Website Security 101: How to Secure Your Website

What is website security?

Website security is the protection in place to protect a website from attacks. Since attacks can come from many places, website security is multidimensional. The US Cybersecurity & Infrastructure Security Agency (CISA) warns that cybersecurity attacks are increasing in number and severity.

Why should you have a secure website?

It is important to keep your website secure to prevent cybersecurity attacks. A secure website is the best protection from someone making unauthorized changes to your website, theft of customer data, or preventing you from completing the business activities you need.

What security website should I monitor?

In the US, watch the Cybersecurity & Infrastructure Security Agency (CISA) website for alerts about new vulnerabilities and threats. It’s also good practice to enable security alerts from every software app you use for your website including the content management system (like WordPress or Salesforce), plugins, browser alerts, and so on. You can only prepare defenses for what vulnerabilities you know are out there.

Common website security threats

Data breach

A data breach happens when someone exposes confidential information. Data breaches can happen by accident, but cyber thieves also target websites and web applications to steal data that they can sell on the black market or use to break deeper into the company’s network. Financial and medical data are common targets, but hackers can also sell student data, private correspondence and photos, and customer contact information.

Data breaches are costly, and not just in terms of lost income. Customers can sue if their private data is stolen and they can show that your company was negligent. National governments are becoming more aggressive in protecting their citizens' data, so large fines and legal sanctions are also a possibility. Data breaches can also destroy a business’s reputation and the public’s perception of its trustworthiness.

Denial of Service (DoS) and loss of website availability

A Denial of Service (DoS) attack is an attempt to crash a website by overloading its servers. A similar attack is a distributed denial of service (DDoS). In a distributed attack, the traffic is coming from multiple resources. This makes it more difficult to stop. You can block one source from flooding your webpage, but it is much more difficult to keep hundreds, especially if the list is constantly changing.

Ransomware

Ransomware is a malicious computer code that blocks access to your website until you pay a ransom. Ransomware is becoming more frequent for small businesses and government municipalities. A criminal encrypts your computer files and user data, then offers to sell you a decryption key in return for cash (often Bitcoin or another cryptocurrency). This is a highly profitable crime because it costs less to pay the ransom than to regain access to business files any other way.

It has become so profitable that CISA and cybersecurity watchdogs warn that dark web users are offering Ransomware as a Service (RaaS). RaaS is a subscription-based business model where a criminal firm develops ransomware tools, then sells the tools to affiliates. When the affiliate uses the ransomware successfully, they pay a percentage of the ransom to the criminal firm. This removes the need for technical skills and opens up ransomware to anyone willing to pay the affiliate fee.

Cross-site scripting (XSS)

Cross-site scripting (XSS) happens when a malicious actor injects executable scripts into a website’s code. When this is successful, the hacker is able to access control of the website and impersonate people who have legitimate access to the website’s code.

SQL and code injections

SQL injections (SQLi) use SQL code to manipulate the databases connected to a website. SQL stands for scripted query language. It is used by database administrators to control the data in a database. An SQL injection bypasses the webpage to access the database directly. Once hackers access the database, they can destroy data or copy it to sell on the dark web.

Stolen passwords

Most websites are secured by passwords. Passwords can be broken by software programs that try different combinations until they find one that works. Or in many cases, web developers use the default passwords that come with their web administrator account. If a hacker has the username and password to a website, they can do any amount of mischief or malicious activity, from defacing the webpage to making the files irrecoverable.

Steps you can take to secure your website

Keep software and security patches up-to-date

Keep all your software up to date. Most website attacks originate through the Content Management System (CMS). Popular examples of CMS are WordPress, Joomla, and Magento.

Turn on the alerts so that you know when Microsoft, WordPress, or any software vendor releases a patch or security enhancement. These are often released in response to a newly discovered weakness, so time is a priority.

Add SSL and HTTPS

The MailChimp Web Builder includes an option to add encryption through SSL certificates that protect monetary transactions. HTTPS is an encryption tool that protects data that needs to be secured, like financial or medical records.

Require complex passwords and require frequent changes

Strong passwords that are changed often are one of the easiest and most effective ways to protect your website. When the option is available, use multi-factor authentication. If it annoys you, it annoys hackers and bots trying to hack into your website even more.

Restrict administrative privileges

The fewer people who have administrative access, the easier it is to keep track of everyone. When someone leaves your company – especially if terminated – disable their account immediately. Not everyone working on your website needs admin privileges. Grant privileges according to what the person needs to do. If someone needs temporary access for a special project, you can add the new rights needed, then.

Change default settings, especially default passwords

Default settings are often the same for everyone who buys a software application or hardware product. This means that anyone else using the same apps you do may know your login credentials. So change them as soon as you install a new product.

Backup your files

Backing up your files gives you a way to quickly recover from any type of cybersecurity attack. The MailChimp Web Builder offers the option to automatically backup your files when you set up your website. This is strongly recommended because it is too easy to forget.

It is important to keep backup files in a secure location separate from your website files. This is because if a hacker gets into your web account, they also have access to your backups. Saving your files offline gives you an alternative to paying a ransom because you can restore the encrypted files yourself instead of paying the criminals.

Prepare a recovery plan before anything happens

Cybersecurity attacks can still happen no matter how diligent or careful you are to maintain security on your websites. Prepare a recovery plan just in case. Drill your team occasionally to make sure the plan is current and everyone knows what needs to be done.

Maintaining security for websites is a constant process. New vulnerabilities appear every day. If a breach happens, get your website back online. Once your business is up and running again, look at what happened and take steps to keep it from happening again.