Website security and protection - how to protect a website?

Website protection — how to protect and secure your website? Website security can be a complex (or even confusing) topic in an ever-changing environment. This guide is intended to provide a clear framework for website owners seeking to mitigate risk and apply security principles to their web properties.

Before we begin, it's important to keep in mind that security is never a "set it and go" solution. Instead, I encourage you to think of it as an ongoing process that requires constant evaluation to reduce your overall risk.

Applying a systematic approach to website security, we can think of it as a framework consisting of many layers of protection combined into one element. We need to look at website security holistically and approach it with a defense in depth strategy.

What is website security?

Website security is the measures taken to website protection from cyber attacks. In this sense, website security is an ongoing process and an integral part of website management.

Why is website security important?

For example, if a website is hacked and blacklisted, it can lose up to 98% of its traffic. Not having a secure website can be as bad as not having a website at all, or even worse. For example, leaking customer data can lead to lawsuits, heavy fines, and damaged reputations.

1. Defense in depth strategy

The defense in depth strategy for website security considers the depth of defense and the breadth of the attack surface to analyze the tools used in the stack. This approach provides a more accurate picture of today's website security threat landscape.

How web professionals see website security

We can't forget the statistics that make website security an attractive topic for any online business, regardless of size.
After analyzing over 1,000 survey responses from web professionals, some conclusions can be drawn about the security landscape:

Why sites get hacked

In 2019, there were over 1.94 billion websites on the web. This provides a vast playground for hackers. There is often a misconception about why websites get hacked. Owners and administrators often believe they won't get hacked because their sites are smaller and therefore less attractive to hackers. Hackers may choose larger sites if they want to steal information or sabotage. For other purposes (which are more common), any small site is of great value.
When hacking websites, various goals are pursued, but the main ones are:

2. Automatic attacks on websites

Unfortunately, automation reduces overhead, allows for mass disclosure, and increases the chances of a successful compromise—regardless of the volume of traffic or the popularity of the website.
In fact, automation is king in the world of hacking. Automated attacks often involve exploiting known vulnerabilities to affect a large number of sites, sometimes even without the knowledge of the site owner.

Auto attacks are based on opportunity. Contrary to popular belief, automated attacks are far more common than handpicked targeted attacks due to their reach and ease of access. Nearly 60% Internet runs on CMS.

CMS Security Issues

It's easier for the average website owner to get online quickly with an open source Content Management System (CMS) like WordPress, Magento, Joomla or Drupal and more.
While these platforms often provide frequent security updates, the use of third-party extensible components such as plugins or themes leads to vulnerabilities that can easily be exploited for attacks of opportunity.

The standard of information security is - Confidentiality, Integrity and Availability. This model is used to develop policies to secure organizations.

3. Confidentiality, integrity and availability

Now that we have some knowledge of automated and targeted attacks, we can dive into some of the more common website security threats.

Website vulnerabilities and threats

Here are the most common website security vulnerabilities and threats:

1. SQL injection - Such SQL injection attacks are carried out by injecting malicious code into a vulnerable SQL query. They rely on an attacker adding a specially crafted query to a message that a website sends to a database.
A successful attack will modify the database query so that it returns the information the attacker wants instead of the information the website expects. SQL injections can even change or add malicious information to the database.
2. Cross Site Scripting (XSS) Cross-site scripting attacks consist of injecting malicious client-side scripts into a website and using the website as a distribution method. The danger of XSS is that it allows an attacker to inject content into a website and change the way it is displayed by causing the victim's browser to execute code provided by the attacker when the page is loaded. If a logged in site administrator uploads the code, the script will be executed at their privilege level, potentially leading to a site takeover.
3. Brute Force Credential Attacks Gaining access to a website's admin panel, control panel, or even an SFTP server is one of the most common vectors used to compromise websites. The process is very simple:

4. Website malware infection and attacks By using some of the previous security issues as a means to gain unauthorized access to a website, attackers can:
5. DoS/DDoS attacks A distributed denial of service (DDoS) attack is a non-intrusive Internet attack. This is done in order to disable or slow down the target website by flooding the network, server or application with fake traffic.

E-Commerce Website Security and PCI Compliance

Payment Card Industry Data Security Standards (PCI-DSS) define requirements for website owners with online stores. These requirements help ensure that the cardholder data you collect as an online store is adequately protected. Under PCI DSS, cardholder data that must be protected refers to the full Primary Account Number (PAN), but may also appear in one of the following forms:

The PCI Compliance Rules apply whether you transfer data digitally, in writing, or communicate with another person who has access to the data.

It is very important for e-commerce websites to do everything in your power to ensure that cardholder data is transmitted from the browser to the web server with proper encryption over HTTPS. It must also be stored securely and similarly encrypted on the server when transmitted to any third party payment processing services.

Hackers can try to steal or intercept cardholder data at any time, whether the data is at rest or in transit.

Website security framework

Regardless of the size of your business, developing a security system can help reduce your overall risk. Understanding that security is an ongoing process means that it starts with building the foundation of a website's security. This structure will include the creation of a "safety culture" where scheduled inspections help keep things simple and timely.
Five functions: "Identify", "Protect", "Detect", "React" and "Recover" will be described in detail along with the actions to be applied.
1. To identify - at this stage, all inventory and asset management is documented and verified. Inventory and asset management can be taken one step further in the following subcategories:

Once you have a list of your website's assets, you can take steps to audit and protect each one from attacks.
2. Protect There are many reasons why having preventive web security measures in place is critical, but where do you start? These are known as security technologies and security levels. Sometimes these measures satisfy compliance requirements such as PCI or make it easier to virtually patch and harden environments that are vulnerable to attacks. Security can also include employee training and access control policies.
3. Detect (continuous monitoring) is a concept that refers to implementing tools to monitor your website (assets) and notify you of any problems. Monitoring should be installed to check the security status:
You can also use security scanners and tools (such as SiteCheck) to look for indicators of compromise or vulnerability.
4. To react — analysis and mitigation help to create a response category. When an incident occurs, there should be a response plan. Having a response plan in place prior to a compromise incident does wonders for the psyche. A proper incident response plan includes:
During the patching process, we never know in advance what kind of malware we are going to find. Some problems can spread quickly and infect other websites in a shared server environment (cross-infection). The incident response process, as defined by NIST, is broken down into four major steps:
A solid prep phase and a website security team you can rely on are critical to mission success. Here's what it should look like:

Preparation and planning

At this stage, we make sure that we have all the necessary tools and resources before an incident occurs. All of this goes hand in hand with the previous sections of the security framework.
Hosting companies play a crucial role at this stage by ensuring that systems, servers and networks are sufficiently secure. It's also important to make sure your web developer or tech team is ready to handle a security incident.

Discovery and analysis

Although there are several methods of attack, we must be ready to deal with any incident. Most infections are vulnerable components installed on the website (mainly plugins), password compromises (weak password, brute force) and others.
Depending on the problem and intent, the discovery phase can be complex. Some attackers are looking for fame, others may want to exploit resources or intercept sensitive information.
In some cases, there is no indication that a backdoor has been installed, waiting for an attacker to access it for malicious activity. Therefore, it is highly recommended to implement mechanisms to ensure the integrity of your file system.

Containment, eradication and restoration

As for the Containment, Elimination and Recovery phase, the process should adapt to the type of problem found on the website and the pre-defined attack-based strategies. For example, a cryptominer infection typically consumes a lot of server (leecher) resources, and the incident response team must contain the threat before starting the remediation process.

Containing this attack is an important step to prevent additional resource depletion and further damage. This decision making system and strategies are an important part of this phase. For example, if we identify a particular file as 100% malicious, there should be an action to destroy it. If the file contains partially malicious code, only that part should be removed. Each script must have a defined process.

Actions after the incident

Last but not least, Post-Incident Action can also be referred to as the Lessons Learned stage. At this point, the incident response team should submit a report detailing what happened, what actions were taken, and how well the intervention worked. We must reflect on the incident, learn from it and take action to prevent similar problems in the future. These actions can be as simple as updating a component, changing passwords, or adding a website firewall to prevent attacks at the edge.

Review the actions your department needs to take to further strengthen security. Then make sure you take these actions as quickly as possible. You can base all further actions on the following tips:

Also, if you are actively using Web Application Firewall (WAF), review your existing configuration to determine any changes that need to be made. Keep in mind that while WAFs help meet several Payment Card Industry Data Security Standards (PCI DSS), they are not a panacea. There are other factors that can affect your business, especially the human factor.
5. recover — recovery planning will occur when a full analysis of all stages in the event of an incident is carried out. Recovery is also linked to having a backup plan for situations where all previous steps failed, such as ransomware attacks.

This process should also include arranging time to talk with your security vendor about how to improve weak spots. They are better equipped to offer insight into what can be done.

Have a communication strategy

If any data is at risk, let your customers know. This is especially important if you are doing business in the EU, where an organization must report a data breach within 72 hours in accordance with Article 33 of the General Data Protection Regulation (GDPR) .

Use automatic backup

No matter what you do to protect your website, the risk will never be zero. If the functionality of your website is damaged, you need a way to quickly restore data - not one, but at least two. It is extremely important to have a local backup of the entire application and an external backup that is not directly linked to the application in case of a hardware failure or attack.

How to protect your site and ensure security?

The importance of website security cannot be underestimated. In this section, we'll look at how to keep your website secure and protected. This is not a step-by-step guide, but it will provide you with website security recommendations to find the right services for your needs.
1. Update everything - Countless websites are at risk every day due to outdated and insecure software. It is important to update your site as soon as a new plugin or version of the CMS is available. These updates may simply contain security improvements or fix vulnerabilities.
Most attacks on websites are automated. Bots are constantly crawling every site they can for exploitation opportunities. It is no longer enough to update once a month or even once a week, because bots will most likely find a vulnerability before you fix it.
That's why you should use a website firewall that will practically close the security hole as soon as updates are released. If you have a WordPress website, one plugin you should consider is WP Updates Notifier. It sends you an email to let you know when a plugin or WordPress core update is available.
2. Have strong passwords Having a secure website depends a lot on your security. Have you ever thought about how the passwords you use can threaten the security of your site?
To clean up infected websites, remediators must log into the client site or server using their administrator user credentials. They may be surprised to see how insecure root passwords can be. With logins like admin/admin, you might not have a password at all.
Hackers will combine data from the network with dictionary word lists to generate even larger lists of potential passwords. If the passwords you use are on one of these lists, it's only a matter of time before your site is compromised.

Strong password recommendations

Recommendations for creating a strong password:

• Don't reuse passwords: each of your passwords must be unique. A password manager can make this task easier.
• Use long passwords. Try using more than 12 characters. The longer the password, the longer it will take for a computer program to crack it.
• Use random passwords. Password cracking programs can guess millions of passwords in minutes if they contain words found on the Internet or in dictionaries. If your password has real words, it's not random. If you can easily pronounce your password, it means that it is not strong enough. Even character substitution (i.e., replacing the letter O with the number 0) is not enough. There are several useful password managers such as LastPass (online) and KeePass 2 (offline). These tools store all your passwords in an encrypted format and can easily generate random passwords with the click of a button. Password managers allow you to use strong passwords without having to remember weaker ones or write them down.

3. One site = one storage Hosting many websites on one server may seem ideal, especially if you have an "unlimited" web hosting plan. Unfortunately, this is one of the worst security practices you can use. Placing multiple sites in one location creates a very large attack surface. You should be aware that cross-contamination is very common. This is when a site is negatively affected by neighboring sites on the same server due to poor server isolation or account configuration.
For example, a server hosting one site could have one WordPress installation with a theme and 10 plugins that could potentially be targeted by an attacker. If you host five sites on one server, an attacker could have three WordPress installations, two Joomla installations, five themes, and 50 plugins that could be potential targets. Even worse, once an attacker has found an exploit on one site, the infection can easily spread to other sites on the same server.

Not only can this cause all your sites to be hacked at the same time, it will also make the cleanup process a lot more time consuming and difficult. Infected sites can keep re-infecting each other, causing an endless loop.

Once the cleanup was successful, you now have a much more difficult task when it comes to resetting your passwords. Instead of one site, you have several. Every single password associated with every website on the server needs to be changed after the infection is gone. This includes all your CMS databases and File Transfer Protocol (FTP) users for each of these websites. If you skip this step, all websites may be re-infected and you will have to restart the process.
4. Restricting user access and permissions Your website code may not be the target of an attacker, but your users will be. Recording IP addresses and all activity history will be useful for forensic analysis later.
For example, a significant increase in the number of registered users may indicate a failure in the registration process and allow spammers to flood your site with fake content.

Principle of least privilege

The principle of least privilege is based on a principle that aims to achieve two goals:

Granting privileges to certain roles will dictate what they can and cannot do. In an ideal system, a role would stop anyone attempting to perform an action outside of what it was intended to do.
For example, suppose an administrator can embed unfiltered HTML in posts or run commands to install plugins. Is it a vulnerability? No, this is a feature based on one very important element - trust. However, should the author have the same privileges and access? Consider separating roles based on trust and lock out all accounts.
This only applies to sites with multiple users or logins. It is important that each user has the appropriate permission required to do their job. If you currently need extended permissions, grant them. Then scale it down once the job is done.

For example, if someone wants to write a guest blog post for you, make sure their account doesn't have full admin rights. The account should only be able to create new posts and edit their own posts because they don't need to change the website settings. Carefully defined user roles and access rules will limit any possible errors. It also reduces the number of compromised accounts and can protect against harm caused by fraudulent users.
This is an often overlooked part of user management: accountability and monitoring. If multiple people use the same user account and that user makes unwanted changes, how do you know who on your team is responsible?
If you have separate accounts for each user, you can follow their behavior by looking at logs and knowing their usual trends, such as when and where they usually visit a website. Thus, if a user logs in at an odd time or from a suspicious location, you can investigate. Keeping audit logs is vital to keeping track of any suspicious changes to your website.

Of course, manual audit logging may be difficult for some users. If you have a WordPress website, you can use the free Sucuri security plugin, which can be downloaded from the official WordPress repository.

File permissions

File permissions determine who can do what with a file. Each file has three available permissions, and each permission is represented by a number:

If you want to allow multiple permissions, just add the numbers together, for example, to allow read (4) and write (2), you set the user's permission to 6. If you want to allow the user to read (4), write (2) and do ( 1), then set the user permission to 7.

User types

There are also three types of users:

So, if you want the owner to have read-write access, the group to have read-only access, and the public to have no access, the file permission settings should be:
5. Change default CMS settings Modern CMS applications (although easy to use) can be challenging in terms of security for end users. By far the most common attacks on websites are fully automated. Many of these attacks rely on users having only default settings. This means that you can avoid a lot of attacks by simply changing the default settings when installing the CMS of your choice.
For example, some CMS applications are user-writable, allowing the user to install any extensions they want.
There are settings you can adjust to control comments, users, and the visibility of your user information. File permissions are another example of a default setting that can be enhanced.
You can change these defaults when you install the CMS or later, but don't forget to do so.
6. Choice of extension (plugins) Webmasters usually like the extensibility of CMS applications, but it can also be one of the biggest drawbacks. There are plugins, add-ons, and extensions that provide just about every functionality you can imagine. But how do you know which one is safe to install?

Choosing safe extensions (plugins) - the main security of the site

Here's what to look for when choosing extensions:

7. Have backups of your websites – in the event of a hack, website backups are critical to recovering your website from a major security breach. While it should not be considered a replacement for a website security solution, a backup can help recover corrupted files.

Choosing the Best Website Backup Solution

A good backup solution should meet the following requirements:
— First, they must be off site. If your backups are stored on your website's server, they are just as vulnerable to attack as anything else. You should store your backups off site because you want your backed up data to be safe from hackers and hardware failures. Storing backups on your web server is also a major security risk. These backups always contain unpatched versions of your CMS and extensions, giving hackers easy access to your server.
- Secondly, your backups should be automatic. You do so many things every day that having to remember to back up your website can be unthinkable. Use a backup solution that can be scheduled according to your website's needs.
To finish, have a reliable recovery. This means having backups of your backups and testing them to make sure they actually work. You will need multiple backups for redundancy. By doing this, you can recover files from before the hack.
8. Server Configuration Files - Check out your web server configuration files: Apache web servers use .htaccess file, Nginx servers use nginx.conf, Microsoft IIS servers use web.config.
The server configuration files, which are most often located in the web root directory, are very powerful. They allow you to enforce server rules, including directives that increase the security of your site. If you're not sure which web server you're using, run your website through Sitecheck and go to the "Website Details" tab.

Site Security - Web Server Best Practices

Here are some guidelines that you can add for a specific web server:

• Deny access to directories: This prevents attackers from viewing the contents of every directory on the website. Limiting the information available to attackers is always a useful security measure.
• Image Hotlink Prevention: Although not strictly a security improvement, it prevents other websites from displaying images hosted on your web server. If people start hotlinking images from your server, your hosting plan's allowable bandwidth can quickly be used to display images for someone else's site.
• Confidential File Protection: You can set rules to protect specific files and folders. CMS configuration files are one of the most important files stored on a web server because they contain database login information in plain text. Other places, such as administrative areas, may be blocked. You can also restrict PHP execution to directories containing images or allowing uploads.

9. Install an SSL certificate — SSL certificates used to encrypt data in transit between a host (web server or firewall) and a client (web browser). This helps ensure that your information is sent to the correct server and is not intercepted.
Some types of SSL certificates, such as the Organizational SSL Certificate or Extended Validation SSL Certificate, add an extra layer of trust because the visitor can see your organization's details and know that you are a legitimate person.
As a website security company, we must educate webmasters and make them aware that SSL certificates do not protect websites from attacks and hacks. SSL certificates encrypt data in transit but do not add a layer of security to the website itself.
10. Install scanning and monitoring tools - control every step to ensure the integrity of the application. Alert mechanisms can reduce response time and reduce damage in the event of a breach. Without checks and scans, how do you know if your site has been compromised?
Logs of at least a month can be very useful in detecting application crashes. They will also show if the server is under DDoS attack or if it is under unnecessary load. Record and regularly review all activities that occur in critical parts of the application, especially (but not exclusively) administration areas. An attacker might try to use a less important part of the site for a higher level of access later.
Be sure to create triggers to notify you in the event of a brute-force attack or an attempt to use any of the site's features, including those not related to authentication systems. It is important to regularly check for updates and apply them to make sure you have the latest security patches installed. This is especially true if you do not enable the web application firewall to block attempts to exploit the vulnerability.
11. Follow personal safety guidelines - protecting your personal computer is an important task for website owners. Your devices can become an infection vector and lead to your site being hacked.
A good website security guide mentions scanning your computer for malware if your website has been hacked. Malware is known to infiltrate from an infected user's computer through text editors and FTP clients.
You must remove all unused programs from your computer. This step is important because these programs can also have privacy issues, just like unused plugins and themes on your website.
If something is not installed, it cannot become an attack vector for infecting your machine, especially a browser extension. They have full access to websites when webmasters are logged into their admin interfaces. The less you have installed on your computer, the better.
If you're unsure about the purpose of a particular app, do a little research online to see if it's needed or something you can remove. If you don't intend to use it, remove it.
12. Use a website firewall - Using only SSL certificates is not enough to prevent an attacker from accessing confidential information. A vulnerability in your web application could allow an attacker to intercept traffic, send visitors to fake websites, display false information, hold a website hostage (ransomware), or wipe all of its data.
Even with a fully patched application, an attacker can also attack your server or network using DDoS attacks to slow down or disable a website. Web Application Firewall (WAF) is designed to prevent such attacks on websites and allows you to focus on your business.

Additional measures without a website

To protect your websites and make the Internet safer, use these free resources and tools.
1. Website Protection Tools - Here are some free website security tools:

1.1 SiteCheck is a free site-free check and malware scanner.
1.2 Sucuri Load Time Tester - check and compare website speed.
1.3 Sucuri WordPress Security Plugin - Audit, malware scanner and security hardening for WordPress websites.
1.4 Google Search Console - security alerts and tools to measure search traffic and website performance.
1.5 Bing Webmaster Tools - Search Engine Diagnostics and Security Reporting.
1.6 Yandex Webmaster - Web search and security breach notifications.
1.6 Unmaskparasites - checking pages for hidden illegal content.
1.7 Best WAF - comparison of the best firewalls for cloud web applications.

2. Additional Resources Here are some educational resources on website security:

2.2 Sucuri Labs - Threat research, malware signature database and statistics.
2.3 OWASP is an open source web application security project.
2.4 PCI Compliance Checklist - PCI Compliance Checklist.
2.5 SANS Institute - training, certification and research in the field of information security.
2.6 NIST - National Institute of Standards and Technology.

Frequently Asked Questions About Website Security

Why is website security important?

Website security is vital to keeping a website online and safe for visitors. Without proper attention to website security, hackers can take advantage of your website, disable it, and affect your online presence. The consequences of a website hack can include financial loss, brand reputation issues, and low search engine rankings.

What are the security risks for a website?

The main website security risks include: vulnerable code, poor access control, and server resource usage. For example, DDoS attacks can render a site inaccessible to visitors in minutes. There are many reasons why websites get hacked; a weak password or an outdated plugin can lead to a site being hacked.

What makes a site secure?

A web application firewall is activated on a secure website to prevent attacks and hacks. It also follows website security best practices and has no configuration issues or known vulnerabilities. You can use SiteCheck to see if a website has a firewall, any security anomalies, malware, or is blacklisted. SiteCheck to see if a website has a firewall, any security anomalies, malware, or is blacklisted.

Do I need security for my site?

Yes, sure. Website security is not included in most web hosting packages. Website security is the responsibility of the website owner. Security should be one of the first considerations when setting up a website and an ongoing verification process. If a website is not secure, it can become easy prey for cybercriminals.

How to make my site secure?

You can protect your website by following website security best practices, such as:

• Use a website firewall.
• Always use the latest version of the site's CMS, plugins, themes, and third-party services.
• Maintain and use strong passwords.
• Provide only the type of access that someone needs to complete a task.
• Install scanning and monitoring tools to ensure the integrity of your website.
• Install SSL certificates for data encryption.
• Keep backup copies of websites.

Thank you for reading Nicola Top