Securing a trading platform: a lockdown checklist

[FXS London Scalper]

Trading platforms often get set up once and never reviewed. A short checklist, worth going through before something looks wrong rather than after:

• Separate MT5 installations for live and demo, in different folders. No shared profiles, so a test EA can't end up on a live chart.
• "Allow DLL imports" off globally, on only for the single EA that needs it.
• Investor password shared with nobody unless needed, trading password unique and stored in a password manager.
• Two-factor authentication on the broker's client area, where offered.
• VPS login with a key instead of a password, and RDP not exposed on the default port.
• A weekly one-minute check of the Experts tab and the list of attached EAs.

The most common scare is finding an EA attached that you don't remember adding. Usually it was added on a test profile and forgotten, but the only way to be sure is to have a setup where that can't happen silently.

Also keep a note of which EAs should be running where, so the weekly check has something to compare against.

None of this is complicated. What does your platform security routine look like?