How to secure your website! 09-10-2013, 06:31 AM
#1
How to secure your website (Tips, Tricks, and more!)
This thread will NOT guarantee that your site will never be exploited, hacked, or anything of that sort. These are just a few ideas to help you secure your website. Some of these are logical, some of these you may not think of, but a little difference can save your site.
Secure your details: by securing your details and information, you can prevent anyone from gaining access to files, pages, etc that they shouldn't. DO NOT share any passwords for your server, whether it be for your FTP Server, your cPanel, your hosting account, your Admin Control Panel, or your MySQL Database. Anyone that gets their hands on this information can exploit it if given the opportunity (and most people probably will). It is smart to change the passwords for these every few days or weeks, keep the attacks guessing and never use the same password twice.
Your webserver: Protect your webserver properly, use your .htaccess file to prevent access to files you do not want accessed directly or files that could allow viewers to exploit your site. Disable PHP error reporting to prevent users from seeing valuable information, instead a method to inform you when an error is generated and deal with it yourself. Never, ever, Ever, EVER set file permissions to 777 on your server! This could allow your users to modify, delete, execute, etc. the files directly. This applies to your .htaccess, don't make your .htaccess readable to prevent your information from being leaked. Also, do NOT run your Apache Server under the user root! They could hack your Apache2 user and exploit your server. Lastly, disable all unnecessary PHP functions on your server to prevent unintended use on your server!
The Admin Control Panel: Most sites you guys run will probably have a built in Administration Control Panel to edit various things on your site, but if someone else was to gain access to it, this could be another problem for your site. Make sure you rename your Admin Control Panel directory to something that no one will guess, protect access to it via .htaccess and using a routine IP check to prevent anyone without an administrator IP from gaining even the slightest access to it. Force all your administrators to change their passwords every couple days/weeks to keep hackers on their toes and hide your administration link from public view. Do not, under any circumstances, give someone you do not trust with your life access to your Admin Control Panel.
Be Careful: If you think you can protect your webserver by doing all this, you're wrong. What you really need to be careful of is what you do on your server, what you upload, etc. Installing untrustworthy script and files on your server can lead to some serious disasters. Someone can upload shells on your server, backdoor it and create various problems, in the end, it all comes down to what you do with your server. Try getting Site-Lock to protect your website, they provide services to scan your website for malicious content. In the end, the security of your website and server comes down to you..
Worst Possible Scenario: Incase someone does attempt (or even succeed) at breaching your website or server, it's great to have security that will notify you of unauthorized logins and even to download backups (usually Daily and store 1-2 weeks). Getting alerted when your server or website it under attack is the best thing you can have happen in a scenario like this. Blacklist their IP, restore a backup (if anything was harmed, modified, or deleted), change all your passwords (maybe even your username), and if you have a good host, warn them of the attack and they can help you protect your site as well (only if it was a server attack, I suggest not bothering them if your website was hacked). Restrict SSH access on your server to properly secure it and get various rootkit checkers and notifiers when your server is being breached.
Choose a Good Host: Okay, I understand that you all probably think this is the dumbest point to make, but putting your faith in a good webhost that is the most important thing you can do. Avoid new, low budgeted, poorly presented, etc. Hosts that you find on community forums such as HackForums. I say this because when you use those hosts, you give them access to your whole website and you don't know who they are or if you can trust them. I'm not saying they will all be bad, but they probably won't be good (in the sense of experience). Even if they don't have bad intentions, their server security could lead to problems for you, and their lack of experience could be an even bigger problem. You may want to find webhosts that offer ACTUAL 24/7 support, not some support ticket system.. I am talking call-in, chats, and other forms of support. Then, incase your website is attacked or anything happens, you can contact them immediately and they can help you get back online.
If you have anything you want to add to this tutorial, post it here or PM me and I will add it if I think it's important. I will update this with various tutorials later.
Special Thanks:
Sydonay
This thread will NOT guarantee that your site will never be exploited, hacked, or anything of that sort. These are just a few ideas to help you secure your website. Some of these are logical, some of these you may not think of, but a little difference can save your site.
Secure your details: by securing your details and information, you can prevent anyone from gaining access to files, pages, etc that they shouldn't. DO NOT share any passwords for your server, whether it be for your FTP Server, your cPanel, your hosting account, your Admin Control Panel, or your MySQL Database. Anyone that gets their hands on this information can exploit it if given the opportunity (and most people probably will). It is smart to change the passwords for these every few days or weeks, keep the attacks guessing and never use the same password twice.
Your webserver: Protect your webserver properly, use your .htaccess file to prevent access to files you do not want accessed directly or files that could allow viewers to exploit your site. Disable PHP error reporting to prevent users from seeing valuable information, instead a method to inform you when an error is generated and deal with it yourself. Never, ever, Ever, EVER set file permissions to 777 on your server! This could allow your users to modify, delete, execute, etc. the files directly. This applies to your .htaccess, don't make your .htaccess readable to prevent your information from being leaked. Also, do NOT run your Apache Server under the user root! They could hack your Apache2 user and exploit your server. Lastly, disable all unnecessary PHP functions on your server to prevent unintended use on your server!
The Admin Control Panel: Most sites you guys run will probably have a built in Administration Control Panel to edit various things on your site, but if someone else was to gain access to it, this could be another problem for your site. Make sure you rename your Admin Control Panel directory to something that no one will guess, protect access to it via .htaccess and using a routine IP check to prevent anyone without an administrator IP from gaining even the slightest access to it. Force all your administrators to change their passwords every couple days/weeks to keep hackers on their toes and hide your administration link from public view. Do not, under any circumstances, give someone you do not trust with your life access to your Admin Control Panel.
Be Careful: If you think you can protect your webserver by doing all this, you're wrong. What you really need to be careful of is what you do on your server, what you upload, etc. Installing untrustworthy script and files on your server can lead to some serious disasters. Someone can upload shells on your server, backdoor it and create various problems, in the end, it all comes down to what you do with your server. Try getting Site-Lock to protect your website, they provide services to scan your website for malicious content. In the end, the security of your website and server comes down to you..
Worst Possible Scenario: Incase someone does attempt (or even succeed) at breaching your website or server, it's great to have security that will notify you of unauthorized logins and even to download backups (usually Daily and store 1-2 weeks). Getting alerted when your server or website it under attack is the best thing you can have happen in a scenario like this. Blacklist their IP, restore a backup (if anything was harmed, modified, or deleted), change all your passwords (maybe even your username), and if you have a good host, warn them of the attack and they can help you protect your site as well (only if it was a server attack, I suggest not bothering them if your website was hacked). Restrict SSH access on your server to properly secure it and get various rootkit checkers and notifiers when your server is being breached.
Choose a Good Host: Okay, I understand that you all probably think this is the dumbest point to make, but putting your faith in a good webhost that is the most important thing you can do. Avoid new, low budgeted, poorly presented, etc. Hosts that you find on community forums such as HackForums. I say this because when you use those hosts, you give them access to your whole website and you don't know who they are or if you can trust them. I'm not saying they will all be bad, but they probably won't be good (in the sense of experience). Even if they don't have bad intentions, their server security could lead to problems for you, and their lack of experience could be an even bigger problem. You may want to find webhosts that offer ACTUAL 24/7 support, not some support ticket system.. I am talking call-in, chats, and other forms of support. Then, incase your website is attacked or anything happens, you can contact them immediately and they can help you get back online.
If you have anything you want to add to this tutorial, post it here or PM me and I will add it if I think it's important. I will update this with various tutorials later.
Special Thanks:
Sydonay
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
