What is a good and easy way to make my site secure?

My goal is to make my site secure. I am a bit new to this but I saw names like SSL, SSH, etc. I am through host monster, and they offer something like SSH/shell access. I guess my first question is:

1.) I haven't attempted to try to access the SSH/shell access for my site. Will this be sufficient for my site? Anyone know or use this through host monster or through another server?

2.) Anyone have any suggestions to reach my goal?

Thanks in advance!!

~Steve

Sounds like you're looking for the magic wand solution there Steve. Happily Zen Cart has much of the magic built in. But there are still a number of additional steps that you can take, none of them overly difficult, that are explained in this FAQ Entry.

Might review this http://www.zen-cart.com/wiki/index.php/Important_Site_Security_Recommendations

Kuroi, in the link you posted, it advises to move the /cache folder above the public_html/htdocs/www area. I would like to do this except I'm not totally sure how. Is it possible to cut and paste the cache folder? Can this be done in FileZilla? Or would I have to download it, then upload it a directory above, then delete the original?

Can someone give a step-by-step guide, ideally for the whole process?

/cache
This is used to cache session and database information. The BEST security protection for this is to move it to a folder "above" the public_html/htdocs/www area, so that it's not accessible via a browser. (Requires changes to DIR_FS_SQL_CACHE setting in configure.php files as well as Admin>Configuration>Sessions>Session Directory.

Using FTP you can move the folder by dragging and dropping one level up and if you are installed in a folder another level up...

Then edit this last line with new path in both configure.php files

define('DIR_FS_SQL_CACHE', '/enter/your/path/to/public_html_or_htdocs/and/zencart/here/zen/cache');

Most likely:

define('DIR_FS_SQL_CACHE', '/home/?accnt?/cache');

Mine says..
define('DIR_FS_SQL_CACHE', '/var/www/html/shop/cache');

Should I still move the cache folder up just one level, so it's /var/www/html/cache? Or do I need to move it up any further?

KoBra:

Using FTP you can move the folder by dragging and dropping one level up and if you are installed in a folder another level up...
Will be in your case

/var/www/cache

or maybe:

/var/cache

I have not seen both www and html that I can recall as a path

The link said to move it above www so I'm going to move it to /var/cache. Hopefully it will work.

A couple of lines up there is this - does yours say 'file' or 'none'??

define('SQL_CACHE_METHOD', 'none'); 

FileZilla outputs this error..

Command: RNTO /var/cache
Response: 550 Rename /var/cache: Permission denied

The folder has 755 permission. Folder properties are read/write.

kobra:

A couple of lines up there is this - does yours say 'file' or 'none'??

define('SQL_CACHE_METHOD', 'none');

It says none.

answer my earlier post and check at the level you are trying to move it to to see if a dir named cache exists there already

It says none.
Then unless you are going to change it to 'file' you do not need to do this

kobra:

Then unless you are going to change it to 'file' you do not need to do this

Oh ok. You were right about there already being a cache folder in the var directory. The reason I'm asking all this is because my tracking mod reported someone trying to do something with the cache folder. I was a bit concerned considering Kuroi's link stated it holds session/db info. So because mine says none, does this mean the cache folder is as secure as I can possibly make it?

as one exists at that level and you are not using any you can just delete or rename it without consequence

Ok, even though admin>config>sessions>session directory points to /var/www/html/cache?

You should be editing both configure.php files to be the same - both none and same path

Ok thanks Kobra. I have renamed the folder to something else, and the site seems to be running as normal. I think I'll just leave it this way.