Securing VisitAnalytics: protect the data folder and the admin panel

VisitAnalytics is built with security in mind. A few server settings make it even safer.

Built-in protections

• The statistics folder has a random name and a deny-all .htaccess, so the XML files cannot be guessed or downloaded on Apache.
• config.php exits immediately when requested directly; lib, lang and tools are blocked by .htaccess.
• Passwords are stored as secure hashes; the login is limited to 5 failed attempts per 15 minutes (Logging in, logging out and a forgotten password).
• All forms have CSRF tokens, all output is escaped, and the session cookie is HttpOnly and SameSite.
• Links created from visitor data (page addresses, referrers) are checked so they cannot run scripts.
• The tracker catches every error and cannot take down your website.

nginx

nginx ignores .htaccess files. Add this to your server block (adjust the folder name):

location ~ ^/VisitAnalytics/(data|lib|lang|tools)/ { deny all; }
location = /VisitAnalytics/config.php { deny all; }

Recommendations

1. Use HTTPS for the admin panel so the password is encrypted in transit.
2. Rename the VisitAnalytics folder (for example to a name nobody guesses) before you install the tracking code. If you rename it later, remove the old line from your index.php and install it again from the Installation tab.
3. Permissions: files 644 and folders 755 are enough on most servers. Only VisitAnalytics (for config.php) and data need to be writable by PHP.
4. Optional second lock: protect the admin folder with HTTP basic authentication in your hosting panel.
5. Back up regularly (Your data: where statistics are stored, backup and deleting data) and keep VisitAnalytics updated (Updating and uninstalling VisitAnalytics).

Last updated 1 November 2026