8 Steps to Protect your Website

Website security is a major concern as of late as cyber-attacks are growing quickly by the number. As a small website or blog owner, you may believe that you don’t need to worry about your website, as there is no valuable content on it and you therefore will not be targeted. Regardless of how trivial the content on your website might be, you are still at risk. Taking preemptive action to protect your website can help prevent the need for spending money on data recovery, or trying to recovery from a total loss of your data.

Many hackers are interested in a website, not for stealing any data or corrupting the site, but rather to use it for some even more sinister purpose, like sending out spam mail, using the server to distribute illegal files or even for Bitcoin mining.

So, how do you protect your website from such attacks? Here are eight steps to take:

Keep everything up-to-date

This may seem fairly obvious, but it is one of the most fundamental and important steps to protecting your website. Always make sure that every last piece of software relating to your website is utilizing the latest version, especially any scripts or plugins. Many of these are open-source, which means anyone can analyze their source code and discover loopholes. These loopholes are one of the most common ways for hackers to gain access to your website and exploit it.

You can avoid this threat by simply keeping all your plugins, scripts, and platforms (such as WordPress) updated.

Security plugins

This one is dedicated to WordPress users.  In addition to keeping all of your software updated, it is crucial for a WordPress website to use security plugins in order to ensure maximum safety. There are plenty of security plugins available, both free and paid, that you can benefit from to keep your website secure.

Some of the most popular security plugins include SiteLock and Bulletproof Security. These plugins seal up potential deficiencies in the WordPress platform and provide an additional layer of security for your website.

Use HTTPS

In addition to using security plugins, you should also consider switching to HTTPS to further solidify the security of your website. Websites using the standard protocol for transporting data between the server and the client's browser, HTTP or Hypertext Transfer Protocol, are susceptible to hackers intercepting the data and using it maliciously. HTTPS makes the exchange of information through your website secure and impenetrable.

Using HTTPS is an absolute necessity if you either have an e-commerce-based website or one that deals with sensitive and private information from customers.

Choose the right web host

You may think that price is the most important aspect of choosing a web hosting provider, but there is so much more to consider. You could be setting yourself up for an attack if you simply go for the cheapest web hosting supplier rather than opting for one that you can trust. Look for reputable web hosting providers that offer features such as an SSL secure server (required for HTTPS), SSH Secure Shell Access, secure email support, a secure data center, regular backups, etc. If you are unsure of the technical aspects of secure data hosting, choose a provider that comes with recommendation. Venture Harbour conducted research comparing 53 different web hosting providers and narrowed down to providers it recommends.

Sneaky SQL injections

Yes, SQL injections are not only sneaky but can also be very nasty if a hacker manages to inject them into your website. Usually, these injections take place through the web forms that you use to collect information from your website’s visitors. If you do not put the necessary constraints on all the fields of a web form, hackers will be able to insert code into them which in turn, allows them to hack into your database and steal any sensitive information available.

A simple and easy way to protect your website from these injections is to always use parameterized queries. It will make sure that your website has specific parameters for queries and thus, hackers will struggle to enter their malicious code.

The mighty XSS attacks

These attacks are similar to SQL injections, in that hackers use web form fields to enter these. However, in terms of their nature, they are far more disastrous than SQL injections. XSS attacks (aka Cross-site scripting) refer to insertion of malicious script tags and JavaScript into your website, which can then spread itself across the accounts of all visitors who view the particular page it was inserted on.

As prevention against XSS attacks, make sure visitors do not have the privileges (or opportunity) to insert JavaScript or script tags anywhere on your website.

Passwords & protection

It is best to use the most complex passwords possible for all of your accounts, and especially for your website administrator’s account. Never use easy-to-remember passwords, as they are often easy to guess as well. Do not use words such as your child's name or your birthday as a password, as hackers can easily access this information.

Also, be sure that everyone who has access to your website uses a secure and complex password that is impossible to guess. A single user’s weak password can put your entire website and all its visitors’ accounts at risk.

Web security tools

Fortunately, there are special tools that can analyze the overall security level of your website. After you have taken all other security measures stated above, it is time to check the security of your website through one of these tools.

There are many of these tools available both as premium and freemium versions. Some of the most popular security tools include Netsparker, OpenVAS and SecurityHeaders.

Netsparker offers foolproof security against SQL injections and XSS attacks, however you can use any other security tool that performs similar actions.

By introducing and utilizing these 8 concepts, your website will be stronger and more apt to overcome a potential cyber-attack.

About Linda Firth As Director at LoveMyVouchers.co.uk, a large part of my role is to ensure that the website meets data protection requirements and is safe and secure for our users. Although these challenges are growing in complexity, it is more important than ever to ensure that adequate processes are in place to protect the data and security of visitors to the site.