Blog Header Banner

Archive for the ‘security’ tag

When is it Time to Upgrade to a Dedicated Server?   no comments

Posted at Feb 15, 2022 @ 9:00am dedicated servers

Dedicated Servers

For many clients just starting out with a website or a new business, a Shared Hosting solution or Virtual Private Server (VPS) is often enough to get off the ground. But, for many there comes a point when these solutions just aren’t enough.

The most obvious sign that it’s time for an upgrade is when your website has started regularly requiring more bandwidth or power than your current plan provides. Sure, this is kind of a no-brainer, but it’s a good idea to upgrade before you start running into trouble. If your site starts topping out the charts, it could temporarily go offline and that’s not good for business. Often we will see clients’ websites explode all of a sudden because they ran a special promotion or got some good press, and we will always work with them to make the transition to a dedicated server as seamless as possible. But, if you start seeing things getting busy, you can avoid a stressful situation with a preventative upgrade.

Another time an upgrade is a good idea is when a web application transitions out of beta or the development stage. While you’re working the bugs out of your application, a VPS can work fine. With just a few developers and beta testers in the system, a dedicated server would probably be overkill anyway. Once you release your application to the public, however, you’ll want to make sure you plan for the inevitable boom in traffic. Nobody wants their newly released project going down right out of the gate!

Regardless of the content of your website, if you’re worried about stability, dedicated servers are always the safest bet. Below you will find a summary of all the benefits a dedicated server provides (and how TurnKey Internet maximizes those benefits for our customers):

  • Speed and Performance: Server and network response times in a shared hosting environment depend highly on the activity of others with whom you share space and resources. With a dedicated server you have significantly faster response and page load times because all the systems resources (such as CPU, disk, RAM and network bandwidth) are controlled and utilized solely by the applications on your server.
  • Reliability: With a dedicated hosting environment, you have unlimited access to the operating system, server resources and software applications. This gives you a reliable way to manage the needs of your website and database system: it’s all there when you need it. If a neighbor causes a problem by over using resources, it will not impact your website or your business.
  • Security: Dedicated servers provide better security than any other form of hosting since you are the only one with the root “administrative” access to your resources (disk, CPU, RAM, etc.) and can configure customized security policies server-wide such as firewall protection, user-level permissions and even restrict the types of applications that run on the server. With other forms of hosting, such as shared hosting, the neighbors you share space with could jeopardize the security of your web and database systems.
  • Customization and Flexibility: Dedicated Servers offer unlimited customization and flexibility to meet your hosting application needs. You have access to fine tune and optimize all aspects of the server such as custom versions of Apache, PHP, MySQL, Perl/CGI or custom database configurations to suit your application needs, providing substantial performance gains over any other form of hosting. You maintain full root ‘administrator’ access to the server and can install, remove, or modify any applications you wish. If you need even more power behind your hosted application, TurnKey can customize your server with additional RAM, disk and bandwidth to suit your needs or provide you with advanced enterprise level solutions such as clustering, virtualization, load balancing and mirroring of your dedicated server.
  • Easy-To-Use-Software: TurnKey Internet offers easy-to-use, pre-installed and pre-configured hosting applications for your web, database and mail system needs. If you know how to use a web browser, you are ready to use a TurnKey Dedicated Server with your choice of control panel, such as cPanel or Plesk. You can even select your choice of Operating System, such as Linux or Windows.
  • Multiple Domains: Dedicated servers provide a cost-effective and management-friendly solution to multiple domain hosting. Rather than dealing with the burden of numerous accounts on shared hosting servers, you can host a virtually unlimited number of domains on a single dedicated server. With our server management software, it’s easy to create, manage and delete accounts whenever you want, and all from one interface.
  • Worry-Free Operation: TurnKey Internet provides Fully Managed Solutions to ensure you don’t have to worry about your server and can keep your focus on running your business. From offsite backups to managed Firewall and Security monitoring, TurnKey takes care of everything for you.


As you can see, dedicated servers are the best solution for those that are serious about their website or business and want the assurance that hardware, software and resources are dedicated exclusively to them. If you are considering hosting numerous domains, a high traffic site, an e-commerce site, reselling hosting to others, have sensitive data contained in your site or simply want more speed, power and control, it’s time to upgrade to a dedicated server. For more information visit www.turnkeyinternet.net/dedicated-servers

Follow Us : Facebooktwitterlinkedinyoutubeinstagram
Share : Facebooktwitterredditlinkedinmail

Written by David Maurer on February 15th, 2022

Tagged with , , , , , , , , ,

Top 5 Benefits of a Dedicated Server   2 comments

Posted at May 12, 2021 @ 9:00am dedicated servers,Web hosting

Benefits of Dedicated Servers

Whether you’re an online business or an individual looking for more power, flexibility, and control over your web hosting solution, the answer for you may be a dedicated server. With a dedicated server, your business has exclusive use of that server’s resources. You also have the flexibility of customizing the server to meet your individual performance and security requirements. To fully understand why a dedicated server is the better solution for you or your business, let’s take a look at the top five benefits they provide.

 

1. Exclusive Resources

When using a dedicated server, every bit of power, storage, and bandwidth is exclusive to you and no one else. Not only will this give your business more room to work with and expand, it will also prevent issues with your site caused by other websites. For example, if you’re site is hosted on a shared server where there is another website that is being attacked or hogging up resources, this can affect the performance of your company’s site.

 

2. Dedicated IP Address

Each dedicated server comes with its own dedicated IP address. With shared hosting, your site may be sharing an IP address with multiple websites. If your website happens to share an IP with a site that spams or contains malware, this can cause multiple problems. Your website can end up getting blocked, your email rejected as spam, even your search results can be affected. Another thing to consider is whether or not you’ll be running an e-commerce or selling things on your site. If so, you will need to have an SSL for your site, which in turn requires a unique dedicated IP.

 

3. Customization

A dedicated server allows your business to customize the hardware and software based on your company’s unique needs. Things like CPU, Memory, Hard Drive, even the speed of the server’s network port, can all be customized and upgraded on dedicated servers. With shared hosting, you are limited to the software already installed on the server, and sometimes it may lack a requirement or feature your business needs. But with a dedicated server, you have full flexibility over which software the server runs, even down to the Operating System.

 

4. Better Access

Another downside of shared hosting is the lack of Administrative or root access to the server. This limitation affects what software you can install as well as the settings and options that you can configure on the server. This can greatly impact the potential of what you are able to do with your website. Another advantage of administrative/root access is the ability to better monitor and troubleshoot your website, with full access to the server’s logs.

 

5. Better Security

With a dedicated server, you have exclusive access and can dictate who shares that access. This allows you to better secure the contents on your server and alleviates the concerns of sharing a server with malicious or careless users. Also because you have full control over the server, you can better enhance and customize its security based on your unique needs.

 

Now if you’re worried that you’re not tech savvy enough to run your own dedicated server, consider the option of going with a Managed Dedicated Server solution, which will provide many additional benefits on top of what’s listed above. Also if cost is a concern, check out our latest Best Value Dedicated Servers. There are countless other advantages to using a dedicated server, however the 5 above are some of the most notable. So before you decide to host your website on a shared server, consider the added flexibility, reliability, and performance that only a dedicated server can provide.

For more information on Dedicated Servers, visit TurnKeyInternet.net or call 877-539-4638 to speak with our 5 Star rated Cloud Hosting experts.

Follow Us : Facebooktwitterlinkedinyoutubeinstagram
Share : Facebooktwitterredditlinkedinmail

Written by David Maurer on May 12th, 2021

Tagged with , , ,

10 Essential WordPress Security Tips   no comments

Posted at Aug 27, 2019 @ 9:00am Web hosting

wordpress security

Failing to protect your WordPress site from potential hackers could leave years of work vulnerable to attack. Malicious users know how to exploit vulnerabilities in unprotected sites, hijack files and plugins for their own use and sabotage functionality.

If you’re not doing all you can secure your site against attacks, it’s time to take action. Use these ten WordPress security tips as a starting point to lock out hackers and protect your web presence.

 

1. Obscure the Login Page

By default, WordPress users access their login pages via domain names followed by wp-login or wp-admin. Hackers know this and will immediately navigate to these pages when attempting to enter your site. Using a security plugin, you can change the URLs of login and user registration portals. Although this doesn’t prevent hackers from eventually finding these pages, it slows them down and may be frustrating enough to make them give up trying to access your site.

 

2. Choose Unique User Identification

Using “admin” as your administrator login name is like an open door for hackers. Your login should be distinct to your website and difficult to figure out. One way to ensure your login remains unique is to use the email associated with your WordPress installation instead of a username. Email addresses are harder to guess and offer better authentication for administrator logins.

 

3. Be a Password Juggler

There was a time when you could stick a few numbers on the end of your dog’s name and call it a reliable password, but in today’s volatile Internet landscape, you need much more than that. Use a password generator to create strong WordPress passwords, and change them on a regular basis. Good passwords include uppercase and lowercase letters, numbers and symbols in various combinations. The more complex your passwords, the more secure your site will be.

 

4. Enable Two-Factor Authentication

Many sites employ a two-step process to verify the identity of each user attempting to log in. Using the same method on your site means it will take a little longer for you to get to the dashboard, but it may prevent hackers from gaining access to your site. Two-factor authentication lets you choose a secret question or a special code to be after the initial password screen. Some methods use a one-time authentication message sent via text to ensure only authorized users can log in.

 

5. Install a Security “Watchdog”

Hackers need multiple attempts to get into your WordPress site, and plugins like WordFence alert you to this activity while locking down the site to prevent unauthorized access. Such security plugins act like gatekeepers, watching who tries to log in, sending alerts, checking for file changes and banning offending IP addresses. Reports of activity arrive in your inbox immediately and again in weekly summaries so that you can keep on top of any potential problems.

 

6. Control Other Accounts

Collaborative or corporate blogs require several user accounts, and this can pose a problem for security unless all users understand how to keep the site protected. Be selective when adding accounts, since every new login creates another potential point of vulnerability. Establish rules about password strength and how frequently passwords should be changed, and make sure each user has a distinct login name. Set individual user permissions at the lowest levels possible so that it’s difficult for hackers to do damage should additional accounts ever be compromised.

 

7. Use .htaccess to Hide Important Files

Editing the .htaccess file can change certain WordPress functions, including the level of security. With the right code, you can:

  • Disable directory listings to prevent unauthorized users from accessing file listings
  • Hide your wp-config file from malicious users
  • Set which IP addresses are granted administrative privleges
  • Block access to the PHP files for themes and plugins

Remember to back up the existing .htaccess file before making any changes.

 

8. Stay on Top of Updates

Themes, plugins and the WordPress core are updated regularly to fix known problems, including security issues. Before installing any plugin or theme, check the last time it was updated. Ensure the developers offer continued updates after installation, and stay away from pirated “free” versions of premium plugins.

Run updates as soon as you can to eliminate vulnerabilities. If you have trouble remembering to update or have a tendency to miss notifications, consider setting automatic updates to run on a routine basis.

 

9. Don’t Neglect “Spring Cleaning”

Make a habit of going through the plugins and themes stored on your WordPress site whenever you run updates. Delete anything you haven’t used in a while or have replaced with something more functional. You may be surprised how many plugins you’ve accumulated while building your site, and getting rid of unused ones eliminates vulnerabilities.

It’s also a good idea to clean up your database from time to time. Find a reliable database cleaning plugin and run it to remove old file versions and other outdated information. As a bonus, your site should load faster and run more smoothly without the extra files weighing it down.

 

10. Backup as Often as Possible

No matter how careful you are, there’s always a chance an enterprising hacker could break through your site’s defenses. Creating site backups safeguards all the information on your site, giving you a way to restore everything should your security measures ever fail.

Some hosting companies provide scheduled backups as part of their services, but it’s a good idea to also have your own plan in place. Use a backup plugin or make manual backups on a regular basis, and store the files in a secure place so that you know they’ll always be there if you need them.

WordPress site security isn’t a “set it and forget it” measure. After putting initial protections in place, it’s essential to continue monitoring activity and running updates. Keep an eye out for new, stronger security tools, and implement the best combination of plugins and code changes to prevent the majority of attacks.

  Follow Us : Facebooktwitterlinkedinyoutubeinstagram
Share : Facebooktwitterredditlinkedinmail

Written by David Maurer on August 27th, 2019

Tagged with , , ,

Email Phishing: Is Your Inbox Safe?   no comments

Posted at Apr 9, 2019 @ 9:00am Web hosting

phishing

When responding to an email or clicking a link, most people don’t think twice. Sending emails has become so common that users rarely consider the danger of phishing and other fraudulent activity. But those who are unaware of the threat are at an even greater risk, and it will likely be too late for them to take action by the time that they notice the problem. The key to avoiding this trap is to educate yourself and to remain vigilant at all times. Although disregarding safety for convenience is becoming common, it’s a pitfall that can have a lasting impact on anyone’s future.

Phishing is the process of posing as another person or as a company to deceive people into giving their personal information away, and criminals have been known to use emails as a way to reach their goals. Knowing about the threat is not always enough when your task is to keep yourself and your bank account safe, and the attack can occur at any time.

A user will be checking their email as they would on any other day. Suddenly, the user spots an email from the bank that asks the user to log in to the account to confirm a recent transaction. But the email was not from the bank, and the user’s information is now in the hands of an identity thief. If you don’t want to encounter this situation, then the following information will help.

 

Don’t Share Sensitive Information Through Email

In a common phishing attack, a criminal will pretend to be someone whom you trust to steal sensitive data. The email could appear as though it had been sent by a friend, boss or business contact, and you might be asked for your account information or pin number. But no credible business will request sensitive data in an email, so the request should be your first red flag.

Rather than sending personal details in an email, pick up your phone and call the company or the individual who requested the information. Although this step might seem a little time-consuming, it can save you from a lot of trouble.

 

Manually Navigate to Web Addresses

Long before sending you a fraudulent email, experienced criminals will put in the effort to clone the website of a bank or business. They will then send an email posing as your bank or another trusted entity, and you will be encouraged to click a link that will take you to a malicious website.

Although the content, logo and other details might appear identical to the real thing, any information that you send will be exposed. Avoiding this type of attack is not difficult. Simply open a separate web browser and manually navigate to the website that you intend to visit.

 

Look for Spelling Errors

Keep in mind that phishing attacks can come from any location on the planet, so a lot of fake emails are sent by those who don’t speak English as their first language. When someone from another country sends a fraudulent email, the message will often contain obvious spelling errors. Some people dismiss the spelling errors that they find, but they will likely have their personal information stolen as a result. Customer service agents can make mistakes, but using caution is the best way to avoid becoming a victim.

Also, even criminals who speak English fluently can make mistakes when typing an email. If you notice anything that seems odd, call the company or person from whom the email appears to originate and ask for verification. If the email is not legitimate, report it as spam and block the domain.

 

Don’t Trust Attachments

Downloading and running email attachments is a good way to get a virus or to have other malicious software installed on your device. In the past, hackers would use screen savers and free games to infect their victims, but hackers can even use Word and Excel documents to inflict damage. After a computer is infected, the malicious code will sometimes automatically email itself to everyone in the victim’s address book. If you want to avoid this problem, never download an attachment that you were not expecting.

 

Having your identity stolen can destroy your credit score, and some people are forced to wait years before they can reverse the damage. Nobody should overlook the threat of phishing, and you can never eliminate the risk entirely. But you can significantly reduce the odds of having your personal information exposed by keeping safety at the front of your mind. Protecting yourself will require some time and effort, but safeguarding your information is always easier than trying to pick up the pieces after an incident occurs. Those who focus on security when communicating online will follow these tips, but they will also use common sense to detect the signs of suspicious activity.

  Follow Us : Facebooktwitterlinkedinyoutubeinstagram
Share : Facebooktwitterredditlinkedinmail

Written by David Maurer on April 9th, 2019

Tagged with , ,

Effective Security Measures For Your Server   no comments

Posted at Feb 26, 2019 @ 9:00am Web hosting

If you run a server, especially for your business or organization, security should be a top priority. Whether the server exists to host files for a website or is networking computers for an office, it needs to be protected from malicious software, exploits and hackers. Failing to secure a server can lead to lost or corrupted data, damage to devices connected to the network and unauthorized individuals getting access to sensitive data. Below are various security measures that you can employ on your server that are extremely effective.

 

Review & Modify Default Settings

Programs running on your server, such as control panels (cPanel, Plesk), CMS (WordPress, Joomla, etc.) and even the operating system, contain various default settings  that need to be reviewed and if necessary modified. They include everything from preset usernames and passwords for admin access to default connection ports. Anything that is left as set up by the software manufacturer may be used as a way to gain easier access to a system. Even leaving the URL for admin access to a server or programs on the server can make it easier for hackers to get in. There are hacking tools that specifically scan websites and servers for default URLs and folders, so changing default login locations is important. On this same basis, it’s a good idea to make sure that directories are protected so that people cannot see their contents.

 

Active Monitoring

A critical requirement to properly managing a server is knowing what is happening with it at all times. Even the best security software cannot prevent all intrusions, and hackers are constantly figuring out new ways to exploit and circumvent security systems. Therefore, it’s important that activity on a server is always being monitored. Things that normally indicate a problem include incredibly high data transfer or processing power use as well as multiple failed login attempts. Brute force hacking involves trying to login to a system over and over again with different login and password combinations. In addition to draining system resources, it can also eventually allow a hacker to find a combination that lets them into your system. Real-time monitoring can help detect these issues and alert the appropriate people, and it can also shut down brute force login attempts.

 

Passwords & Permissions

Another important server security measure is to ensure that all passwords, especially the root and/or Admin passwords, are complex and that people are only given access to areas that they need to do their job. Aside from malice, giving an intern administrative access to databases could lead to major problems through simple error. It’s also recommended to change your passwords on a regular basis, even if they are robust.

There are a number of ways to tackle the issue of making sure passwords are complex enough, including using computer generated passwords or using passphrases. Computer generated passwords normally require certain characters, length and require a combination of upper and lower case letters; passphrases are combinations of words, and they tend to be easier to remember and more secure than passwords. There should also be a set time that passwords expire, which will require users on the network to change them on a regular basis.

Along with ensuring that people are only given access to parts of a server that they need to have, it’s important that permissions are updated when people leave a job or move to a different part of the company. This can be done with proper database management and doing occasional audits to ensure that access levels are appropriate.

 

Updates

One way that hackers get into many servers is by going through weak points that developers did not notice when creating an application or an operating system. This is why both computers and mobile devices need regular updates. Along with offering new options, updates close off back doors and holes in the security of software. Therefore, it’s important that all software hosted on your server is kept up to date. For web hosting servers, that means content management systems (CMS) such as WordPress, and the plug-ins the CMS uses must be kept current. Many operating systems and software applications can be set up to update automatically, but if you’re not comfortable with that, it’s important that you have some way of being notified when important changes are available.

 

For those of you who feel there’s just not enough time in your day to employ these server security measures, or if you just prefer someone else does it for you, at TurnKey Internet we got your back. We offer Fully Managed solutions, such as our Best cPanel Dedicated Server, that include Server Hardening. We’ll take care of securing and protecting your server so you can focus on running your business. For more information, visit https://turnkeyinternet.net/managed/

 

  Follow Us : Facebooktwitterlinkedinyoutubeinstagram
Share : Facebooktwitterredditlinkedinmail

Written by David Maurer on February 26th, 2019

Tagged with , , , , ,

Securing cPanel   no comments

Posted at Jun 20, 2017 @ 10:20am Web hosting

Securing cPanel

cPanel is one of the most popular web hosting control panels available today. With it’s user-friendly graphical interface and robust server automation tools, cPanel is designed to make web hosting as simple as possible. However, like many other popular applications, it can be vulnerable to potential security problems. To prevent your website from falling victim to hackers and malware, it is critical that you manage and routinely check your server’s cPanel security settings.

 

SSH

SSH or Secure Shell, is a common way users access their server or website remotely. Unfortunately, it also provides an entry point for hackers. Data sent through SSH is authenticated and encrypted to prevent outside manipulation, so malicious users can’t touch it unless they break through your security measures. The default port of 22 is the most common setting for SSH access. Changing it to another available port and implementing a security key for logins minimizes the risk of being hacked. Switch the settings from SSH1 to SSH2 for additional protection.

 

Firewall

A firewall lets users access cPanel while keeping unauthorized individuals out. ConfigServer Security and Firewall or CSF, is one of the most popular firewalls for cPanel. It scans the system on a regular basis and checks authentication logs to keep your site safe from hackers at all times. CSF also provides feedback on how to make your server more secure overall.

 

Brute Force Protection

Although a firewall can prevent hackers from gaining access to a website or server, it won’t stop them from trying to log in. Brute force protection is a feature of cPanel used to block IP addresses after multiple failed login attempts. Found under the ‘Security Center’ section, this option is easy to enable and customize. Use the IP Deny Manager to manually input IP addresses known to be malicious so that they’re never allowed to log on. You can customize the brute force option, known as cPHulk, by setting how many minutes the tool monitors for repeated logins, the maximum number of failed logins allowed and how long each IP ban stays in place.

 

Passwords

From your admin cPanel login to individual email accounts, every access point needs a strong, secure password. Longer passwords allow for more complex combinations of numbers, symbols and upper- and lower-case letters. Use a different password for accessing cPanel, FTP, email management and other secure areas, making sure none of them contain obvious information such as phone numbers or birthdays. If you have trouble coming up with enough different combinations, try an online password generator.

 

Automatic Updates

One of the easiest ways to keep cPanel secure is to enable automatic updates. Old versions of software, including cPanel, may contain security vulnerabilities hackers can use to access your server. Automatic updates ensure you’re always running the latest version of cPanel with any associated security patches and bug fixes. Go back and check once and a while to confirm updates are running as they should. If not, update manually and contact your web host to find out why the setting isn’t working.

 

Additional Settings to ‘Tweak’

While you’re taking care of the larger security issues in cPanel, make sure you don’t neglect less common settings. Open ‘Tweak Settings’ under Server Configuration to access an entire list of other possible security measures. With this checklist, you can:

• Help prevent the sending of unauthorized emails, including spam
• Shut down potential email attacks
• Block malicious referrals or redirects from hijacking your site
• Stop the generation of proxy domains
• Require IP validation for cookies
• Set up an additional security token for cPanel access

Enabling these additional cPanel security settings helps address any remaining vulnerabilities and keep hackers at bay. But, for those of you who feel there’s just not enough time in your day to employ these security measures, or if you just prefer someone else does it for you, at TurnKey Internet we got your back. We offer Fully Managed solutions that include Server Hardening. We’ll take care of securing and protecting your server and cPanel so you can focus on running your business.

For more information, visit https://turnkeyinternet.net/managed/

  Follow Us : Facebooktwitterlinkedinyoutubeinstagram
Share : Facebooktwitterredditlinkedinmail

Written by David Maurer on June 20th, 2017

Tagged with , , , , ,

The SSL POODLE that Bites – SSL 3.0 Issues for web sites   no comments

Posted at Feb 22, 2015 @ 11:20am internet security,Web hosting

PadlockWhen I say POODLE, what do you think of? Is it a fluffy dog? In most cases, I would be referring to the fluffy dog, but for this article, we will be focusing on a security vulnerability. I’m not sure if you’re aware, but if you’re currently using SSL version 3.0, you will need to perform some updates to your SSL daemon on your server. SSL stands for Secure Sockets layer. A SSL is what every ecommerce site should have. It allows for you to securely process payments through your website. In fact, if you’re taking orders from your clients, you should be using a SSL. SSL’s add another layer of security and trust for your clients. If you’ve not read my post on PCI compliance and you’re running an ecommerce site, you should read my post on PCI compliance here: (Insert link to PCI compliance post)

 

With SSL’s as with any piece of software on the internet, there are different versions. SSL version 3.0 is nearly 18 years, however, SSL version 3.0 is no longer secure and remains in widespread use across the internet. Nearly all browsers support SSL version 3, and in order to work around bugs, within HTTPS servers, browsers will retry failed connections with older protocol versions, including SSL 3.0. This retrying of failed connections within SSL v3, allows the POODLE exploit to be initiated. This POODLE exploit works due to the nature of the failed connections and allows for a possible leak of your customers data when processing orders. You can read more about the specifics of the attack here:

 

http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html

 

Browsers and websites should turn off SSLv3 in order avoid compromising users’ private data.  The most straight forward method is to disable SSL 3.0 entirely, which you can see how to do at the links below, however, this can cause a myriad of computability issues. Therefore, the recommend plan of option is to enable TLS_FALLBACK_SCSV. Using the links below, they will show you how to properly secure your servers SSL daemon. These options resolve the issue of retrying failed SSL connections. It also prevents hackers with knowhow from downgrading from TLS 1.2 to 1.1 or 1.0.

 

 

For WHM/cPanel servers –  https://documentation.cpanel.net/display/CKB/How+to+Adjust+Cipher+Protocols

 

For DirectAdmin servers – http://forum.directadmin.com/showthread.php?t=50105

 

For Plesk servers – http://kb.sp.parallels.com/en/123160

  Follow Us : Facebooktwitterlinkedinyoutubeinstagram
Share : Facebooktwitterredditlinkedinmail

Written by Jeremy on February 22nd, 2015

Tagged with , , , , , , ,

Is your wordpress web site under attack? Over 90,000 hacker bots may be knocking on your door!   no comments

Posted at Sep 12, 2014 @ 9:50am Web hosting

wordpress-site-attackHowdie do Turnkey Lovers,

 

I have a quick question for you, have you ever heard of wordpress? My guess is since you’re reading this blog, you’ve heard of wordpress any may even be using on your own website, but for those who are first time readers, I will give a brief overview. Here is a quick overview from WordPress.org:

 

WordPress is web software you can use to create a beautiful website or blog. We like to say that WordPress is both free and priceless at the same time. The core software is built by hundreds of community volunteers, and when you’re ready for more there are thousands of plugins and themes available to transform your site into almost anything you can imagine. Over 60 million people have chosen WordPress to power the place on the web they call “home” — we’d love you to join the family.

 

WordPress is one of the most popular site building pieces of software currently on the internet. Sure, you have Joomla which is almost the same as wordpress, but has slight differences with its configuration. For this article, however, we will be focusing purely on wordpress. As you can see in the overview above, over 60 million people have chosen to use wordpress  which is quite a large pool of users on the internet. Now, what if someone decided to launch an attack on wordpress based sites? They would have a pretty large base of users to attack and could affect hundreds or possibly, thousands of websites. Well, this attack has already happened and still running at this very instance.

 

On an off for the last few months, A botnet of over 90,000 machines, has been attempting to globally brute force and hack into wp-login.php which is the file that WordPress users use to login to WordPress. The attack is sending thousands of requests at one time to attempt to login to your WordPress installation via wp-login.php in an attempt to gain access to make it part of the growing botnet. To shed some light on what a bonet is, directly from Wikipedia:

 

botnet is a collection of Internet-connected programs communicating with other similar programs in order to perform tasks. This can be as mundane as keeping control of an Internet Relay Chat (IRC) channel, or it could be used to send spam email or participate in distributed denial-of-service attacks. The word botnet is a combination of the words robot and network. The term is usually used with a negative or malicious connotation.

 

Well, you may be wondering, if I have a site on a server with Turnkey Internet, how are my sites being protected?  Since day 1 of the wide scale attacks,  we’ve enabled a server wide ACL that blocks all access to wp-login.php unless the IP is whitelisted. This ACL or access control list, keeps the attack at bay. Due to the fact that the botnet is targeting wp-login.php directly, we can deney all access to users we specifically allow. When the attack runs, our servers return a 403 page and the attack moves on. You may be saying, “Sure, that works, but is there anything that I can do as a client on my end to help relieve the attack?’

 

Listed below is the recommended code that you add to your sites .htaccess file in your public_html folder to add an extra layer of security (you’ll need to edit ‘example.com’ to be the domain you are setting it up on):

 

<IfModule mod_rewrite.c>

RewriteEngine On

RewriteCond %{REQUEST_METHOD} POST

RewriteCond %{REQUEST_URI} .(wp-comments-post|wp-login)\.php*

RewriteCond %{HTTP_REFERER} !.*example.com.* [OR]

RewriteCond %{HTTP_USER_AGENT} ^$

RewriteRule (.*) http://%{REMOTE_ADDR}/$ [R=301,L]

</ifModule>

 

This in conjunction with our ACL will prevent the attack from affecting your site(s).

 

Additional recommendations:

-Changing your default admin username for wp-admin to a different username as the attack is specifically targeting the admin username.

 

-Placing a browser-based password on wp-login.php

 

The link immediately below will explain how to do this:

http://codex.wordpress.org/Brute_Force_Attacks#Password_Protect_wp-login.php

 

Additional information about the attack can be found here:

http://blog.skunkworks.ca/brute-force-attack-targeting-sites-running-wordpress/

http://www.inmotionhosting.com/support/news/general/wp-login-brute-force-attack

 

Using the tips we’ve provided above, this will help to keep the attack from affecting your site. It will also increase the security of your wordpress based site as well. We hope this will help all clients and not just those at Turnkey Internet, but any client globally who may be having issues with the wordpress attack on their sites.

 

Until next time

Follow Us : Facebooktwitterlinkedinyoutubeinstagram
Share : Facebooktwitterredditlinkedinmail

Written by Jeremy on September 12th, 2014

Tagged with , , , , ,

An Angry Bird attacks TurnKey Internet’s super secure data center:   2 comments

Posted at Jun 18, 2013 @ 2:57pm New York Datacenter,News,Story Time at TurnKey

BirdAt approximately 12:53PM on June 18, 2013, a cardinal was captured on security film trying to break into TurnKey Internet’s highly secure, green data center in New York’s Tech Valley Region.

Neighbors called in after tweets (audible, non-Twitter) were heard at the Latham data center. Luckily, TurnKey Internet’s facility contains a state-of-the-art security system that safeguards their SSAE-16 Type 2 certified building.

“The bird just swooped in, tried to knock over all the security cameras so he could sneak inside! Then realized how secure the buildin’ was,” local resident Emily Wegener said of the incident. “He flew away and disappeared in some bush-tower-tree-thing and I never done seen that creature again!”

The bird stands about three inches in height, is red in color and has a white belly. The culprit was last seen fleeing the scene to a nearby maple tree. If you have seen this bird, have any additional information, or have any suggestions for when birds attack, please contact your local authorities or email birdpatrol@turnkeyinternet.net. Follow Us : Facebooktwitterlinkedinyoutubeinstagram
Share : Facebooktwitterredditlinkedinmail

Written by Dylan on June 18th, 2013

Tagged with , , , , ,

TurnKey Internet Receives SSAE 16 Type 2 Certification!   25 comments

Overheard at TurnKey Internet, straight from the CEO: “Attaining the SSAE 16 Type 2 certification was a significant goal and milestone for us. We pride ourselves on our unparalleled reliability, quality of service, and—most importantly—customer satisfaction. This certification not only proves that we are excelling in those areas, but also assures our new and existing clients that they are receiving the best possible service.”

You heard right, ladies and gentlemen! We are proud to add SSAE 16 Type 2 to the list of certifications that our green data center in Upstate NY has attained. “What’s that,” you ask? SSAE (or The Statements on Standards for Attestation Engagements) No. 16 (SSAE 16) Type 2 certification is an internationally recognized compliance certification, that was created by the Auditing Standards Board of the American Institute of Certified Public Accountants in April of last year (2012). It replaced the Statement on Auditing Standards No. 70 (SAS 70) to better supplement international auditing standard ISAE 3402.

After a thorough examination, conducted by SOC audit specialists The Moore Group CPA, LLC., our facility was deemed compliant with the regulations required to attain SSAE 16 Type 2 certification. This audit investigates several core areas: security, availability, processing integrity, confidentiality, and privacy. It verifies that TurnKey Internet is of the utmost security, integrity, and reliability. It confirms that we have procedures and safety precautions of the utmost efficiency in place to ensure the security of our facility and our clients’ data within.

Needless to say, we’re pretty excited. We couldn’t wait to share the good news! You can read the full press release here > Follow Us : Facebooktwitterlinkedinyoutubeinstagram
Share : Facebooktwitterredditlinkedinmail