Security Note

Applied Measures

Publishing security has been strengthened.
Sensitive connection details are not included in publishing.
PHP files, app folder, tools folder and SQL backup are not included in the package.
HTTP POST/PUT/PATCH/DELETE/TRACE methods are blocked by .htaccess.
Executable files such as .php, .phtml, .phar, .cgi, .pl, .py, .sh and .exe are denied.
Directory listing is disabled.
The /media folder serves public images only; script execution is blocked.

Note: .htaccess blocks web requests. Hosting account permissions such as FTP/cPanel File Manager should also be protected with strong passwords and two-step verification.