Complete HostBill's security configuration before accepting real customer information. The work involves application access, private files and recoverable administration. Make one change at a time so an access mistake can be identified and reversed.
IN THIS ARTICLE
01 Protect files and private storage
- Remove the installation directory after installation or upgrade. Confirm that no installation archive or database export remains publicly downloadable.
- Protect
includes/config.phpfrom unnecessary writes. Store an encrypted recovery copy containing the original encryption hash and database configuration. - Move
attachments,downloadsandtemplates_coutside the public document root. Update$hb_attachments_dir,$hb_downloads_dirand$hb_templates_c_dirto their actual absolute paths. - Give the web application and scheduled tasks the access they require. Test a support attachment, authorised download and client page before removing the old private directories.
- Disable web-server directory listings and confirm that configuration, logs and private storage cannot be fetched directly through the public address.
02 Secure staff access
Create named staff accounts with permissions appropriate to their work. Enable and test an available multi-factor authentication plugin, then apply the intended enforcement settings. Keep an authorised recovery route documented before restricting administrator access by IP.
If you rename the administrator directory, update $hb_admin_folder and the paths used by cron and email piping. Test a second administrator session before closing the first. Record the custom directory for future upgrades, because new administrator files must reach that location.
03 Example: configure private directory paths
In this example the public application is under /home/billing/public_html and private storage is outside that directory. After moving the actual contents, update the existing entries in includes/config.php to match the real destination paths:
$hb_attachments_dir = "/home/billing/attachments";
$hb_downloads_dir = "/home/billing/downloads";
$hb_templates_c_dir = "/home/billing/templates_c";These paths are examples, so replace them for your account. Keep the original database settings and encryption hash. Confirm that the web process and cron account have the required access, then test a support attachment, an authorised download and a rendered client page. Directory permissions should suit those users; copying a world-writable permission command is not a substitute for checking ownership.
Common questions
Does renaming the administrator directory replace MFA?
No. It changes the address and can reduce routine unsolicited requests, but it does not verify identity or prevent compromise of known credentials. Continue using unique accounts, MFA, restricted privileges and monitored access.
Why did attachments stop working after I moved them?
Check the configured absolute path, directory ownership and access for both web PHP and the cron user. Also confirm that the files were moved rather than only creating an empty destination. Restore the documented original paths if you need to recover access while investigating.