Basic Tips for Website Security

You have worked hard to get your website online, so it is natural to worry about security. Attackers look for loopholes all the time, and most attacks are automated: bots scan thousands of sites for known weaknesses. A few sensible steps remove most of the risk.

Start With a Secure, Managed Server

The simplest protection is a hosting server in a secure data centre that is kept up to date. On shared and managed plans the host applies operating system updates and security patches, runs firewalls and filters malware and spam. Ask your host what it covers and what is left to you.

Keep Your Software Updated

Most hacked websites run outdated software. Update your content management system, themes and plugins promptly, remove the ones you no longer use, and run a supported version of PHP. Turn on automatic updates where you can.

Close the Doors You Don’t Need

• Turn off directory browsing. Directory listings show an attacker how your site is organised and expose files that were never meant to be public.
• Hide error details. Display errors to visitors only during development; on a live site, write them to a log instead, because error messages can reveal how your server is configured.
• Keep personal data out of cookies. Store data on the server and keep only a random session ID in the cookie, marked Secure and HttpOnly.
• Use HTTPS everywhere. A free SSL certificate protects logins and forms.

Protect Your Logins

Use long, unique passwords and a password manager, turn on two-factor authentication for your hosting account and your site’s admin area, and limit login attempts. Give each person their own account with only the permissions they need.

Add a Firewall

A web application firewall filters malicious requests before they reach your site. Many hosts include one; on Apache servers the ModSecurity module does a similar job, and CDN services offer firewall rules as well.

Back Up and Scan Regularly

Keep automatic backups, store a copy away from your hosting account, and test that you can restore it. Then scan your site regularly with a security scanner that checks for known weaknesses and malware. Scanners are updated often to include new exploits, so regular checks are worth more than a single one.

Higher Stakes: Gambling Sites

Sites that deal with money attract more determined attackers. Online casinos and sportsbooks face credential-stuffing attacks on player logins, bonus abuse bots and, above all, traffic floods timed for big events. If you run a betting or casino project, read our guide to DDoS protection for betting platforms.