Security features and best practices

Security is built in. A few steps of your own complete it.

Built in

• Prepared statements for all database queries
• CSRF tokens on forms
• HttpOnly and SameSite cookies, hashed passwords (bcrypt)
• Blogger HTML is cleaned with a whitelist before it is stored
• Uploaded images are re-encoded with GD; PHP execution is blocked in upload folders
• Rate limits and captcha on public forms; login throttling in the administration
• Stripe webhooks are verified with the signing secret

Your checklist

1. Use HTTPS everywhere.
2. Delete the /install folder and the demo bloggers before launch.
3. Use strong, unique admin passwords and give team members limited groups (Administrators and permissions).
4. Keep PHP and MySQL updated.
5. Back up regularly (Backups).
6. Keep file permissions tight: only the listed folders need to be writable.
7. Keep Stripe and PayPal secrets private; rotate them if you suspect a leak.

Last updated 1 November 2026