In this section of the tutorial you will find several tips how to improve the security of your Invision Power Board.
1.
Do not allow HTML for your board except for user groups that you can
fully trust. When creating a forum you can choose not to allow HTML code
to be posted in various sections for the board. You can disallow HTML
code in all of the areas listed below:
To disable HTML in
signatures and the about me section for members go to System tab->
System Settings -> Members tab -> User Profiles.
To
disable HTML in personal messages between users go to System tab ->
System Settings -> Members tab -> Personal Message Set-up
To
disable the HTML in posts for specific user groups go to Members tab
-> Manage User Groups -> Edit for the group -> Global tab
2. For the lost password recovery it is best to use the email random password option.
This
option can be altered via the IPBoard admincp -> System -> System
Settings -> System Tab -> Security and Privacy.
Note
that it is highly advisable to email the new password instead of
letting the user enter it manually as it is much less likely that the
user account email address is compromised.
3. Setup a limited amount of failed login attempts. If the number is reached the user is locked out of the forum for a set time.
This
option can be altered via your the IPBoard admincp -> System ->
System Settings -> System Tab -> Security and Privacy ->
Brute-force Account Locking section.
The
other two options below allows you to define if blocked accounts will
be automatically unlocked and if so after how many minutes.
4. Use
secure mail form for member to member communication. This way it will
not be possible to get the emails of your board users and use them for
spam and other fraudulent activities.
You can enable secure form
email for member to member communication via IPBoard admincp ->
System -> System Settings -> System Tab -> Security and Privacy
-> Use secure mail form for member to member mails
5. Remove the admincp link from your board and modify the name of the administrator directory to something else.
The
link to the admin panel that is by default included on your forum index
can be removed. This is highly advisable along with renaming the
admincp folder to something else. The option can be altered via IPBoard
admincp -> System -> System Settings -> System Tab ->
Security and Privacy -> Remove the ACP link from the board
6.
It is highly advisable to manually approve new accounts registration as
well as leave the option to verify the registration via email.
This
option might not be suitable for very popular forums that have lots of
new user registrations on a daily basis. However, for closed communities
it is best if you have all new user registrations manually approved by
forum administrators. This way you can prevent spam bots and
unauthorized users from posting on your forum with 100% success.
The
highest possible security is forcing users to first verify the new
account registration via the email address they provided upon
registering the new account. Once the new account registration is
verified via email it is queued for approval via the board
administrator. This option can be chosen via IPBoard admincp ->
System -> System Settings -> System Tab -> Security and Privacy
-> New registration email validation.
You might want to take some time and also adjust the options below to your convenience.
7.
Force user login before the board is viewed. This way only registered
users can view and post on your online board. Note that in this case
guests on your online board won't be able to view any of the forums. The
option is available at IPBoard admincp -> System -> System
Settings -> System Tab -> Security and Privacy -> Force guests
to log in before allowing access to the board
The
alternative is to set specific permissions for each forum and thus
allow some general purpose forums to be viewable for Guest users. For
example you might want to make news and forum rules viewable for
everyone so they can check them prior to registering.
To achieve
this all you need to do is use the permissions matrix when creating a
new forum or category. Do not add permissions for the group that guest
users are automatically assigned to. This way none of your forums will
be accessible for users that are not registered and logged in except for
forums you explicitly add permissions to. It is highly advisable to set
only Show Forum and Read Topics permissions in such cases.
8.
Do not display the version of IPB you are running. Otherwise it will be
much easier to search for possible exploits for the specific version if
one is trying to compromise your board.
Displaying the IPBoard
version can be turned off via IPBoard admincp -> System -> System
Settings -> System Tab -> Security and Privacy -> Privacy
section -> Display IPB version on your site.
There
are various options you can manage for your IPBoard. Most of the other
features that can be a security issue are set to the highest possible
security by default. Bear in mind that you should carefully read and
understand what each option does prior to making changes in order to
avoid any issues with your online board.
Step 1: Click on Import New Skin Set and scroll down the page. 
