7 Easy Steps that Protect Your Website From Hackers
As a website owner, is there anything more terrifying than the thought of seeing all of your work altered or entirely wiped out by a nefarious hacker?
You’ve worked hard on your website (and your brand) – so take the time to protect it with these basic hacking protections!
In addition to regularly backing up your files (which you should already be doing, for various reasons), taking the following seven easy steps will help keep your website safe:
Step #1: Keep platforms and scripts up-to-date3
One of the best things you can do to protect your website is to make sure any platforms or scripts you’ve installed are up-to-date. Because many of these tools are created as open-source software programs, their code is easily available – to both good-intentioned developers as well as malicious hackers. Hackers can pore over this code, looking for security loopholes that allow them to take control of your website by exploiting any platform or script weaknesses.
As an example, if you’re running a website built on WordPress, both your base WordPress installation and any third-party plugins you’ve installed are potentially vulnerable to these types of attacks. Making sure you always have the newest versions of your platform and scripts installed minimizes the risk that you’ll be hacked in this way and usually takes very little time to do.
WordPress users can check this quickly when they log in to their WordPress dashboard. Look for the update icon in the top left corner next to your site name. Click the number to access your WordPress Updates.
Step #2: Install security plugins, when possible
Once you’ve updated everything, further enhance your website security with plugins that actively prevent against hacking attempts.
Again, using WordPress as an example, you’ll want to look into free plugins like iThemes Security and Bulletproof Security (or similar tools that are available for websites built on other content management systems). These products address the weaknesses that are inherent in each platform, foiling additional types of hacking attempts that could threaten your website.
Alternatively – whether you’re running a CMS-managed site or HTML pages – take a look at SiteLock. SiteLock goes above and beyond simply closing site security loopholes by providing daily monitoring for everything from malware detection to vulnerability identification to active virus scanning and more. If your business relies on its website, SiteLock is definitely an investment worth considering.
Step #3: Use HTTPS
As a consumer, you may already know to always look for the green https in your browser bar any time you’ll be providing sensitive information to a website. Most consumers know to recognize those five little letters as an important shorthand for security: they signal that it’s safe to provide financial information on that particular webpage.
If you have an online store, or if any part of your website will require visitors to hand over sensitive information like a credit card number, you have to invest in an SSL certificate. The cost to you is minimal, but the extra level of encryption it offers to your customers goes a long way to making your website more secure and trustworthy.
Step #4: Use parameterized queries
One of the most common website hacks many sites fall victim to are SQL injections.
SQL injections can come into play if you have a web form or URL parameter that allows outside users to supply information. If you leave the parameters of the field too open, someone could insert code into them that lets them hack into your database, which may well contain sensitive customer information, like their contact info or credit card numbers. Obviously that’s information it’s your duty to protect.
There are a number of steps you can take to protect your website from SQL injection hacks; one of the most important and easiest to implement is the use of parameterized queries. Using parameterized queries ensures your code has specific enough parameters so that there’s no room for a hacker to mess with them.
Step #5: Use CSP
Similar to SQL injections, cross-site scripting (XSS) attacks are another common foe site owners have to be on the lookout for. They occur when hackers find a way to slip malicious JavaScript code onto your pages which can then infect the pages of any visitors to your website that are exposed to the code.
Part of the fight to protect your site from XSS attacks is similar to the parameterized queries you use for SQL injections. You should make sure any code you use on your website for functions or fields that allow input are as explicit as possible in what’s allowed, so you’re not leaving room for anything to slip in.
Another handy tool you have to protect yourself from XSS is Content Security Policy (CSP). CSP allows you to specify the domains a browser should consider valid sources of executable scripts when on your page, so the browser knows not to pay attention to any malicious script that might infect your visitor’s computer.
Using CSP is simply a matter of adding the proper HTTP header to your webpage that provides a string of directives that tells the browser which domains are ok and any exceptions to the rule. You can find details on how to craft CSP headers for your website provided by Mozilla here.
Step #6: Make sure your passwords are secure1
This one seems simple, but it’s so important.
It’s tempting to go with a password you know will always be easy for you to remember. That’s why the #1 most common password is still 123456. You have to do better than that – a lot better than that.
Make the effort to figure out a truly secure password (or use HostGator’s password generator). Make it long. Use a mix of special characters, numbers, and letters. And steer clear of potentially easy-to-guess keywords like your birthday or kid’s name. If a hacker somehow gains access to other information about you, they’ll know to guess those first.And make sure everyone who has access to your website has similarly secure passwords. Institute requirements in terms of length and the type of characters that people are required to use so they have to get more creative than going with the standard, easy passwords they turn to for less secure accounts.
One weak password within your team can make your whole website more vulnerable, so set expectations with everyone who has access and hold yourself to the same high standard.
Step #7: Lock down your directory and file permissions
Now, for this final technique, we’re going to get a little technical – but stick with me for a moment…
All websites can be boiled down to a series of files and folders that are stored on your web hosting account. Besides containing all of the1 scripts and data needed to make your website work, each of these files and folders is assigned a set of permissions that controls who can read, write, and execute any given file or folder, relative to the user they are or the group to which they belong.
On the Linux operating system, permissions are viewable as a three-digit code where each digit is an integer between 0-7. The first digit represents permissions for the owner of the file, the second digit represents permissions for anyone assigned to the group that owns the file, and the third digit represents permissions for everyone else. The assignations work as follows:
- 4 equals Read
- 2 equals Write
- 1 equals Execute
- 0 equals no permissions for that user
As an example, take the permission code “644.” In this case, a “6” (or “4+2”) in the first position gives the file’s owner the ability to read and write the file. The “4” in the second and third positions means that both group users and internet users at large can read the file only – protecting the file from unexpected manipulations.
So, a file with “777” (or 4+2+1 / 4+2+1 / 4+2+1) permissions would then readable, write-able, and executable by the user, the group and everyone else in the world.
As you might expect, a file that is assigned a permission code that gives anyone on the web the ability to write and execute it is much less secure than one which has been locked down in order to reserve all rights for the owner alone. Of course, there are valid reasons to open up access to other groups of users (anonymous FTP upload, as one example), but these instances must be carefully considered in order to avoid creating a security risk.
For this reason, a good rule of thumb is to set your permissions as follows:
- Folders and directories = 755
- Individual files = 644
To set your file permissions, log in to your cPanel’s File Manager or connect to your server via FTP. Once inside, you’ll see a list of your existing file permissions (as in the following example generated using the Filezilla FTP program):
The final column in this example displays the folder and file permissions currently assigned to the website’s content. To change these permissions in Filezilla, simply right click the folder or file in question and select the “File permissions” option. Doing so will launch a screen that allows you to assign different permissions using a series of checkboxes:
Source: https://www.hostgator.com/blog/3-easy-steps-that-protect-your-website-from-hackers/
