Finalizing My Setup

Hi guys,

I am quite impressed with your clean docs and amazing product.

Installation was a breeze. I have 5 questions for ya'll..

I will type as fast as I can as Im too excited to go back and configure the product..

1. Out of laziness, when I created the db user for the whcms database, I granted all permits except "grant privileges" The docs doesn't require all of these but I had a premade script for command line. Should I roll some of these permits back for security?

2. The installation required turning off mysql strict mode, can we turn it back on? Is there any benefit for it to be on? Seems not many applications require it to be turned off.

3. I am going to order the SSL cert offer I received by email from whcms. Will this apply domain wide because I have a vBulletin forum on the same website, and YES I prefer the cert to be domain wide. Actually I also have a 2nd website on the same server different assigned ip. IS the cert. server wide? This will be my first experience with SSL.

4. I intend to add cloudflare for ddos protection. Do you foresee an issues with this setup?

5. I followed all the "further secure" steps

FURTHER SECURE

https://docs.whmcs.com/Further_Security_Steps#Secure_the_Writeable_Directories

Is there any other steps I can take to secure the whcms environment further.

I dont mind upgrade complications as I take good notes. My only concern is functionality.

Centos 6.9

mysql 5.7.18

PHP 5.6.30

apache2.2/f2b/iptble

2. The installation required turning off mysql strict mode, can we turn it back on? Is there any benefit for it to be on? Seems not many applications require it to be turned off.

WHMCS requires MySQL strict mode to be turned off in order for it to function.

- - - Updated - - -

3. I am going to order the SSL cert offer I received by email from whcms. Will this apply domain wide because I have a vBulletin forum on the same website, and YES I prefer the cert to be domain wide. Actually I also have a 2nd website on the same server different assigned ip. IS the cert. server wide? This will be my first experience with SSL.

This depends on the SSL certificate, a DV (Domain Validated) will work on usually the root directory, www, or no http://www... If you get a wild card SSL Cert, it will work on other directory's on your server.

If you have a forums, live chat or any other folder in which you would like to secure with the ssl, I recommend you purchase a WildCard Certificate.

Well, that's a great news!!!

Thx affordableDC,

Anyone else's input would be appreciated..

If you get a wild card SSL Cert, it will work on other directory's on your server.

Directories, yes, other sites and domains, no. Even for a wildcard SSL, it's not going to cover every site/domain on the server.

3. I am going to order the SSL cert offer I received by email from whcms. Will this apply domain wide because I have a vBulletin forum on the same website, and YES I prefer the cert to be domain wide. Actually I also have a 2nd website on the same server different assigned ip. IS the cert. server wide? This will be my first experience with SSL.

If the second website is not the same domain, no.

Thanks bear!