As you already know, in the recent years there has been a rapid increase in numbers of great services and tools in the web development industry. Content management systems (CMS) like WordPress, Drupal, Joomla! and many others, allow us to quickly and efficiently build an online presence. Having a lot of highly extensible architectures, modules and extension ecosystems and powerful plugins, the CMSs have made the process of building a website much easier than ever.
Unfortunately, a lot of webmasters do not understand how to make secure their website, or even worse, the do not understand the importance of securing their website. Thus, we will share to you some steps all website owners should take in order to keep their website secure:
Update!
Many websites are compromised every day due to the insecure and outdated software used to run them. It is extremely important to update your website as soon as a new CMS version or plugin is available. The majority of hacking processes these days are completely automated. Bots are constantly scanning every website they can for exploitation opportunities. Therefore, it is not enough to update once a month or even once a week the software used to run your website because bots are very likely to find a vulnerability before you patch it.
Users Access
This rule could be applied only to websites that have multiple logins. It is important that every user has the specific permission they require to do their job. If they require suplimentary permissions momently, grant it, then reduce it once the job is complete. The concept is also known as “least privileged“.
Passwords
It is crucial to use powerful passwords to your website admin area and server, but equally also important to insist on good password practices for your users. Passwords should be random and very strong (12+ characters long). Do not let someone access your account just because they could find out your birth date or favorite food. Nowadays, password-cracking programs can guess millions of passwords in some minutes. Hence, every single password you use should be unique. Do not reuse passwords!
Backups
Making backups of your website is very useful, but keeping these backups on your web server is a big security risk. Why? Well… these backups may contain unpatched versions of your CMS and extensions which are publicy available, providing hackers easy access to your server.
SSL
SSL is mainly used for E-Commerce website security and websites that accept form submissions with Personally Identifiable Information (PII) or sensitive user data. The SSL certificate protects the visitor’s information in transit, which in turn protects the website’s owner from the fines that come along with being found noncompliant with PCI DSS.