<p>In case of emergency, check your logs! By default they are located in the <codeclass="docutils literal notranslate"><spanclass="pre">server/logs/</span></code> folder.
Here are some of the more important ones and why you should care:</p>
<li><p><codeclass="docutils literal notranslate"><spanclass="pre">http_requests.log</span></code> will show you what HTTP requests have been made against Evennia’s built-in
webserver (TwistedWeb). This is a good way to see if people are innocuously browsing your site or
trying to break it through code injection.</p></li>
<li><p><codeclass="docutils literal notranslate"><spanclass="pre">portal.log</span></code> will show you various networking-related information. This is a good place to check
for odd or unusual types or amounts of connections to your game, or other networking-related
issues– like when users are reporting an inability to connect.</p></li>
<li><p><codeclass="docutils literal notranslate"><spanclass="pre">server.log</span></code> is the MUX administrator’s best friend. Here is where you’ll find information
pertaining to who’s trying to break into your system by guessing at passwords, who created what
objects, and more. If your game fails to start or crashes and you can’t tell why, this is the first
place you should look for answers. Security-related events are prefixed with an <codeclass="docutils literal notranslate"><spanclass="pre">[SS]</span></code> so when
there’s a problem you might want to pay special attention to those.</p></li>
<h2>Disable development/debugging options<aclass="headerlink"href="#disable-development-debugging-options"title="Permalink to this headline">¶</a></h2>
<h2>Handle user-uploaded images with care<aclass="headerlink"href="#handle-user-uploaded-images-with-care"title="Permalink to this headline">¶</a></h2>
<p>If you decide to allow users to upload their own images to be served from your site, special care
must be taken. Django will read the file headers to confirm it’s an image (as opposed to a document
or zip archive), but <aclass="reference external"href="https://insinuator.net/2014/05/django-image-validation-vulnerability/">code can be injected into an image
file</a><em>after</em> the headers
that can be interpreted as HTML and/or give an attacker a web shell through which they can access
other filesystem resources.</p>
<p><aclass="reference external"href="https://docs.djangoproject.com/en/dev/topics/security/#user-uploaded-content-security">Django has a more comprehensive overview of how to handle user-uploaded
files</a>, but
in short you should take care to do one of two things–</p>
<li><p>Serve all user-uploaded assets from a <em>separate</em> domain or CDN (<em>not</em> a subdomain of the one you
already have!). For example, you may be browsing <codeclass="docutils literal notranslate"><spanclass="pre">reddit.com</span></code> but note that all the user-submitted
images are being served from the <codeclass="docutils literal notranslate"><spanclass="pre">redd.it</span></code> domain. There are both security and performance benefits
to this (webservers tend to load local resources one-by-one, whereas they will request external
resources in bulk).</p></li>
<li><p>If you don’t want to pay for a second domain, don’t understand what any of this means or can’t be
bothered with additional infrastructure, then simply reprocess user images upon receipt using an
image library. Convert them to a different format, for example. <em>Destroy the originals!</em></p></li>
<p>Though not officially supported, there are some benefits to <aclass="reference internal"href="Apache-Config.html"><spanclass="doc">deploying a webserver</span></a>
to handle/proxy traffic to your Evennia instance.</p>
<p>For example, Evennia’s game engine and webservice are tightly integrated. If you bring your game
down for maintenance (or if it simply crashes) your website will go down with it. In these cases a
standalone webserver can still be used to display a maintenance page or otherwise communicate to
your users the reason for the downtime, instead of disappearing off the face of the earth and
<p>Proper webservers are also written in more efficient programming languages than Python, and while
Twisted can handle its own, putting a webserver in front of it is like hiring a bouncer to deal with
nuisances and crowds before they even get in the door.</p>
<p>Many of the popular webservers also let you plug in additional modules (like
<aclass="reference external"href="https://en.wikipedia.org/wiki/ModSecurity">mod_security</a> for Apache) that can be used to detect
(and block!) malicious users or requests before they even touch your game or site. There are also
automated solutions for installing and configuring TLS (via <aclass="reference external"href="https://en.wikipedia.org/wiki/Let%27s_Encrypt">Certbot/Let’s
Encrypt</a>) to secure your website against hotspot and
