To improve website security it is necessary to take into account several aspects. However, do not think that it is too complex a process. Therefore, today we have decided to bring an article in technology tips to help you understand and improve the security of your website and avoid cyber-attacks.
In previous articles I wrote about ways to protect your Wi-Fi. I have also written about ways to protect your PC from malware. All these combined tools will create a bunker stronger than the US Federal Reserve. Enjoy!
First step to improve website security:
Updating installed applications
Nowadays it is very common to use for the development of open source CMS web applications such as WordPress or Joomla. These tools make it much easier to start a new website. However, they can become a major security problem if we do not track periodic updates.
In the case of WordPress, it is the tool itself that alerts you when a new version has come out, inviting you to update it. As usual, the update process is usually very simple. Thus, practically anyone could be able to perform this action. In addition, in the network we can find a large number of manuals that explain this type of actions.
Recommendations to improve website security if you are going to program
If instead of betting on an open source tool we prefer a web page made to measure. It is very important to take into account a series of safety recommendations when programming. Among the most important we can highlight:
Set necessary filters to determine if each data entry field has the expected length and format.
Remove special characters or escape them, eliminating them if they are not necessary. Among the most problematic characters we can find single, double quotes, bars … eliminating these characters can help us avoid SQL Injection attacks.
Do not allow the loading of HTML code in those fields that are not necessary
Block the loading of content from remote pages.
In those sections where a user and a password are necessary to access: Check that the visitor has logged in and that their data is in the session.
Installing SSL helps improve website security if you sell products!
The use of security certificates would not improve the security of our site. But it would help to improve the security of the information that moves through it, especially in electronic stores where users often send sensitive data.
This type of security certificates, what it does is encrypting the information that is sent by the web page. This prevents someone intercepting traffic from decrypting the data sent. A useful tool to improve web security for Woocomerce and others.
Encrypt sensitive information for web security
Nowadays most web applications make use of a database to store the information.
There are occasions when part of that information is of great importance. In those cases it is a good idea to encrypt the data that is stored. In this way, if someone enters the database of our server cannot read the information, but only see letters and numbers without meaning. This is the case of passwords or bank account numbers. This information should always be encrypted using some algorithm created for it.
IN THIS ARTICLE YOU CAN KNOW MORE ABOUT THE ENCRYPTION OF WEB SITES.
Set cookies to be “httponly” and secure
If we configure cookies as “secure” we will be getting that they are only exchanged between the browser and your application through the HTTPS protocol. On the other hand, by marking them as “httponly”, we will avoid having scripts that can access the information stored in them. This reduces the chances of suffering a cross-site scripting attack.
Last tips to improve website security: A trusted hosting
In the market we can find hundreds of companies that provide hosting services, but not all of them offer the same level of security. It is very important that this hosting provider has some intruder detection and prevention system. It is ideal that it offers security barriers to block possible attacks with firewall, among others.
A good practice is to block the protocols considered management (Remote Desktop or Terminal Service, telnet, ssh, webmin, usermin and if possible ftp). In such a way that it can only be accessed from the IP addresses normally used by the user for its management. In this way, even if an attacker could get our passwords, by not having an authorized IP could not connect.
I hope this article helps you improve the website security for you or your clients. Remember to always be aware of the security information to avoid being outdated. This will help avoid attacks more easily. See you in a future article, see you soon!
