Controls and Tools to Secure a Website

How many times have you read “it’s unsafe” on the browser navigation bar? Or how many times have you read about a privacy policy of an online store “the site transfers data securely “? By now the word “security“in the web has become a fundamental piece, especially with the advent of the Law on GDPR.

Although it is mandatory now, as well as fundamental, many people who are approaching the development of an idea or a profession on the web neglect this aspect or do not know exactly how to make a secure site. Not only do they risk damage to the site resulting in a waste of time and money to restore, but in case of theft of user data even in some penalty.

The security of a website is a step to consider, together with the site Design and its development which can be done in professional animation web video companies. Not to mention the positioning on search engines: by now Google is able to label as “no secure” any website that does not have the SSL certificate. The penalization of the site is its natural consequence. And you will say: ” But how to make a secure site, how to verify everything? Hackers are computer geniuses! “. Well, it is true that there is no limit to computer security because the technologies are constantly renewed, but by applying a few simple actions you can make the work of hackers very difficult and make most of them desist.

How to make a secure site: what kind of attack can your website be submitted to?

As a first step, I want to explain some terms about the types of attacks that occur most on a site. The site can be attached with:

DoS: is an attack in which the server on which your site resides is subjected to a constant and expensive sending of data in order to saturate its resources and make it useless to users or administrators. Usually the attackers use botnets, or devices that have been taken possession of the owner without the knowledge through malware. The aim is to use them as a resource for attacking the site to be hit.

XSS Cross site Scripting: it is a very widespread type of attack, especially in recent times. There are various subtypes of this category, but in general the process is similar. It is about launching malicious code (usually JavaScript) from a user input or a link clicked by an email, in order to run a script that steals sensitive data from cookies or other data stored on the client side. Or it is used to alter the visualization of the site.

SQL Injection (Attack to the database): is to attack the database, usually with SQL code (the most common language among the systems database) using the form on the site interacting with the database itself. The end? Execute instructions that can extract information from the database or even delete it.

How to make a secure site: checks to verify the security status

When you want to check if your site is secure, there are a number of online services, some of which are free, allowing you to check for vulnerabilities. The service does nothing but simulate an attack in order to verify the weaknesses of the site. I’m not here to list all the services because the web is full of them. Just look for “website security check” and Google will display a series of sites where you can link your site and check it out. However I would recommend two of them all that are very reliable and free:

Sitecheck: This service checks malware and malicious code on the site. Obviously I state that these are services that communicate the presence or not of malware or anomalous code.

Scanmyserver: This is another good service that after free registration checks the site and sends a report via email. For a single site is free and if you need multi-site verification, there is a small sum payment.

However, if you discover a hacked site, unless you are a developer or a network expert, you should contact a professional. By communicating the outcome of the service, the professional in question can solve the vulnerabilities and also undertake prevention actions. The online services often also offer to solve the problems, obviously behind the payment of a fee.

How to make a secure site: 7 tools and actions “save life”

As I’ve just explained to you, checking through site security verification tools is important, but the most effective way to have your site as secure and secure as possible is to implement a set of good practices or tools that are used to make the site safe and be able to restore it in the event of an attack. Below you list the basic actions in order of complexity. Let’s start from the most immediate to some actions that require some notion of computer science:

Use complex passwords: this is the easiest action to do and still plays a fundamental role. Some hackers launch software or scripts that repeat the password check with a list of passwords contained in a file. So if the password is very complex, the algorithm can take a really large amount of time that could take it to stop the script or fail to find it because its list does not contain it

Do not use standard names for admin users: whether you have an application made from scratch or you use a frame work or CMS, many times an administrator user is created with standard names, such as admin or administrator. One of the first checks that the attacker will do will be to search among these names.

Lower the access level of the first database user: when the site is set, the admin is almost always created and obviously goes to the first position of the database. It is good practice to create an additional admin user and then lower the level of the first user to one with minimum permissions. This is because sometimes the hacker makes a search in the db. to find the user and password of the record with id 1 of the database. Spending time to enter the db. , access it but then discover that with that user cannot do anything will make him desist.

Use SSL certificates: by now it has become almost mandatory given the latest data protection laws and the modification of the Google algorithm. The SSL certificate allows the exchange of data on pages using an encrypted system. Use the https protocol.

Keep your systems up-to-date: make sure you always have the latest version of the programming language, the framework, the CMS, the libraries you use. Most updates are about security breach implementation, so it’s really important.

Create a backup of the site: this, even if it is not really a safety action, is still an action that saves you from economic damage and visibility. Always make a backup of both the site and the database. In case of violation or unusability of the site, you can always restore the situation. The frequency you decide, depending on how often you update the site.

If you are a programmer it is essential to avoid , as explained before, the XSS and the Sql Injection : if you are creating a site from scratch documented on the tools available in the programming language used that perform these practices If you use frameworks or CMS make sure they are implemented the related functions.

I hope that after this article you will be more attentive to the security of your site. Those described are basic checks and practices to keep in mind, as the topic of security is very important and deserves further study after reading this article, especially because it is always in constant evolution. Obviously using CMS like WordPress, Joomla or Prestashop most of the actions described above (and many others) can be done with the use of plugins that greatly facilitate the task.