A Structured Timeline for Auditing Legacy MyBB Permissions and Directory Access

By 4FreeForums Editors · Published October 29, 2026 · Sources linked below

Older community installations often retain default server structures, outdated administrative paths, and unhardened directory controls long after launch. Following a methodical review schedule ensures critical internal files, configuration parameters, and backend management interfaces remain protected from unauthorized exposure.

Phase 1: Pre-Audit Inventory and Immediate Safety Backups

Every administrative audit should begin with a clean snapshot of the system. According to the MyBB Security Guide - MyBB Documentation, making backups of all forum files and the database is extremely important, and administrators should routinely verify these copies to ensure the forum can be restored without errors. You can schedule the included Weekly Backup task in Tools & Maintenance → Task Manager to keep regular database copies ready for download.

Before modifying core files or altering table structures, verify database access tools such as phpMyAdmin or your command-line interface. For teams managing shared maintenance duties, reviewing our checklist on Forum Admin Security: 10 Steps to Protect Your Forum From Takeovers helps coordinate elevated credentials safely before touching the file tree.

Phase 2: Securing Root Directives and Internal Folders

Once backups are secure, the next stage of the timeline focuses on locking down web server routing and private directories:

• Deploy Server Directives: The base MyBB installation package provides htaccess.txt and htaccess-nginx.txt in the forum root. On Apache, rename htaccess.txt to .htaccess and verify that admin/backups/ contains its own existing .htaccess file. On nginx, transfer the contents of htaccess-nginx.txt into your server configuration block.
• Block Internal Directories: Restrict direct web access to the inc/ directory. For nginx servers, place a location block matching ~ /inc with the directive internal;. For Apache 2.4, create an .htaccess file inside the folder with Require all denied, or use Order deny,allow and Deny from all on Apache 2.2.
• Restrict SSRF Targets: Update inc/config.php to populate $config['disallowed_remote_hosts'] with 'localhost', and set $config['disallowed_remote_addresses'] to an array covering '0.0.0.0', '127.0.0.0/8', '10.0.0.0/8', '172.16.0.0/12', and '192.168.0.0/16' to prevent requests to local network interfaces.

Phase 3: Relocating and Obscuring the Administration Directory

Leaving the Admin Control Panel at its default /admin/ path invites automated guessing and makes targeted frontend attacks more effective. The MyBB Security Guide - MyBB Documentation recommends renaming the admin/ directory to an unpredictable name known only to trusted staff, such as d8e8fca2dc0f896.

To execute this migration:

1. Rename the actual admin directory on your server storage to your chosen secret string.
2. Open inc/config.php and update $config['admin_dir'] to match the newly chosen name.
3. In the same configuration file, update $config['hide_admin_links'] = 0; to prevent management links from rendering in the public forum theme.
4. Test the new direct URL in your browser and confirm login functionality before distributing the path to other staff. Remember that future extension assets intended for the administrative panel must be uploaded to the renamed folder.

Phase 4: Establishing External HTTP Authentication Layers

Adding HTTP Basic Auth puts administrative access behind an independent barrier that does not rely on MyBB software sessions. This htpasswd protection can be enabled through hosting control panels or manual terminal configuration:

• cPanel: Navigate to Directory Privacy, choose your renamed administrative folder, select the option to password protect the directory, enter a username and password, and save.
• DirectAdmin: Select Password Protected Directories, use Find a Directory to Password Protect, pick the administrative path, enter credentials, check Protection Enabled, and save.
• SSH for Apache: Place an .htaccess file in the directory using AuthType Basic, AuthName "Restricted", AuthUserFile /PATH/TO/.htpasswd, AuthGroupFile /dev/null, and require valid-user. Generate the credentials by running the shell command htpasswd -c -b /PATH/TO/.htpasswd DESIRED-USERNAME DESIRED-SECURE-PASSWORD.

Phase 5: Granular ACP Roles and Super Administrator Lockouts

The final phase of the audit restricts what logged-in administrators can execute. In MyBB, User ID 1 is established as a Super Administrator during setup. Additional Super Administrators can be defined in inc/config.php using comma-separated IDs via $config['super_admins'], such as setting it to '1,2002'. These accounts cannot be deleted, banned, or edited by standard administrators in most sections of the panel.

Review standard staff roles under Users & Groups → Admin Permissions. Avoid granting unfiltered HTML access unless strictly required. Critical permissions that handle unfiltered code include managing settings, custom profile fields, custom MyCode, language packs, help documents, calendars, forums, themes, and templates. Permissions controlling users, user groups, admin permissions, and group promotions can lead to privilege escalation, while cache and database backup tools expose sensitive data. If you are comparing backend workflows across platforms, see our overview of Best Free Forum Software Compared (phpBB, Discourse, Flarum, MyBB).

Sources

MyBB Security Guide - MyBB Documentation

Published October 29, 2026. No affiliate links on this page. Facts come from the sources linked above; check them for updates.