网站管理 - 集成到主网站还是单独的部分？
从可用性的角度来看，在主网站上集成管理部分更好还是有一个单独的部分来管理内容更好？
任何想法都将不胜感激。
编辑：该应用程序是一个针对技术非常不友好的员工的 CMS。
From a usability perspective, is it better to integrate admin section on the main website or have a separate section to manage content?
Any thoughts are greatly appreciated.
EDIT: the application is a CMS for very non-techno friendly staff.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
恕我直言，这取决于您想要管理的项目和部分。
例如，对新闻帖子的评论应在网站本身中进行管理，方法是为每个评论显示一个“删除”链接按钮。 否则，模组将不得不在管理部分查找评论 => 不太用户友好。
但总的来说，我认为单独的管理部分通常对您的客户来说会更清楚。 您希望他们像普通用户一样查看该网站。
It depends on the project and part you want to administer, imho.
For example comments on newsposts should be administered in the website itself by showing a "delete" linkbutton for each comment. Otherwise the mods would have to look up the comment in the admin section => not very user friendly.
But in general I think a seperate admin section will usually be more clear to your client. You'd want them to see the site as a normal user would see it.
至少我建议将所有管理文件移动到一个单独的文件夹中。 这样，如果您使用 .NET 这样的平台，您可以通过基于角色和用户的 web.config 权限轻松控制文件夹访问。
将管理文件全部隔离后，您还可以轻松执行其他操作，例如，如果您决定稍后将它们移动到另一台服务器，则将其删除。 您也可以将它们排除在您的 robots.txt 文件中（尽管通过将其放入 robots.txt 文件中，您将告诉其他人此部分存在，并且机器人不必介意此文件）。
编辑：
考虑到你的问题，我觉得我的回答有点不切实际。 当然，从可用性的角度来看，内联编辑比进入单独的页面更容易，但每当我听说将管理员用户与普通用户混合在一起时，我的脑海中就会响起巨大的警钟。
我认为这取决于网站的功能以及它对您的员工的干扰程度。 他们在浏览网站时进行更改是否有意义？他们最终是否会对您的系统感到灰心，因为它迫使他们在流程中注入不必要的步骤？ 编辑需要多长时间？ 向管理员展示完全不同的界面是否有意义？ 我认为这个问题的答案需要更多地了解您想要完成的具体功能，并且会根据具体情况而有所不同。
At the very least I would recommend moving all your administration files to a separate folder. That way if you're using a platform like .NET you can very easily control folder access though role and user-based web.config permissions.
Having your administration files all segregated allows you to do other things easily too, like delete them if you decide to move them to another server later. Also you can exclude them in your robots.txt file (although by putting it in the robots.txt file you will be telling other people this section exists, and robots don't have to mind this file).
Edit:
I feel like my answer missed the mark a little considering your question. Of course in-line editing is easier than going to a separate page from a usability perspective, but whenever I hear of mixing admin users with regular users giant alarm bells go off in my head.
I think that it depends on the function of the site and how intrusive it will be to your staff. Does it make sense for them to make changes while browsing the site and will they eventually become discouraged with your system because it forces them to inject unnecessary steps into their process? How long will the edits take? Does it make sense to show a completely different interface to administrators? I think an answer to this question requires a lot more understanding of what specific function you're trying to accomplish and will vary on a case by case basis.
我从来不喜欢在主站点中添加管理页面。 似乎有人意外访问该网站的管理部分的风险太大了。 即使您一遍又一遍地检查安全性，也总是有可能发生意外的事情，并且清理起来会很混乱（修改了什么，谁访问了什么等等）。 在我看来，将其保留为一个单独的网站是最简单的方法。
I have never liked adding administration pages into the main site. It seems like it is too much of a risk from someone accidently getting access to the administration portion of the site. Even if you review the security over and over, there is always that possibility that something unexpected will happen, and it is a huge mess to clean up (what was modified, who accessed what etc. etc.). In my opinion keeping it as a seperate site is the easiest way to go.
虽然能够以特权用户身份登录站点的主要部分，然后单击页面的某些部分来编辑/更改它有一定程度的便利，但将其放在一个单独的区域。
While there is a level of convenience in being able to login to the main part of a site as a privileged user, and then clicking on parts of a page to edit/alter it, there is also a measure of security in having it in a separate area.
我发现网站上有一个专门用于管理任务的单独部分可以使任务更易于组织和使用。 只要看看 Wordpress（尤其是新的 2.7 版本）、Drupal（一个非常流行的 cms）和 Joomla（另一个非常流行的 cms）就可以了。 如果您想测试这些功能以了解为什么我认为单独的部分更好，您可以访问 www.opensourcecms。 com 并测试 Drupal 和 Joomla。
I have found that having a separate section of the website that is devoted specifically to administrative tasks makes the tasks easier to organize and use. Just look at Wordpress (especially the new 2.7 release), Drupal (a very popular cms), and Joomla (another very popular cms). If you would like to test these feature out to see why I think the separate section is better, you can go to www.opensourcecms.com and test out both Drupal and Joomla.
从可用性来看，集成度越高越好，但往往会严重增加复杂性。 如果您可以在发生操作的上下文中执行该操作，那么它总是最好的 - 锁定不良用户、修剪太大的日志等。但是，由于这些往往会产生显着的副作用，因此安全方面很多时候都胜过这一点出于恐惧。
我认为您需要考虑对将管理功能集成到应用程序中进行风险评估。
如果有人能够提升权限并获得管理功能的访问权限，会对系统产生什么影响。 如果每个用户都被恶意锁定 - 对网站、声誉、SLA 等造成损害？
管理员可以通过此部分执行哪些破坏性功能？ 删除大量数据？ 使应用程序崩溃？ 改变对用户/客户产生重大影响的成本？
管理功能是集成在应用程序中还是隔离到特定的管理功能中？
应用程序是否具有公共面孔，或者是否是假定安全的 Intranet？
我个人从来没有感到轻松地将管理部分与网站集成，因为担心由于我的无能或超出我控制范围的事情（例如不良默认值、未修补的漏洞）而导致安全漏洞。 然而，当客户写支票时，我倾向于做他们认为最好的事情。
From a usability, the more integrated the better but it tends to add severely to the complexity. Its always best if you can perform the action within the context in which it occurs - lock out a bad user, trim a log thats too big etc. however since these tend to have significant side effects the security aspect trumps this a lot of the time out of fear.
I think you need to look at doing a risk assessment with regards to integrating the administration capabilities right into the application.
What would be the implication for the system if someone were able to escalate privelages and gain access to the admin functions. if every user was locked out maliciously - damage to the site, the reputation, SLA etc?
What destructive functions can an admin perform from this section ? delete lots of data? crash the app? alter costs that have material impact on users/customers?
Are the admin functions integrated in the app or isolated into specific admin functions?
Does the application have a public face or is it an intranet that is assumed secure?
I personally have never felt at ease integrating the admin section with the site out of fear that a security breach caused by my ineptness or something beyond my control like bad defaults, unpatched exploit. However, when the client is writing the cheque I tend to do what they feel is best.
我来自可用性学院，它说“尽量减少猜测工作”。 那么，您从用户组会议中获得了哪些类型的信息？
请记住，您不是（我们也不是）系统的典型用户。 我们所说的任何事情都只是猜测。 更糟糕的是，这里显示的任何意见都可能不适合您的情况（但可能对他们所做的事情很棒）。 您对该怎么做有一个明智的意见的唯一方法是走出去并以明智的方式询问您的用户。
因为这是一个安全问题，所以您的一些用户组合应该是专门从事安全方面的人员。 仅仅因为它更容易使用并不意味着它是最合适的。
I come from the school of Usability that says "minimise guess work". So, what kind of information did you get from your user group sessions?
Remember, you're not (and we're not) typical users of your system. Anything we say is going to be a guess. What's worse is that any opinion shown here is likely to be ill informed for your situation (but probably awesome at what they do). The only way you'll have an informed opinion on what to do is by going out and asking your users in intelligent ways.
Because this is a security issue some of your user mix should be people who specialise in security. Just because it's easier to use doesn't mean it's the most appropriate.