3

I've extracted phpmyadmin in public folder, and named it phpmyadmin-012940912830

Now I can access it using, mysiteurl.com/phpmyadmin-012940912830, I don't want anyone to know about this URL but what if google index it and show when someone search for my website name with keyword phpmyadmin.

  • 2
    You shouldn't even have PHPMyAdmin publicly accessible. It's a huge security liability. – André Borie Aug 16 '15 at 12:36
  • 1
    Rule of thumb: Whenever there's a public URL to it, people should be able to know about it without you being afraid that something might go wrong. If you can't guarantee that, why even make it public? – Chiru Aug 16 '15 at 16:58
5

You've just identified why phpMyAdmin should be only accessible through a protected backend like cPanel... or other means.

If Google indexes it, you will be providing a Google Dork, the term for inept server admin mistakes.

Lock down access to it via your .htaccess file with either a login or by limiting the ip addresses that can see the link with a 403 Access denied for everyone else.

Links are to other StackExchange sections where the above protections have been described.

1

First change the URL for access.

Then when the URL is reached, one should be asked for a valid username or password before accessing the actual phpmyadmin interface.

Also, To increase the odds of a phpmyadmin URL not being indexed by any search engine make sure it is told not to index. Modify the Phpmyadmin code and make sure that:

header("X-Robots-Tag: noindex, nofollow", true);

is added before html output (before any print or echo statements). Adding it near other lines containing "header" is ok.

Alternatively, you can edit the html output and include the robots meta tag in it.

See: http://www.robotstxt.org/meta.html for info.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.