The worst thing that can happen when you manage a website, is to see it compromised by malicious scripts or brute force attacks. With Content Management Systems (CMS) like WordPress, Joomla, Drupal or Magento, it is very easy to setup and manage a website. However, security knowledge can escape you, because you don’t need to be an expert and program everything. Is that really a problem? No. But it’s important that you remain vigilant.
As a webmaster, regardless of your skill level, managing and maintaining the security of your website is a priority. Don’t go thinking that once your site is setup that it will work perfectly forever, especially if you are using a CMS. You have to keep it up to date, because ill-intentioned people continuously work to find website vulnerabilities; therefore CMS are an ideal target due to the high volume of people using them.
Other than upholding a secure behaviour over the Web, what can you do to secure your website? Here are the top 4 tips to keep your CMS in check!
Number 1: Regular Updates
We will never repeat this enough: updating your applications prevent a whole lot of problems. An update is not only made to provide new features, but also solves important bugs. And more often than not, these updates repair security vulnerabilities in the software.
It’s quite easy: all CSM have an administrative panel. From there, you are be warned of any software update and you should make the suggested updates. We highly recommend making a backup of your site and databases, because if the update breaks something, you can always revert back. Need not to worry, Funio saves over 7 days of backups of your account, so you can always ask us for a back restore of one of our copies.
The main application you are using is not the only thing to update. Consider extensions, plugins and the theme that you use.
NOTE: when you download plugins and themes, make sure you get them from their original source. Too often, popular themes are copied and made available for free… with malware. If you wish to use good plugins and good themes that require you to pay: do it!
Number 2: Limited Access to the Admin Panel
All CMS have a management interface. They are often the target of brute force attacks, because the link to these panels is fairly standard.
- The administrative username: don’t use “admin” for the main username; change it for something else and unique. Make sure its password is strong and complicated (lowercase, uppercase, numbers AND symbols).
- Password protect the admin panel: add an additional security layer to the administrative panel by protecting the folder with another username and password. This article should help you do this easily on your Funio hosting plan.
- Limit access/permissions to administration: each user you create should have specific permissions to their tasks. Ideally, only a single user should have all the rights (the “admin”). CMS already have preconfigured user permissions and roles: use them!
Number 3: Tips From the Hosting Experts
We cannot hide it: we are web hosting experts. I therefore consulted our IT staff to learn what other tricks they have up their sleeves to help you. Here are some suggestions that can divert many types of attacks on your site.
- If your website does not display or make comments available, deactivate the feature completely. Even though the comment field is not visible on your page, it doesn’t mean it cannot be called and filled by malicious code.
- When you install your CMS, modify the suggested database prefix by the application (for example, WordPress uses ‘wp_’).
- Make sure the file and directory permissions respect a standard secure format.
- Deactivate PHP edition made by the administrative interface.
Number 4: Plugins!
There are many plugins that can be installed on your CMS to protect it on different levels. Also, each CMS has its own little trick to protect the admin interface (for example, WordPress has a Captcha plugin that works wonders).
There are also plugins that will limit the spam comments on your comments. In fact, that is quite a common problem with Joomla installations and the spamming of their k2_comments; here’s a good article on how to prevent that.
Other plugins can perform daily checkups of your site and create security protocols like you have never imagined (Better WP-Security).
Certain plugins can cost money but are really worth it. Just search a bit and you will find the right ones for you. However, make sure you only trust the original sources and don’t download unofficial copies.
