Sensitive Files Summary
Admin panel files are served from the admin.nortonshop.net subdomain. The nginx deny rules described below are enforced on the admin subdomain server block. The main site’s /admin/ path 301 redirects to the admin subdomain.
| File | Contains | Protected by |
|---|---|---|
admin/users.json | Usernames, encrypted TOTP secrets, hashed recovery codes, WebAuthn credentials | Admin subdomain nginx deny rule + JSON catch-all |
admin/audit.json | Audit log of all admin panel actions (logins, saves, user management, server actions) | Admin subdomain nginx deny rule + JSON catch-all |
admin/.versions.json | Content version history (change descriptions, timestamps, users) | Admin subdomain dotfiles rule |
admin/.sessions.json | Active session tracking (hashed session IDs, masked IPs) | Admin subdomain dotfiles rule |
admin/.ip-salt | Random salt used for IP address hashing | Admin subdomain dotfiles rule + file permissions (600) |
admin/.ip-geo-cache.json | Cached IP-to-country lookups (keyed by hashed IP) | Admin subdomain dotfiles rule |
admin/drafts.json | Unpublished content drafts | Admin subdomain JSON catch-all |
admin/bip-39-english.txt | BIP-39 word list used for owner recovery phrase generation | Admin subdomain nginx deny rule |
admin/config.php | Encryption key, upload paths, domain config, API keys | Admin subdomain nginx deny rule (not in PHP whitelist) |
/var/www/secrets/.encryption-key | Auto-generated AES-256 key (migrated outside web root) | Outside web root + directory permissions (700) + file permissions (600) |
/var/www/secrets/.captcha-key | Contact form captcha HMAC secret | Outside web root + directory permissions (700) + file permissions (600) |
admin/.vapid-keys.json | VAPID key pair for web push notifications | Admin subdomain dotfiles rule |
admin/push-subscriptions.json | Push notification subscriber endpoints | Admin subdomain nginx deny rule + CDN deny rule |
admin/reset-totp.php | CLI-only reset tool | Admin subdomain nginx deny rule (not in PHP whitelist; also exits if not CLI) |
admin/migrate-secrets.php | CLI-only migration tool | Admin subdomain nginx deny rule (not in PHP whitelist; also exits if not CLI) |
admin/dev-server.php | Local dev router | Admin subdomain nginx deny rule (not in PHP whitelist) |
admin/webauthn.php | WebAuthn library | Admin subdomain nginx deny rule (not in PHP whitelist) |