# ProInvoice — Security Guide

**Purpose:** Help buyers **protect** their installation, customers, and financial data.  
**Audience:** Site owners, administrators, and IT helpers  

---

## 1. Why security matters

ProInvoice handles **money**, **customer PII**, and **business documents**. A breach can mean **fraud**, **data loss**, or **regulatory** problems. These practices reduce **common** risks—they do not replace **legal** or **industry-specific** requirements.

---

## 2. SSL / HTTPS

### Recommendation

- Install a valid **SSL certificate** (Let’s Encrypt, cPanel AutoSSL, or commercial).  
- Force **HTTPS** so admin and customer sessions are **encrypted**.  

### Prevention

- Avoid mixed content (HTTP assets on HTTPS pages).  
- Set `APP_URL` in `.env` to `https://...` in production.  

---

## 3. Admin passwords & users

### Best practices

- **Change** default or installer-generated passwords **immediately**.  
- Use **long, unique** passwords (password manager recommended).  
- Create **individual user accounts** for staff—avoid sharing one login.  
- Use **Roles & Permissions** to limit who can delete data, change settings, or export reports.  

### Warning

**Super admin** roles can bypass restrictions—assign only to **trusted** people.

---

## 4. File permissions

### Goal

The **web server** should write only where needed (`storage`, `bootstrap/cache`, uploads). **Sensitive** files should not be web-accessible.

### Typical guidance

- **Never** set `777` unless a host temporarily requires it—**revert** afterward.  
- **Document root** must be **`public`** so `.env` is **not** downloadable.  

### If you suspect exposure

1. Fix document root.  
2. Rotate **database password** and **mail passwords**.  
3. Regenerate `APP_KEY` **only** per author instructions (may invalidate sessions).  

---

## 5. Backups

### What to back up

- **Database** (daily for active businesses).  
- **Application files** (especially `storage/app` uploads if used).  
- A copy of **`.env`** stored **offline** and **encrypted** (treat as secret).  

### Where to store backups

- **Off-server** (cloud storage, separate datacenter).  
- **Encrypted** at rest.  

### Testing

- Periodically **restore** a backup to a **test** environment to ensure backups actually work.

---

## 6. Updates & vulnerabilities

- Apply **product updates** from the author when released—often include **security fixes**.  
- Keep **PHP** on a **supported** version.  
- Remove **unused** plugins/addons.  

---

## 7. Server hardening (VPS)

If you manage the server:

- Configure **firewall** (allow 80/443/SSH only as needed).  
- Use **SSH keys** instead of passwords where possible.  
- Disable **directory listing** on the web server.  
- Enable **automatic security patches** or a maintenance window for patching.  

---

## 8. Application-level hygiene

- **APP_DEBUG** should be **`false`** in production.  
- Do not post **screenshots** containing `.env`, SMTP passwords, or license keys.  
- **Log out** on shared PCs.  
- Review **Reminder Logs** and **user accounts** periodically for anomalies.  

---

## 9. Email & phishing

- **SMTP credentials** are sensitive—treat like bank passwords.  
- Train staff to recognize **phishing** (“click here to verify invoice portal”).  
- Use **SPF/DKIM** on your domain when sending bulk mail (improves deliverability and trust—configure at DNS/host).  

---

## 10. Incident response (short checklist)

If you suspect a compromise:

1. **Take site offline** or put maintenance page (if you know how).  
2. **Change** all admin passwords and database passwords.  
3. **Review** access logs (hosting panel).  
4. **Restore** from a **known-good backup** if malware or defacement is present.  
5. **Notify** affected parties if **personal data** was exposed (follow **local law**).  
6. **Contact** the script author for **product-specific** guidance.  

---

## 11. Compliance note

Depending on your country and industry, you may need **GDPR**, **PCI** (if you store card data—**not recommended** in most self-hosted invoicers), or **retention policies**. Consult a **professional**—this document is **not legal advice**.

---

## Related documents

- **[INSTALLATION_GUIDE.md](INSTALLATION_GUIDE.md)** — Correct web root  
- **[TROUBLESHOOTING.md](TROUBLESHOOTING.md)** — When things go wrong  
- **[USER_MANUAL.md](USER_MANUAL.md)** — Roles & permissions  

---

*End of Security Guide*
