# Security Recommendations

#### [Web Server Redirect Rules](Web+Server+Redirect+Rules)

Web server redirect rules are critical to prevent unauthorised access to your SupportPal installation.

#### [Enable HTTPS](Enable+HTTPS)

`https` ensures encrypted transport of communication between your customers and your server. It's required by several third party integrations and will also improve consumer confidence in your web site.

#### Change The Default Operator URL

 Change the default operator panel URL prefix from *admin* to something that only your staff know. The prefix can be updated using the *Settings > Admin Folder* field in the operator panel.

#### [Configure HTTP Headers](Configure+HTTP+Headers)

Configure additional HTTP headers to improve the security of your installation.

#### [Moving the `storage/` directory](Storage+Directory)

The `storage/` can be moved outside the web root directory to prevent unauthorised access to its contents via the web.

#### [Restricting Public Access](Restricting+Public+Access)

SupportPal expects public access to your installation. If you intend to restrict access find out about the limitations.

#### Cross-Origin Requests (CORS)

 By default, cross-origin requests are permitted from any domain. Set the `CORS_ALLOWED_ORIGINS` environment variable to a comma-separated list of origins to restrict cross-origin requests to specific domains (e.g. the sites where the chat widget is embedded). Wildcards can be used, eg `*.mydomain.com`. Refer to [Updating Config Files](Updating+Config+Files) for guidance on how to set the environment variable.