In implementations where one uses content management, which is the better method to secure the web content authoring pages from access from internet?

  1. Configuring httpd.conf to restrict the content authoring URLs to only internal LAN.
  2. Configuring firewall rules.

By using second method, one would need to configure the content authoring to run on a port other than port 80, which I do not have an issue.
By using the first method, if there is a mis-configuration in httpd.conf then it will open up a loop hole.

Which method is more sound in terms of security?


1 Answer 1


Depends on the capabilities of your firewall, really, but first: stop doing anything that involves being logged in on port 80! If your CMS asks for username and password, and you're running over HTTP (as would be standard for port 80), your username and password would be sent in clear text between your local machine and your server.

Once you're running over HTTPS, there is very little difference in the two approaches:

  1. Any misconfiguration in httpd.conf could open up loopholes, so you should be looking to minimise the chances of these. This could be through a limited set of configuration options being used, making it easier to monitor, or through keeping restrictions relating to specific sites in dedicated configuration files, again, ensuring that they can easily be checked for issues.
  2. If your firewall can only monitor traffic on a port level, it may introduce unintended paths to access content authoring functions if the CMS has not been built with this in mind. For example, it might still be possible to access content authoring tools over the main site port, but for the content authoring port to be unable to access the main site - this would depend on the specific CMS in use.

    If you have a more powerful firewall, which can do traffic inspection, you may be able to restrict access to specific URLs to given IP addresses. You may also be able to put these restrictions in place with some WAF systems. There is still a chance of misconfiguration, just as with httpd.conf though.

For most small sites, modifying httpd.conf or related files is probably sufficient. For larger sites, there is nothing to stop you from doing both - defence in depth is a good principle. For really high profile sites, you probably want to separate the content authoring and actual site serving, and implement some kind of push mechanism to send updates made on an authoring server to hosting servers which don't allow for modifications by other methods.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .