Running and managing a website is a lot of work, and most people don’t even consider the possibility of being compromised. When they ignore the risk, webmasters are putting themselves at an even greater risk. If you run a personal or business website then it’s vital you take steps to protect your website from hackers. Criminals have many reasons for wanting to gain unauthorized access to your content, and all of them will impact you in a negative way.

The hacker might be interested in performing a prank, or they could try to redirect your traffic to another link. If a business website gets compromised, your customers’ personal data could be exposed, and that would ruin your reputation. The following information will help you keep yourself safe.

 

1. Stay Updated

One of the ways that hackers gain access to a website is by looking for software vulnerabilities. They will reverse engineer software and scripts to find methods to take control of your content and to view your files. To combat that problem, software developers consistently release updates for their programs, which address known weaknesses.

But some webmasters are still reluctant to update their sites because they don’t want to experience any downtime. When you choose not to install recent updates, you are inviting criminals to exploit you and your users. Ensure that you are always using the latest scripts when your goal is to safeguard your website.

 

2. Strong Passwords

Hackers will sometimes use brute force software to access your administration panel, and they can do anything they want from there. The brute force software works by repeatedly entering different numbers and letters into the username and password fields until it finds the correct combination. You can protect yourself from such attacks by using strong passwords that contain letters, numbers and special characters.

Although it’s still possible for hackers to use brute force software to break into your website, they are not likely to succeed. A complex password can resist a brute force attack for several thousand years before the correct combination is discovered. Unless your website contains extremely sensitive data, the hackers will likely move on to an easier target.

 

3. File Encryption

Many people store files on their website as plain text, and that makes it easy for hackers to steal and read the information. The problem becomes that much worse when the data contains the credit card numbers of your customers. You can add an extra layer of safety by encrypting your files so that they become all but impossible to read.

An encryption program works by scrambling a file until it’s unreadable, and only the person with the correct decryption key can reverse the process. If your important files are encrypted, hackers will not be able to see them even if they gain access to your website.

 

4. Rename Your Directories

When hackers want to take control of your website and to cause damage, they will search for your administration directories. If they can locate them, then the hackers can steal your login details or give themselves access. Many programs are available that will scan websites to find administrative credentials, and you can protect yourself by renaming your directories.

Although this step might seem small, don’t get tempted to overlook it because you must do everything that you can to stay safe. The name that you give your directories is not important as long as you know how to access them when you need to make changes.

 

If a business website gets compromised by criminals, then the entire business could fail. Whether you run a private blog or corporate site, it’s vital to be proactive when it comes to securing your content if you don’t want to encounter problems. Some people feel as though hackers would not want to target them, but their false sense of security could cause them to lose everything.

Safeguarding yourself does not need to be a hard or time-consuming process, and a little effort can work wonders to prevent a disaster from occurring. You never know when a security breach will take place, so you need to take action while you still have the opportunity.

 

Running a business can be very demanding and it may not leave you with enough spare time to regularly maintain your website’s security. If this scenario sounds familiar, your best bet may be to switch to a Managed web hosting solution. TurnKey Internet offers a complete all-inclusive fully managed service that lets you focus on your customers while running your business – leave the infrastructure, software updates, security, backups, and uptime to us. We provide a turnkey solution that employs a unique combination of Application and Network Engineers, deep-level performance monitoring and on-going guidance to maintain and optimize your cloud-based hosted infrastructure. You get all-access to our Support and network Engineers – far more cost-efficient than hiring, onboarding, and building your own team of tech gurus. As technology changes daily, we’ll keep your systems secure and up-to-date, while you focus on your business.

 

Follow Us :
Share :

While you may have been urged by Drupal to update your software late in 2014 due to SQL injection attacks in compromised Drupal 7 sites. Drupal has released version 6.35 and 7.35 to address a few newly discovered vulnerabilities within their software.

Listed in an advisory by Drupal’s security team, Drupal stated one of the vulnerabilities they are addressing has allowed password reset URLs to be forged. This allows malicious users to gain access without knowing the password.
In Drupal 7 this vulnerability is segragated to sites where accounts have been imported or edited in ways that will result in the password hash, in the database being the same for multiple user accounts.

In Drupal 6 this vunlnerability can be exploited on sites where administrators have created multiple user accounts with the same password. As well as where accounts have been imported or edited in ways that will result in the password hash, in the database being empty for at least one user account. Drupal 6 sites having an empty password hash, or a password with an easily compromised string in the database are extreamly prone to this vulnerability.

The second vulnerability Drupal’s team has patched is the ability for malicous users to devise a URL, sending visitors to a 3rd party website.

Drupal modules use a destination query to redirect users to a new destination after completing an action. Malicious users can use this destination parameter to construct a URL that will fool users by redirected them to a 3rd party website. Several URL related API functions in Drupal 6 and 7 can be fooled into passing through external URLs when that was not the intention, leading to open redirect vulnerabilities.

This vulnerability is has been down played as a large amount of the destination parameter are not vulnerable to the attack. Although, all confirmation forms built using Drupal 7’s form API are vulnerable! Drupal has also stated some Drupal 6 confirmation forms are vulnerable too.

Drupal versions affected:

Drupal core 6.x versions prior to 6.35

Drupal core 7.x versions prior to 7.35

How to rectify these vulnerabilities? Update to the latest versions.

If you use the Drupal 6.x upgrade to Drupal core 6.35

If you use the Drupal 7.x upgrade to Drupal core 7.35

For those using TurnKey Internet’s Web Hosting with Drupal can simply login to your cPanel control panel, click on the Softaculous icon, and update your drupal version from there as well as from the Drupal Control panel of your installated copy on your web site.  If any questions contact our customer service team, or keep posted on our help desk at http://helpdesk.turnkeyinternet.net/

Follow Us :
Share :