# Security Hardening Guide — AARJAY GDP Portal

## Immediate production actions

1. Change the seeded admin password.
2. Create named user accounts; do not share admin login.
3. Review `Permissions` for every non-admin user.
4. Keep `install.lock` in place after installation.
5. Remove or rename `install.php` and `install.sql` from production if no longer needed.
6. Verify `.htaccess` blocks direct access to:
   - `app/`
   - `logs/`
   - `*.sql`
   - `*.md`
   - `*.log`
7. Confirm upload directories cannot execute PHP files.
8. Confirm backups are encrypted/off-server where possible.

## Credential handling

Do not store these in plain text inside the portal:

- Xero/QuickBooks client secrets
- OAuth refresh tokens
- Supplier/customer portal passwords
- Cold-chain portal passwords
- Email SMTP passwords

Use encrypted secrets storage before enabling real integrations.

## Recommended server settings

- PHP 8.0+
- Disable `display_errors` in production.
- Enable PHP error logging to a protected server log.
- Restrict file permissions:
  - PHP files: read-only for web user where practical
  - Upload folders: writable only where needed
  - Config file: not world-readable
- Use HTTPS only.
- Add HSTS if domain is HTTPS-only.

## Operational controls

- Review Activity Log weekly.
- Review System Health after deployments.
- Run export/backups before schema changes.
- Retain GDP audit records per applicable policy.
