📚 Help Center

Security Guidelines

Security Guidelines

The school website CMS is built with security as a top priority.

For All Users

• Strong Passwords — Use at least 8 characters with a mix of letters, numbers, and symbols
• Don't Share Login Credentials — Each user should have their own account
• Log Out — Always log out when using shared computers
• Report Suspicious Activity — Contact the Super Admin if you notice unusual behavior

Built-in Security Features

• CSRF Protection — All forms are protected against Cross-Site Request Forgery
• Password Hashing — Passwords are securely hashed using bcrypt
• PDO Prepared Statements — All database queries use parameterized statements to prevent SQL injection
• File Upload Validation — Only valid image files are allowed; file types and sizes are verified
• Role-Based Access Control — Users can only access features appropriate to their role
• Activity Logging — All admin actions are recorded in the activity log
• Session Security — Sessions are regenerated on login and use secure settings

File Upload Security

• Only JPG, PNG, GIF, and WebP files are accepted
• Files are verified to be genuine images (not disguised executables)
• Maximum file size is 10MB
• Files are renamed to prevent directory traversal attacks