{"id":13114,"date":"2016-11-07T09:35:06","date_gmt":"2016-11-07T14:35:06","guid":{"rendered":"https:\/\/www.hostgator.com\/blog\/?p=13114"},"modified":"2018-07-20T13:56:13","modified_gmt":"2018-07-20T18:56:13","slug":"how-secure-is-your-website-free-website-security-checklist","status":"publish","type":"post","link":"https:\/\/www.hostgator.com\/blog\/how-secure-is-your-website-free-website-security-checklist\/","title":{"rendered":"How Secure Is Your Website? A Website Security Checklist"},"content":{"rendered":"

\"Website<\/p>\n

The <\/span>recent DDOS scare<\/span><\/a> that affected a large number of websites brought to light how important it is to put whatever precautions we can into place to keep our websites secure. Anyone that owns a website right now should be thinking about security, but for those for whom your website is your business, you need to treat it as a priority.<\/span><\/p>\n

That\u2019s doubly true if you accept payment through your website. Whenever someone provides you with their credit card information, they\u2019re putting trust in you and your brand. If a hacker gets access to that information because you didn\u2019t take the necessary steps to make your website secure, then you betray that trust. <\/span><\/p>\n

Cyber security is complicated stuff and you may not be able to ward off every threat hackers are often savvy and always working to outsmart every new security update. Nonetheless, you can vastly reduce the risk of having your website be the next to be victimized by taking a few key precautions.<\/span><\/p>\n

 <\/p>\n

1. Keep all your software up to date.<\/h2>\n

The first step is one of the easiest, but one that makes a big difference. A lot of software updates are designed specifically to reduce security vulnerabilities. Software designers and cyber security experts are in a constant battle with hackers to thwart every new effort they come up with.<\/span><\/p>\n

Most of those software updates you seem to get constant reminders for are part of that battle. Even if it feels like an annoyance, don\u2019t dilly-dally on completing those updates. Regularly check for updates to your plug-ins, your CMS, your ecommerce software, and any other software related to how your website runs. Taking this simple step will immediately reduce your vulnerability.<\/span><\/p>\n

 <\/p>\n

2. Use secure passwords and update frequently.<\/h2>\n

A surprising number of people<\/span><\/a> still use basic passwords like 'password'\u009d or '123456.'\u009d \u00a0Don\u2019t be one of those people. <\/span><\/p>\n

Make sure the password you use to access your website has a mix of numbers, letters, and special characters. Also avoid using something an acquaintance could guess at in your password your kid\u2019s name or year of birth is too easy for someone to figure out. Get creative, make sure you use something different for your website than you use for your other logins, and make sure anyone else in the company that has access to the website does the same.<\/span><\/p>\n

And then do it all over again in six months. Set a reminder on your calendar so you remember to update your password with some frequency.<\/p>\n

With HostGator’s Password Generator tool<\/a>, simply\u00a0click\u00a0and drag Snappy’s head to generate a new password. Creating a secure password has never been so fun!<\/p>\n

\"Password<\/a><\/p>\n

 <\/p>\n

3. Backup regularly.<\/h2>\n

In the case that anything does happen, you don\u2019t want to be stuck building your website over again from scratch. Make sure you back it up regularly, just like you do your own computer (you do backup your computer regularly, right?).<\/span><\/p>\n

If you use HostGator for your web hosting, then setting up automatic backups for your website is as easy as <\/span>adding CodeGuard to your subscription<\/span><\/a>. It not only makes backing up completely effortless since everything is automated, but restoring your site if the need ever arises is a simple process as well.<\/span><\/p>\n

 <\/p>\n

4. Invest in a malware detector.<\/h2>\n

Malware\u2019s extremely common, and <\/span>not just on the website\u2019s you\u2019d expect<\/span><\/a>. Hackers have an interest in infecting any website that people are likely to visit. That means your website could be felled by malware, or (arguably) worse, it could be the means by which <\/span>malware infects your customers\u2019 computers<\/span><\/a>. <\/span><\/p>\n

Your best move to avoid both scenarios is a <\/span>strong malware detector<\/span><\/a>. Anti-malware programs can spot malware fast and help you get rid of it before it has the chance to do much damage. They\u2019re relatively inexpensive when you consider the risks malware poses, and they’re not all that difficult to implement. Your web hosting platform might even offer one (like HostGator does<\/a>), which makes adding it to your web hosting plan and activating it especially easy to do.<\/span><\/p>\n

 <\/p>\n

5. Be careful about your permissions.<\/h2>\n

How many people have access to your website? Most businesses, even many on the smaller side, need to provide at least a couple of people with the means to access the website to make changes. Medium-sized and larger businesses will often have far more people accessing the website on a regular basis.<\/span><\/p>\n

The more people you have in there making changes to the website, the more vulnerabilities you have. Chances are, not every person using your website needs the same level of access. By using your permissions wisely, you can limit the potential damage a thoughtless or malicious act by one of your employees or contractors can have.<\/span><\/p>\n

 <\/p>\n

6. Set up SSL.<\/h2>\n

If you have an ecommerce websites, purchasing an <\/span>SSL certificate<\/span><\/a> is not optional. Your customers need to know that your website is secure before they hand over sensitive information. An SSL certificate is the way you provide them that security. <\/span><\/p>\n

An SSL certificate isn\u2019t terribly expensive and ensures your websites shows a green HTTPS in the browser bar, which is what consumers look for to see that a website can be trusted. It adds an extra level of protection to ensure the details customers share with you are properly encrypted and can\u2019t be easily snatched up by cyber thieves.<\/span><\/p>\n

\"HostGator<\/a><\/p>\n

 <\/p>\n

7. Use AVS and CVV.<\/h2>\n

When you add an address verification system (AVS) and credit card verification value (CVV) field for all credit card checkouts, fraud attempts are far less likely to slip through. You have a chance to check the information a customer provides against the information their credit card company knows so people that have stolen credit card numbers alone won\u2019t get past your confirmation process. <\/span><\/p>\n

 <\/p>\n

8. Reduce XSS vulnerabilities.<\/h2>\n

This step gets really technical and you may want to consult with your webmaster or a cyber security consultant rather than try to handle this one on your own. <\/span>XSS (cross site scripting) vulnerabilities<\/span><\/a> are weaknesses in the code you write that allow hackers to add code to your website that infects your visitors\u2019 devices. <\/span><\/p>\n

To reduce XSS vulnerabilities, you need to validate and sanitize your data as described at the link above. You may also be able to insert <\/span>this string<\/span> onto your webpages to reduce your vulnerability:<\/span><\/p>\n

echo htmlentities($string, ENT_QUOTES | ENT_HTML5, ‘UTF-8’);<\/span><\/em><\/p>\n

But that will only work for you if you\u2019re not using HTML. If you are using HTML, running your code through the <\/span>HTML purifier<\/span><\/a> is your best alternative.<\/span><\/p>\n

 <\/p>\n

9. Reduce SQL injection vulnerabilities.<\/h2>\n

As with step 8, this step is probably more the job of a webmaster than a business owner, so ask for help if you find the suggestions confusing. <\/span><\/p>\n

SQL injection vulnerabilities aren\u2019t as common as XSS vulnerabilities, but they\u2019re still cause for concern. They allow hackers to get ahold of the sensitive data stored in your database which often includes information like your customers\u2019 credit card numbers. <\/span><\/p>\n

All of the best methods for prevention here are pretty technical and you can check out the <\/span>SQL Injection Cheat Sheet<\/span><\/a> for more detail on what each defense means. The main five defenses against SQL injections are:<\/span><\/p>\n