Cyber-criminals are now focusing on websites rather than email. Anyone who runs a website has to worry about whether it's been infected with bad code, as bloggers Tony Hung of Deep Jive Interests and Josh Porter of Bokardo recently discovered.
With the power of micro-publishing comes the responsibility of making sure you're publishing only what you want to publish. But that takes some knowledge and some work.
What do you need to know and do about security? Here are a few basics with a focus on WordPress and Drupal.
Keep your content management system up to date. Responsible developers will provide patches or upgrades as soon as security holes become obvious. WordPress 2.5.1 is out and it includes a security fix. The latest version of Drupal, Drupal 6.2, includes an important security fix as well.
Hint: if you're a WordPress user, install the Automatic Upgrade plugin. It handles everything from backing up your files and database to putting your site into offline mode while the code is upgraded. With this plugin, you're much more likely to keep your sites up to date.
Use strong passwords for your admin and FTP logins. Don't pick one easy to remember password and use it everywhere. Also, don't just go with the passwords that your CMS generates for you -- change them immediately to something stronger. Drupal 6 includes a nice password strength checker that shows you how strong your password is as you type it in.
Consider using a password management program that will remember long, strong passwords for you. I like 1Password for OS X. Sam Dean of Web Worker Daily recommends PassKeeper for Windows users. Other people swear by KeePass; it's open source and available cross-platform as KeePassX.
Use SFTP or FTP-SSL when uploading files to your website. FTP and telnet use clear text to transmit login names and passwords -- someone could get FTP access to your web site just by watching your network communications.
Note that many cheap web hosts don't provide SFTP or FTP-SSL access. In that case, you may want to use a personal VPN such as OpenVPN so all your Internet communications are encrypted or at the very least change your FTP password frequently.
Protect your files using operating system permissions. The web server itself should only be able to read the vast majority of your files, not change or overwrite them. Yes, there are certain cases where the web server needs to be able to change files -- for example, if you allow users to upload avatars or if your CMS offers you the ability to edit theme files from the management console.
Most of your files should be owned and writable by the user you use to modify the code or pages for your site -- your FTP user for example.
Register yourself as the owner of a website with Google. Google may know long before you do if your website has been hacked. At Google Webmaster Central, you can tell Google what websites you own and verify that you own them, then Google will keep you up to date on what they know about your website. If your website gets hacked as Josh Porter's did, leading to your site's removal from Google indexing, Google will leave you a message about what's happened.
Educate yourself about security. That's one of my goals in writing this article -- to better understand the range of security vulnerabilities a website might have and to know what precautions I might take against them.
You might want to subscribe to Google's Webmaster Central blog via which you'll stay aware not just of security issues but also other important topics like SEO.
WordPress users, subscribe to the WordPress.org blog, where you'll hear about security patches and Wordpress upgrades as they become available. Drupal webmasters will want to subscribe to the security announcements and read the handbook section Writing secure code.
Do you have anything to add? Share in the comments.
Further reading
Recent comments
3 weeks 1 day ago
3 weeks 3 days ago