Order a module Order a template
Knowledge base

Security and hosting for DLE sites

Malware and hacks, admin and uploads hardening, site mail and blocklists, servers — from our experience.

Security & hosting 12 minute read PHP2Shell: what a DLE site owner needs to know about two RCEs in PHP We go through CVE-2026-109618 and CVE-2026-109619 in PHP: which versions are fixed, why php -v alone is not enough and what to check after the update. Read the article
FAQ

About the security and hosting section

How to protect a DataLife Engine site and the server under it: malware and hacks, protecting the admin panel and the uploads folder, file permissions, backups.

Ask on Telegram
How do I protect the DLE admin panel?

Rename admin.php as DLE itself recommends, use a strong password and, if possible, restrict admin access by IP at the web server level.

Why is running PHP in the uploads folder dangerous?

Users and plugins upload files to uploads. If PHP can run there, an uploaded malicious script gets access to the whole site. Block PHP execution in uploads in the web server settings.

Why do site emails land in spam?

Usually because of domain and server settings: no SPF, DKIM and DMARC records, the PTR record of the IP does not match the server name, or the IP is already on a blacklist such as Spamhaus. Check each record — free services can do it.

How can I tell a DLE site has been hacked?

Signs: unknown .php files in uploads and the template folder, foreign links or redirects for visitors from search, new administrators in the database, a sharp rise in outgoing mail. Compare the site files with a clean copy of your DLE version.