How to secure my web site

Friday, 08 January 2010

Securing your website is something that you definitely don't want to leave to chance.  Your website is constantly bombarded by hackers, all of whom are looking for the tiniest weakness that they can exploit.  Once a loophole is found, it can be used to steal not only your personal and private data, but your customers' personal and private data too.  So if peace of mind and online business credibility are important to you, you'll need to keep reading.

Secure your websites

First of all, you need to know your enemy.  Who are these hackers, and how do they work?  The main thing you need to recognize is that hackers have all the time in the world.  They can afford to spend days, weeks and even months, patiently working away at your website to find weaknesses.  They can do this because the processes they use are automatic, and you simply don't notice they're happening.  A lot of it is guesswork.  For example, they can take the cookies that your site produces and run through an infinite number of variations to see what effect that has.  They can work away at the source code of your site's pages, and set programs running to try and crack the authorization process.

Install CMS updates to secure your web site

The first thing you can do to defeat these attacks is to ensure that your content management system (CMS) is up to date.  Out of date software is software that hackers have already managed to breach, so you don't want it running on your system.  Drupal, Joomla, Wordpress and other major CMS providers continually test their systems for weaknesses, and update accordingly, so you should install these updates as soon as they appear.  This can usually be done automatically.

Be sure to change the default administrator user name and passwords on your CMS once it's installed.  Hackers know what these defaults are too!  It's an obvious thing to try if you're trying to break into someone's site, because it's amazing how many people overlook this simple security measure.  It's a bit like leaving your front door wide open  for burglars.

Another devious hacker trick is to use PHP error reporting to get information about your site.  If your error reporting level is set too high, a hacker can find out a lot about your site simply by studying the error reports.  If you turn off the error messages entirely, and set your PHP configuration so that it doesn't display errors even if one occurs, you will plug a major security leak.  If you feel unsure or nervous about doing this, ask your system administrator to do it for you.

You can also keep hackers out of your secure files by correctly setting the htaccess file.  A simple bit of code will secure the htaccess file itself, as follows -

<files .htaccess>
order allow, deny
deny from all
</files>

Use the same coding to secure any other files you don't want people to look at.  To do so, just replace .htaccess with the name of the file you're securing.

Finally, don't neglect the issue of passwords.  If you can guess it, a hacker will be able to guess it too, and they're running programs that can go through millions of combinations until they find the right one.  Use an online generator to help you create an uncrackable password.

Always remember that hackers, like burglars, are opportunists.  If you take the basic security measures to keep your website safe, a hacker will swiftly move on to a site that is less well protected.  Securing your website takes minutes, but gives you a lifetime of peace of mind.