🤖 9 security tips that protect your website from hackers

You may think your website is not valuable enough to be the target of a hacker attack but, in theory, any site can have its security compromised at any time. Most attacks are not there to steal data or change the website layout, but to try to use the server as a spam relay or as temporary hosting, usually to store files of an illegal nature.

Another way of attacking compromised websites includes using their servers as a botnet or to mine bitcoins.

At the extreme, any website can even be hit by ransomware. So, to avoid these or other headaches, here are nine website security tips.

1. Keep your software up to date

It may seem obvious, but making sure you keep your software up to date is vital for your website's security. That also applies to the operating system or any software you are using to run your site, such as a CMS or a forum. When security holes are found in software, hackers tend to try to attack.

If you use a company's server (for example, the one that built your website), then you do not need to worry as much about applying security updates to the operating system, because those companies handle that task. If you use third-party software on your website, you should make sure you apply security patches.

Wordpress, Umbraco and many other CMS tools notify you of updates when you log in. You can also use tools that automatically notify you of any vulnerability found on your website.

2. Watch out for SQL injections

SQL injections are attacks that happen when an attacker gains access and manages to manipulate your website's database. If you use standard SQL, you can more easily (and without realising) introduce code that hackers can use to alter tables and obtain or delete data. It is simple to prevent this attack by always using parameterised queries; this tool is common in most web languages and is easy to implement.

3. Protect yourself from XSS attacks

Cross-site scripting (XSS) attacks inject malicious JavaScript into your pages, which then runs in users' browsers and can change the content of those pages, and even steal information and send it to the attacker. For example, if you allow comments to be shown on a website without prior validation, the attacker can submit comments that contain script tags and JavaScript, which can run in every other user's browser and steal their login cookie. That way, the attacker takes control of the accounts of each user who saw that comment. Always make sure no user can inject active JavaScript into your pages.

4. Pay attention to error messages

You should be careful about how much information you give in error messages. Show visitors only small failures, making sure you do not leak ‘secrets’ on your server (for example, API keys or database passwords). You also should not give too much detail, because that can more easily lead to complex SQL injection attacks. Show them only the information they really need.

5. Do not forget double validation

Validation should always be done in the browser and on the server. The browser can catch simple faults, such as required fields that are empty or text entered in a numbers-only field; however, attackers can bypass these security measures, so make sure you also have validation on the server. That way you stop hackers inserting malicious code into the database or causing problems on the website.

6. Check your passwords

Everyone knows passwords should be complex and hard to crack, but that does not mean everyone does it. It is crucial to use strong passwords on the server and in the website admin area, and to insist on strong passwords for users too. You can use sites such as: Bitwarden Password Generator to keep your password up to date and complex.

7. Avoid file uploads

Allowing users to upload files can mean a serious risk to your website, even if it is only a profile photo. Even if a file looks harmless, it can contain script that, when run on the server, fully exposes your website.

If you have a file upload form on the site, you should always be suspicious of its origin. If it is photographs, watch the file-name extension, because this kind of file can easily be faked. Most image formats allow a comment that can contain PHP code and be executed on the server.

To prevent this problem, you can simply not allow uploads. By default, web servers do not allow files with image extensions to be executed, but that is not enough to stop attacks, from files named image.jpg.php, for example.

If you allow file uploads, use only secure transport methods, such as SFTP or SSH. Finally, do not forget how important it is to restrict physical access to the server.

8. Use HTTPS

HTTPS is a security protocol used on the internet. It guarantees that users are in contact with the server they expect, and not with someone who can intercept or alter the content in transit. If you have anything your visitors want to keep private, it is also advisable to use HTTPS only to handle that data. That refers to banking or login data, for example. An attack on these fields can be used to intimidate a user and use their data to get into the website. For that reason it is always recommended to use SSL Certificates for your website.

9. Use security tools

When you think you have everything covered, it is time to run a test of your website's security. The best way to do that is through security tools. There are several products, paid or free, to help you with this task. They work from the scripts used by hackers, which let you test and explore the website's weaknesses.

After analysing the results, take precautions and secure your website and users.

Looking to run a security audit on your website? Contact us today! Security is one of our priorities and also one of our core businesses!