3

I've extracted phpmyadmin in public folder, and named it phpmyadmin-012940912830

Now I can access it using, mysiteurl.com/phpmyadmin-012940912830, I don't want anyone to know about this URL but what if google index it and show when someone search for my website name with keyword phpmyadmin.

Aumkar Thakur
  • 33
  • 4

2 Answers2

5

You've just identified why phpMyAdmin should be only accessible through a protected backend like cPanel... or other means.

If Google indexes it, you will be providing a Google Dork, the term for inept server admin mistakes.

Lock down access to it via your .htaccess file with either a login or by limiting the ip addresses that can see the link with a 403 Access denied for everyone else.

Links are to other StackExchange sections where the above protections have been described.

Community
  • 1
Fiasco Labs
  • 2,492
  • 14
  • 11
1

First change the URL for access.

Then when the URL is reached, one should be asked for a valid username or password before accessing the actual phpmyadmin interface.

Also, To increase the odds of a phpmyadmin URL not being indexed by any search engine make sure it is told not to index. Modify the Phpmyadmin code and make sure that:

header("X-Robots-Tag: noindex, nofollow", true);

is added before html output (before any print or echo statements). Adding it near other lines containing "header" is ok.

Alternatively, you can edit the html output and include the robots meta tag in it.

See: http://www.robotstxt.org/meta.html for info.

Mike -- No longer here
  • 13,650
  • 5
  • 29
  • 63