[Banadmin]

Make sure you have all these boxes ticked:

• Change the admin directory from default
  
• Make your admin directory "password protected"
  
• Make ALL (e-mail, hosting, website, domain etc) passwords unique
  
• Add 2-step authentication to your mail (use Google Mail)
  
• Use SMPT (external) mailing if on VPS
  
• Patch or completely remove avatar URL uploading
  

[Auth]

Thanks for these, I have done all these I think apart from ones which I do not need.

[Dean Winchester]

Thanks for the tips Blue. Many users will find them useful.

[OversouL]

I don't understand the last part.

[Banadmin]

I don't understand the last part.

"Hackers" can use this service to grab the origin server IP even if the website is secure by a reverse proxy through URL avatar uploading.

[Nefarious]

*SMTP

You should also only allow certain IP addresses or IP ranges to access important directories.
Your admin password should be at least 30 characters long, with at least six symbols and it should have capital and lowercase letters.. (Write it down on paper, don't keep it on your PC)
Admin accounts should not have emails linked to them, you should remove them via PHPMyAdmin.
Add an extra password for the admin directory.
Put a IP logger in a fake admin directory(not the admincp honeypot) and put the directory name in robots.txt

Make use of MyBBs file verification to check for backdoors.
If you are using Cpanel use Clam AV Scanner at least once a week to look for GET backdoors and shells.

[OversouL]

I don't understand the last part.

"Hackers" can use this service to grab the origin server IP even if the website is secure by a reverse proxy through URL avatar uploading.

*SMTP

You should also only allow certain IP addresses or IP ranges to access important directories.
Your admin password should be at least 30 characters long, with at least six symbols and it should have capital and lowercase letters.. (Write it down on paper, don't keep it on your PC)
Admin accounts should not have emails linked to them, you should remove them via PHPMyAdmin.
Add an extra password for the admin directory.
Put a IP logger in a fake admin directory(not the admincp honeypot) and put the directory name in robots.txt

Make use of MyBBs file verification to check for backdoors.
If you are using Cpanel use Clam AV Scanner at least once a week to look for GET backdoors and shells.

Ne knowledge acquired. :devil:

[Cosmic]

Learning to manually mitigate DDoS attacks is the best thing that you'll ever learn. Relying on third party software will let you down.

[DavidGuetta]

Thanks for this admin, will help me!

[Nefarious]

Learning to manually mitigate DDoS attacks is the best thing that you'll ever learn. Relying on third party software will let you down.

Most people use shared-hosting, so they wouldn't be able to mitigate attacks if they knew how.