Securing XAMPP to Live Migration

Every project we build starts in a local XAMPP environment. That's great for fast iteration, but a local setup is intentionally permissive — directory browsing, verbose errors, and open file access all help debugging. None of that belongs on a live production server. Here's the checklist we run before any site goes live.

1. Disable Directory Browsing

An open directory listing hands an attacker a map of your entire codebase. A single Options -Indexes directive in .htaccess closes that door before anything else matters.

2. Force HTTPS Everywhere

Every request should be redirected to HTTPS, and browsers should be told to remember that with an HSTS header (Strict-Transport-Security). This prevents downgrade attacks where a visitor is silently served an unencrypted version of your site.

3. Set Core Security Headers

Four headers stop a large share of common browser-based attacks:

• X-Frame-Options: Blocks your site from being loaded inside a hidden iframe (clickjacking).
• X-Content-Type-Options: Stops browsers from guessing file types in a way that can be exploited.
• Referrer-Policy: Limits how much of your URL is leaked to third-party sites.
• X-XSS-Protection: An extra browser-level backstop against reflected cross-site scripting.

4. Sanitize Every Input, Every Time

Never trust data from a form, URL parameter, or cookie. Use prepared statements for all database queries, escape output with htmlspecialchars(), and validate file uploads by content type — not just file extension.

5. Compress and Cache Deliberately

GZIP compression and browser caching headers aren't just performance wins — a faster, leaner response surface also means less for an attacker to probe. We enable both by default on every production deployment.