How to hack-proof your website

Many organisations invest heavily in their website, paying for set-up costs, hosting fees, SEO optimisation, and more. But do companies know what security issues could be lurking under the surface of their website? To prevent businesses from seeing their investments go to waste through poor security planning, Anthony Green, CTO of cyber security firm FoxTech, discusses what company owners can do to protect the security of their greatest online asset.

An insecure website is like an unlocked door to a hacker. Through a website hack, cyber criminals can steal sensitive customer data and use it to hold companies to ransom, insert backlinks to scam sites, launch phishing attacks to trick customers into making false payments, or make money by selling data on the dark web. They might also launch a Distributed Denial of Service (DDoS) attack to make the site unusable – preventing sales and damaging customer trust.

Many business owners believe that as long as their site isn’t constantly crashing, or getting spammed with bots, they don’t need to worry about cyber security. Unfortunately, even a website that is calm on the surface could be hiding an array of security issues. If an organisation has never investigated the strength of their website’s security, then it is likely that it needs to be improved.

How do hackers gain access to a website?

There are a variety of ways that cyber criminals can gain access to a website and its data. They often target the various types of software that a site uses to run, from web servers and content management systems such as WordPress, to database servers and their operating systems. Web hosting providers can also be the victim of attack, with a successful breach giving the hacker access to all the websites they host. Brute force password attacks may also be used.

Shockingly, it is also not uncommon for organisations to unknowingly have entire customer databases exposed to the internet – so sometimes a hacker doesn’t have to work hard at all to gain access to sensitive information. Businesses can access a free initial report of their internet facing assets using FoxTech’s CyberRisk assessment tool.

While investing vulnerability monitoring and reacting quickly to new threats is the best way to protect your website on an ongoing basis, most businesses can make vast improvement just by implementing a few simple security strategies. At FoxTech, we are committed to helping businesses improve their cyber security. Here are our top five tips to hack-proof your website:

Always install software updates

A common method that hackers use to gain access to a website, is exploiting vulnerabilities in the software a site uses to stay up and running. Software companies frequently scan for weaknesses in their system, and create fixes, which are rolled out to users via software updates. By always installing these updates promptly, you can ensure that your site won’t be exploited by hackers targeting those using old software with unpatched vulnerabilities. You need to install updates across all your software, including security plugins, web servers, and CMSs.

Enable two-factor authentication

Enabling two-factor authentication (2FA) on your site means that even if a hacker has gained access to your, or your user’s passwords, they will not be able to log in without inputting a code sent to the device linked to that account. This is one of the simplest and most cost-effective ways to protect any accounts associated with your site from becoming the victim of a data breach. If you’re operating on a WordPress site, popular 2FA tools include SecSign, and the Google Authenticator plugin. Businesses can also strengthen their protection against password attacks by following the National Cyber Security Centre’s guidance on updating password policies.

Ensure your security products are correctly configured

Security products, such as anti-virus software and firewalls, are designed to scan for, and block, hacking attempts. However, if you simply install these products, and then leave them alone, you’re wasting your money. Any security product needs to be correctly configured and monitored, otherwise they will not deliver the full protection that you expect. Businesses without the in-house capacity to carry out these tasks can be reassured that hiring a third-party cyber security consultancy to properly configure any products should come at a relatively low cost.

Be picky about your host server

Choosing the wrong web host could wreak havoc on your website. It might be tempting to use a cheap host, however, the low price comes at a cost. These providers often have glaring holes in their security measures which makes them, and the websites they host, vulnerable to attack. While trusted web hosts do come with a higher price tag, they offer strong server security. Look for a host that provides real-time scanning and monitoring and alerts you immediately if they spot any problems.

Create regular backups

If your security measures are not up to scratch, creating regular backups won’t prevent a hacker from gaining initial access to your site. However, it does mean you have the power to cut them off at the source. When armed with a recent backup of your site, all you need to do in the event of a breach is delete the hacked site, and reupload your backup. Of course, prevention is always better than cure, and you should never reupload your site without fixing the security issues that caused the hack in the first place. But, with that said, having backups will give you the confidence that you can stop a hacker in their tracks, without having to rebuild your site from scratch.

Don’t wait to think about security until you’ve got a problem – it’s never too early to start protecting your greatest online asset.