugin or by doing an export using phpMyAdmin is not technically a "hot backup". Your use of the term is misleading.