{"id":28635,"date":"2013-02-07T10:06:55","date_gmt":"2013-02-07T07:06:55","guid":{"rendered":"http:\/\/blog.superhosting.bg\/en\/?p=28635"},"modified":"2022-04-02T11:08:23","modified_gmt":"2022-04-02T08:08:23","slug":"website-security-in-10-steps","status":"publish","type":"post","link":"https:\/\/blog.superhosting.bg\/en\/website-security-in-10-steps.html","title":{"rendered":"How to improve your website security in 10 steps"},"content":{"rendered":"\n

Today, our hosting company SuperHosting.BG<\/a> launches a campaign under the code name Security<\/strong>! By adding blog posts and specific guidelines on our help page<\/a> we would like to achieve the best possible results together! This campaign focuses mainly on you and your websites. We rely on your questions and comments to “paint” together the whole picture of websites that are protected from external unauthorized access.<\/p>\n\n\n\n

Usually, we post tips under the “Support Tips<\/a>“, category in the end of each article. Today, we will break the pattern by mentioning the recommendation of our Tech team in the beginning: Prevention is the best protection!<\/strong> \ud83d\ude42<\/p>\n\n\n\n

Below you will find 10 important steps<\/strong> that we would like to take together:<\/p>\n\n\n\n

  1. Protecting the admin panel with additional username and password<\/a><\/li>
  2. Changing the “admin” username<\/a><\/li>
  3. “Bad” aspect of “good” passwords<\/a><\/li>
  4. Testing…<\/a><\/li>
  5. Subscribing for news from CMS developers<\/a><\/li>
  6. Regular backup<\/a><\/li>
  7. Plugins for additional protection<\/a><\/li>
  8. Most common reasons for security breaches on websites<\/a><\/li>
  9. WordPress and Joomla<\/a><\/li>
  10. From 1 to 9\u2026 and back!<\/a><\/li><\/ol>\n\n\n\n

    In the following section will look into the basic and most common methods for protection<\/strong> and security improvement<\/strong> of your website. It is not necessary to be a webmaster to cope with them… but if you implement them, you will surely get closer to a security master! \ud83d\ude42<\/p>\n\n\n\n

    Speaking of your successful online presence<\/strong>, let us begin with the fact that Content Management Systems (CMS<\/a>) are now the most popular and convenient way to get a website. You may build your website by yourself using the most user-friendly and free open-source systems \u2013 WordPress, Joomla!, Drupal, OS Commerce, e107, phpBB, etc. A web studio may also develop your website on their custom CMS. However, in this case they will take care of the security. This article aims at paying more attention to the open-source CMS<\/strong>, which security is mostly your concern\u2026
    <\/a><\/p>\n\n\n\n

    1. Protecting the admin panel with additional username and password<\/h2>\n\n\n\n

    Your website admin panel security can be accomplished in two ways, but they are used only if the new user registration option is disabled (as new users will not be able to access their accounts).<\/p>\n\n\n\n

    First option: Restricting access to the admin panel for specific IP addresses<\/h3>\n\n\n\n

    If you would like your admin panel to be accessed from your IP address only, you will have to place the following lines in the .htaccess file, located in the directory where login script is found:<\/p>\n\n\n\n

    Deny from All
    Allow from xxx.xxx.xxx.xxx<\/p>\n\n\n\n

    Note: You have to replace xxx.xxx.xxx.xxx with your IP address.<\/em><\/p>\n\n\n\n

    If you want to access the admin panel from another IP address, you should add one more line:<\/p>\n\n\n\n

    Allow from xxx.xxx.xxx.xxx<\/p>\n\n\n\n

    Second option: Protecting the admin panel with additional username and password<\/h3>\n\n\n\n

    In this case you may use “Password Protect Directories” option in cPanel<\/a>.<\/a><\/p>\n\n\n\n

    2. Changing the “admin ” username<\/h2>\n\n\n\n

    By default, usernames having admin rights of most open-source CMS are called admin, admi1, administrator<\/strong>, etc. They also have identical IDs<\/strong> in databases\u2026<\/p>\n\n\n\n

    Here it will be useful and helpful to change in the database the username name and\/or the ID<\/strong>! It’s easy, isn’t it!? \ud83d\ude42<\/a><\/p>\n\n\n\n\n\n

    3. “Bad” aspect of “good” passwords<\/h2>\n\n\n\n

    The issue concerning the passwords<\/strong> we use not only for our website, but also for our email, bank account, Facebook, Twitter, Google, etc., has gathered head!<\/p>\n\n\n\n

    Does it sound familiar to you? “I will use 123456 so that I do not forget the password\u2026 it is so easy, no one will ever guess that I use it\u2026”<\/p>\n\n\n\n

    But you are perfectly wrong! Worldwide statistics on people using such <\/strong>“difficult<\/strong>“ passwords<\/strong> is mind-blowing\u2026 – there are millions, billions of them. This strongly facilitates the job of malware or persons who, being willing to access your private data, use in their first attempts:<\/p>\n\n\n\n

    1111
    123456
    654321
    0000 \u0438 etc…<\/p>\n\n\n\n

    On behalf of the whole team we advise and recommend you to pay attention to passwords!<\/p>\n\n\n\n

    It is a good idea to change the default password, that has been set by the system during initial CMS installation and to choose a secure, strong and more complex password.<\/p>\n\n\n\n

    You have to change the password for the admin panel on a regular basis. You should use strong passwords, consisting of uppercase and lowercase letters, numbers, and special characters.<\/a><\/p>\n\n\n\n

    4. Testing…<\/h2>\n\n\n\n

    Sometimes when people want to test a feature, they set easy passwords. Later on, if they forget to delete it, third parties may guess their data, which means that unauthorized persons twill be able to manage the information.<\/p>\n\n\n\n

    Never set easy passwords<\/strong> even when you are in a hurry or would like to only create a test account!<\/a><\/p>\n\n\n\n

    5. Subscribing for news from CMS developers<\/h2>\n\n\n\n

    When an update\/new version or a security patch is released, these news are published on the official website of the CMS.<\/p>\n\n\n\n

    System versions consist of main versions, e.g. 1.5, 2.5, 2.9, 3.0, 3.1, etc. and subversions, e.g. 1.5.27, 2.5.9, 2.9.1, 2.9.2, 3.0.1, 3.1.1, etc. Subversions contain source code and security fixes, which have been omitted in the main version.<\/p>\n\n\n\n

    It is strongly advisable to update the CMS as soon as a new subversion is released. We also recommend you when a new main version is released NOT to update immediately, but to wait for the subversion.<\/p>\n\n\n\n

    This is the most effective protection against malicious attempts to your website.<\/p>\n\n\n\n

    Of great importance is to also update the installed plugins.<\/p>\n\n\n\n

    It is necessary to always keep up-to-date the additional applications, you use along with your CMS.<\/p>\n\n\n\n\n\n

    6. Regular backup<\/h2>\n\n\n\n

    We recommend you to use several backups!!!<\/strong> Please backup files and database of your website on regular basis. You may also use plugins to backup your database<\/a> directly in the administration panel. You may also backup through the cPanel<\/a> of your hosting account<\/a>.<\/p>\n\n\n\n

    \ud83d\udd17 How to Generate a Full Backup?<\/a> | Help<\/p>\n\n\n\n

    It will be great to adopt it as a habit just like your coffee in the morning! <\/strong><\/p>\n\n\n\n

    Before making any changes to your website you should always ensure yourself by generating a backup. It is also strongly advisable to generate backups and store them locally on your computer once or several times a week, depending on website and content.<\/p>\n\n\n\n

    Of course, we are taking care of the system backups, but their aim is to backup your backup! \ud83d\ude42<\/p>\n\n\n\n

    It is very important that you take responsibility<\/strong> for your website security and backups!
    <\/a><\/p>\n\n\n\n

    7. Plugins for additional protection<\/h2>\n\n\n\n

    There are a lot of plugins for additional protection<\/strong>, depending on the CMS. There are applications admin URL address change, add-on for a number of unsuccessful access attempts, after which the access to the website administration panel, etc. is blocked.<\/p>\n\n\n\n

    Here we pay attention to the fact that when using such extensions you should keep in mind that there may be a conflict with a specific plugin, module, component or theme on your website. Before installing and enabling an extension, it is strongly advisable to backup your website!<\/strong>
    <\/a><\/p>\n\n\n\n

    8. Most common reasons for security breaches on websites<\/h2>\n\n\n\n

    Here we will reveal the most common reasons for security breaches on websites, ways to improve security and prevent malicious access, as further information is available on our help page.
    <\/a><\/p>\n\n\n\n

    9. WordPress and Joomla<\/h2>\n\n\n\n

    Based on your inquiries and case studies we created 2 articles containing specific tips on how to improve the security of WordPress and Joomla websites, which are available on our help page:<\/p>\n\n\n\n