Advanced security and maintenance

Advanced security in Éclair starts where the everyday settings stop: understanding what protects your data, repairing lost access, updating without breaking anything and monitoring the site over time. This lesson is for anyone who manages one or more sites, on shared hosting or on a VPS.

What the offensive security review checked

Any advanced security effort starts with a question: what was actually tested? Éclair was deliberately attacked: race conditions between requests, brute force, redirects, injections, booby-trapped files. The review found 17 vulnerabilities (2 severe, 7 medium, 8 minor), all fixed, then its 13 attack scenarios were replayed against the fixed version: all were neutralized. Many of them now run every time you execute php tests/run.php, for example:

Data protections in detail

• No database, so no SQL injection. The data/, app/ and cache/ folders are blocked by the server, and every data file starts with <?php exit; ?>.
• Private files: 0600 permissions, data and cache folders in 0700, atomic writes under a lock. No <?php sequence can be written into a data file.
• Sessions: none before login, files named after the SHA-256 hash of their ID, and HttpOnly, Secure (over HTTPS) and SameSite=Strict cookies.
• Passwords: Argon2id with 19 MiB and 2 passes, with bcrypt as a fallback. A dummy hash makes checking an unknown email take as long as checking a real account, so nobody can guess which accounts exist.
• API keys: encrypted in data/vault.php (libsodium, or AES-256-GCM as a fallback), never sent back to the browser, excluded from backups.

ECLAIR_SECRET: why and when?

The vault key is derived from the site secret, stored in data/keys.php. Someone who got hold of a copy of data/ alone (a manual archive of the folder, a Docker volume, a poorly protected data folder) could therefore decrypt your API keys. The ECLAIR_SECRET constant adds a second secret, stored outside data/: both are then needed.

<?php
// eclair-config.php, next to index.php
defined('ECLAIR') || exit;
define('ECLAIR_SECRET', 'une-longue-phrase-secrète-propre-à-ce-site');

Set it before you save your API keys, replacing the example value with a long phrase of your own. If you add, change or lose it later, the keys already saved become unreadable: just enter them again in Settings › AI assistant, since nothing else depends on it. Store this phrase in your password manager, one per site. The eclair-config.php file is protected: the server refuses any .php file other than index.php, and the integrity check recognizes it.

Integrity check and manifest.php

In Security › File integrity, Scan now compares each Éclair file with its original fingerprint, recorded in app/manifest.php, and looks for suspicious files.

Run the scan after each update, every month, and whenever a behavior surprises you. If you find a suspicious file: download a backup, keep a copy of the file to analyze it, delete it, change the passwords and look for how the intruder got in.

Bounded logs and lost access

The data/logs/security.php and data/logs/errors.php logs record one JSON line per event. Each field is truncated to 300 characters, and beyond 1 MB, only the last 256 KB are kept, so an attacker can't make them balloon. The Security page shows the Security log (logins, failures, blocks, two-factor authentication, backups, changed settings) and the Recent technical errors.

Forgot your password, or lost your two-factor authentication phone, with no other administrator? Create the data/reset.php file via FTP, with exactly these three lines (the protection line, your account's email address, then your new password):

<?php exit; ?>
ton-adresse@email.fr
TonNouveauMotDePasse2026

Within 24 hours, log in with that email and that password, which must follow the usual rules (at least 10 characters). The password is replaced, two-factor authentication for the account is turned off, your other sessions are closed and the file is deleted. Without the first line, the file is refused and erased. Likewise, if the installation shows “Installation locked”, delete data/install-window.php: the 2-hour window opens again.

How do you update Éclair without breaking anything?

1. Download a backup: Security › Download a backup, with your password.
2. Via FTP, delete the app/ and assets/ folders, then upload the ones from the new version along with index.php and .htaccess. Deleting first avoids keeping old files, which the integrity check would flag as unknown.
3. Don't touch data/ (content, settings, accounts, custom CSS), media/ (images) or eclair-config.php.
4. In Settings › Advanced, click Clear cache: the saved pages still point to the old versions of the static files.
5. Run Scan now: only your customized templates, if you have any, should appear.

Over SSH, steps 2 and 3 take four commands, since the archive contains an eclair/ folder:

cd /var/www/eclair
unzip -q ~/eclair-cms-1.8.0.zip -d ~/eclair-new
rm -rf app assets
cp -r ~/eclair-new/eclair/app ~/eclair-new/eclair/assets ~/eclair-new/eclair/index.php ~/eclair-new/eclair/.htaccess .

Off-site backups and file permissions

There's no advanced security without an off-site backup. The ZIP backup contains data/ and media/, without the sessions, the counters, the ai/ folder (conversations and MCP connections), vault.php or reset.php. To restore, replace data/ and media/ with those from the archive, clear the cache, then enter your API keys again and reconnect Claude or ChatGPT. Keep at least one copy outside your hosting, and make one before every update.

On a VPS, automate the same backup with tar, excluding the same items:

tar -czf /sauvegardes/eclair-$(date +%F).tar.gz -C /var/www/eclair \
  --exclude=data/sessions --exclude=data/limits --exclude=data/ai \
  --exclude=data/vault.php --exclude=data/reset.php data media

As for permissions, Éclair only writes to data/, cache/ and media/. On a VPS, only these three folders need to belong to the PHP user; the code (app/, assets/, index.php) can stay read-only for it, and eclair-config.php readable by PHP but not by other accounts. On shared hosting, keep folders at 755, as the setup wizard asks.

Advanced security: HSTS, admin and firewall

• HSTS (Settings › Advanced): Éclair sends Strict-Transport-Security: max-age=31536000, one year, without subdomains. Only turn this option on once HTTPS is perfectly stable.
• Admin URL (Settings › Advanced, 3 to 40 characters: lowercase letters, numbers, hyphens): a personal address keeps bots away. Neither the site's Edit button nor the MCP connector's discovery reveals it, so write it down carefully.
• Web application firewall: Éclair doesn't need one, but you can add a layer, such as the OWASP CRS rules with ModSecurity or your CDN's firewall. Then test saving in the editor, /_eclair/ and /.well-known/: these requests contain JSON and HTML that sometimes trigger false positives.

Monitoring and revoking MCP access

The Protection level card on the Security page sums up seven points: HTTPS enforced, site address verified, two-factor authentication for all administrators, custom admin URL, PHP 8.2 or later, Argon2id passwords, HSTS. Aim for 100%.

To revoke the MCP connector, click Revoke access next to the app in Settings › AI assistant. Unchecking Allow MCP connections cuts off every app at once, as does a password change or Log out my other devices in your profile. Access tokens last one hour, and only their hashes are stored.

Key points

• Éclair's advanced security relies on protections checked by an offensive review and replayed by the automated tests.
• Set ECLAIR_SECRET before saving API keys, and keep the phrase outside the site.
• An update replaces app/ and assets/, keeps data/, media/ and eclair-config.php, then clears the cache.
• The integrity check, run monthly and after every update, spots modified, unknown and suspicious files.
• data/reset.php restores access within 24 hours, with no outside help, to whoever controls the FTP account.

Going further

• Everyday security: two-factor authentication, roles and one-click backups.
• Understanding the MCP connector: tokens, approvals and app permissions.
• Nginx, VPS, proxy and CDN: HTTPS, HSTS and the real IP address outside Apache.
• OWASP: Password Storage Cheat Sheet, the source of Éclair's Argon2id settings.
• PHP: supported versions and end-of-support dates.

All the lessons of this path