---
title: "Advanced security and maintenance"
description: "Éclair advanced security: offensive review, ECLAIR_SECRET, integrity check, FTP recovery, safe updates, backups and monitoring."
url: "https://eclair.academy/en/paths/expert/advanced-security"
lang: "en"
author: "Thierry Gustin"
published: "2026-11-02"
updated: "2026-11-02"
---

# Advanced security and maintenance

> **Key takeaways** — Éclair's advanced security combines built-in protections, tested by an offensive review (17 vulnerabilities found and fixed), with a maintenance routine: off-site backups, updates that replace app/ and assets/ without touching data/ or media/, the integrity check, ECLAIR_SECRET, HSTS, a custom admin URL and revoking unused MCP access.

Advanced security in Éclair starts where the everyday settings stop: understanding what protects your data, repairing lost access, updating without breaking anything and monitoring the site over time. This lesson is for anyone who manages one or more sites, on shared hosting or on a VPS.

> **Before you start** — Time: 45 minutes. Prerequisites: be comfortable with [Everyday security](https://eclair.academy/en/paths/intermediate/everyday-security) (two-factor authentication, roles, the Security page), have FTP or SSH access, and have read [Éclair's architecture](https://eclair.academy/en/paths/expert/architecture).

## What you'll be able to do

### 🛡 Understand the protections

What the offensive review checked and what Éclair does on its own.

### 🔧 Update safely

The complete procedure, via FTP or over SSH.

### 📅 Keep a routine

Off-site backups, integrity, logs and MCP access.

## What the offensive security review checked

Any advanced security effort starts with a question: what was actually tested? Éclair was deliberately attacked: race conditions between requests, brute force, redirects, injections, booby-trapped files. The review found 17 vulnerabilities (2 severe, 7 medium, 8 minor), all fixed, then its 13 attack scenarios were replayed against the fixed version: all were neutralized. Many of them now run every time you execute `php tests/run.php`, for example:

| Replayed attack | Automatic check |
| --- | --- |
| site uploaded then forgotten, installed by a stranger | installer locked after 2 hours |
| forged site address | never used to redirect visitors |
| passwords tried in parallel | blocking per network, while the owner is never locked out on their usual device |
| cache poisoned by a forged header | headers independent of the announced protocol |
| data file requested from the web | 404, plus the `<?php exit; ?>` line at the top of the file |
| booby-trapped FTP recovery file | refused and deleted if the protection line is missing |

## Data protections in detail

- **No database**, so no SQL injection. The `data/`, `app/` and `cache/` folders are blocked by the server, and every data file starts with `<?php exit; ?>`.
- **Private files**: 0600 permissions, data and cache folders in 0700, atomic writes under a lock. No `<?php` sequence can be written into a data file.
- **Sessions**: none before login, files named after the SHA-256 hash of their ID, and `HttpOnly`, `Secure` (over HTTPS) and `SameSite=Strict` cookies.
- **Passwords**: Argon2id with 19 MiB and 2 passes, with bcrypt as a fallback. A dummy hash makes checking an unknown email take as long as checking a real account, so nobody can guess which accounts exist.
- **API keys**: encrypted in `data/vault.php` (libsodium, or AES-256-GCM as a fallback), never sent back to the browser, excluded from backups.

## ECLAIR_SECRET: why and when?

The vault key is derived from the site secret, stored in `data/keys.php`. Someone who got hold of a copy of `data/` alone (a manual archive of the folder, a Docker volume, a poorly protected data folder) could therefore decrypt your API keys. The `ECLAIR_SECRET` constant adds a second secret, stored outside `data/`: both are then needed.

```php
<?php
// eclair-config.php, next to index.php
defined('ECLAIR') || exit;
define('ECLAIR_SECRET', 'une-longue-phrase-secrète-propre-à-ce-site');
```

Set it **before** you save your API keys, replacing the example value with a long phrase of your own. If you add, change or lose it later, the keys already saved become unreadable: just enter them again in **Settings › AI assistant**, since nothing else depends on it. Store this phrase in your password manager, one per site. The `eclair-config.php` file is protected: the server refuses any `.php` file other than `index.php`, and the integrity check recognizes it.

## Integrity check and manifest.php

In **Security › File integrity**, **Scan now** compares each Éclair file with its original fingerprint, recorded in `app/manifest.php`, and looks for suspicious files.

| Result | Meaning | What to do |
| --- | --- | --- |
| Modified files | content different from the original | normal for customized templates; otherwise, put back the file from the archive and look for the cause |
| Missing files | deleted or badly uploaded | upload them again from the archive |
| Unknown files | present in `app/`, `assets/` or at the root, absent from the manifest | often a leftover from an old version: delete it |
| Suspicious files | in `media/`, anything other than an image or a font; in `data/` or `cache/`, a script or a `.php` file without the protection line | treat it as an intrusion |

Run the scan after each update, every month, and whenever a behavior surprises you. If you find a suspicious file: download a backup, keep a copy of the file to analyze it, delete it, change the passwords and look for how the intruder got in.

## Bounded logs and lost access

The `data/logs/security.php` and `data/logs/errors.php` logs record one JSON line per event. Each field is truncated to 300 characters, and beyond 1 MB, only the last 256 KB are kept, so an attacker can't make them balloon. The **Security** page shows the **Security log** (logins, failures, blocks, two-factor authentication, backups, changed settings) and the **Recent technical errors**.

Forgot your password, or lost your two-factor authentication phone, with no other administrator? Create the `data/reset.php` file via FTP, with exactly these three lines (the protection line, your account's email address, then your new password):

```text
<?php exit; ?>
ton-adresse@email.fr
TonNouveauMotDePasse2026
```

Within 24 hours, log in with that email and that password, which must follow the usual rules (at least 10 characters). The password is replaced, two-factor authentication for the account is turned off, your other sessions are closed and the file is deleted. Without the first line, the file is refused and erased. Likewise, if the installation shows “Installation locked”, delete `data/install-window.php`: the 2-hour window opens again.

## How do you update Éclair without breaking anything?

![Updating Éclair: replace app and assets, keep data and media](https://eclair.academy/media/2026/11/eclair-academy-update-en.png)
*What an update replaces, and what it never touches.*

1. Download a backup: **Security › Download a backup**, with your password.
2. Via FTP, delete the `app/` and `assets/` folders, then upload the ones from the new version along with `index.php` and `.htaccess`. Deleting first avoids keeping old files, which the integrity check would flag as unknown.
3. Don't touch `data/` (content, settings, accounts, custom CSS), `media/` (images) or `eclair-config.php`.
4. In **Settings › Advanced**, click **Clear cache**: the saved pages still point to the old versions of the static files.
5. Run **Scan now**: only your customized templates, if you have any, should appear.

Over SSH, steps 2 and 3 take four commands, since the archive contains an `eclair/` folder:

```bash
cd /var/www/eclair
unzip -q ~/eclair-cms-1.8.0.zip -d ~/eclair-new
rm -rf app assets
cp -r ~/eclair-new/eclair/app ~/eclair-new/eclair/assets ~/eclair-new/eclair/index.php ~/eclair-new/eclair/.htaccess .
```

## Off-site backups and file permissions

There's no advanced security without an off-site backup. The ZIP backup contains `data/` and `media/`, without the sessions, the counters, the `ai/` folder (conversations and MCP connections), `vault.php` or `reset.php`. To restore, replace `data/` and `media/` with those from the archive, clear the cache, then enter your API keys again and reconnect Claude or ChatGPT. Keep at least one copy outside your hosting, and make one before every update.

On a VPS, automate the same backup with `tar`, excluding the same items:

```bash
tar -czf /sauvegardes/eclair-$(date +%F).tar.gz -C /var/www/eclair \
  --exclude=data/sessions --exclude=data/limits --exclude=data/ai \
  --exclude=data/vault.php --exclude=data/reset.php data media
```

As for permissions, Éclair only writes to `data/`, `cache/` and `media/`. On a VPS, only these three folders need to belong to the PHP user; the code (`app/`, `assets/`, `index.php`) can stay read-only for it, and `eclair-config.php` readable by PHP but not by other accounts. On shared hosting, keep folders at 755, as the setup wizard asks.

## Advanced security: HSTS, admin and firewall

- **HSTS** (**Settings › Advanced**): Éclair sends `Strict-Transport-Security: max-age=31536000`, one year, without subdomains. Only turn this option on once HTTPS is perfectly stable.
- **Admin URL** (**Settings › Advanced**, 3 to 40 characters: lowercase letters, numbers, hyphens): a personal address keeps bots away. Neither the site's **Edit** button nor the MCP connector's discovery reveals it, so write it down carefully.
- **Web application firewall**: Éclair doesn't need one, but you can add a layer, such as the OWASP CRS rules with ModSecurity or your CDN's firewall. Then test saving in the editor, `/_eclair/` and `/.well-known/`: these requests contain JSON and HTML that sometimes trigger false positives.

## Monitoring and revoking MCP access

The **Protection level** card on the **Security** page sums up seven points: HTTPS enforced, site address verified, two-factor authentication for all administrators, custom admin URL, PHP 8.2 or later, Argon2id passwords, HSTS. Aim for 100%.

| Frequency | Action |
| --- | --- |
| every month | read the protection level and the security log, run the integrity scan, store a backup off-site |
| with every release | follow the update procedure, then run the scan again |
| every quarter | review the accounts in **Users** and revoke unused MCP apps |
| continuously | external uptime monitoring that alerts you if the site stops responding |

To revoke the MCP connector, click **Revoke access** next to the app in **Settings › AI assistant**. Unchecking **Allow MCP connections** cuts off every app at once, as does a password change or **Log out my other devices** in your profile. Access tokens last one hour, and only their hashes are stored.

## Key points

- Éclair's advanced security relies on protections checked by an offensive review and replayed by the automated tests.
- Set `ECLAIR_SECRET` before saving API keys, and keep the phrase outside the site.
- An update replaces `app/` and `assets/`, keeps `data/`, `media/` and `eclair-config.php`, then clears the cache.
- The integrity check, run monthly and after every update, spots modified, unknown and suspicious files.
- `data/reset.php` restores access within 24 hours, with no outside help, to whoever controls the FTP account.

## Going further

- [Everyday security](https://eclair.academy/en/paths/intermediate/everyday-security): two-factor authentication, roles and one-click backups.
- [Understanding the MCP connector](https://eclair.academy/en/paths/ai-mcp/understanding-mcp): tokens, approvals and app permissions.
- [Nginx, VPS, proxy and CDN](https://eclair.academy/en/paths/expert/nginx-vps): HTTPS, HSTS and the real IP address outside Apache.
- OWASP: [Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html), the source of Éclair's Argon2id settings.
- PHP: [supported versions and end-of-support dates](https://www.php.net/supported-versions.php).

## Frequently asked questions

### Does the ZIP backup contain my API keys?

No: `vault.php` and the `ai/` folder are excluded. After a restore, enter your keys again in **Settings › AI assistant** and reconnect your MCP apps.

### What should I do if the integrity check flags a suspicious file?

Treat it as an intrusion, right away. The steps are described in the integrity check section: backup, copy for analysis, deletion, new passwords and a search for the security hole.

### What happens if I lose eclair-config.php and ECLAIR_SECRET?

Only the API keys become unreadable: the rest of the site keeps working. Recreate the file with a new phrase, then enter your keys again.

### Does Éclair need a web application firewall?

It's not necessary, since its protections are built in. If you add one, check that it lets the editor, `/_eclair/` and `/.well-known/` through.