Modern websites are constantly under attack. Hackers use “bots” or computers that scan the internet looking for vulnerable sites. Here are some common questions about website security that should be of interest to website owners.
Why would someone want to hack my site?
There are a number of reasons to hack a website. The main ones are:
- To steal credit card information (ecommerce sites).
- To redirect users to a bad site where they may have information stolen.
- To install malware on your website that will infect the computers of your visitors with a virus or trojan. The hacker can then control the infected computer for denial of service attacks or other mischief.
- To place links on your website to promote other sites (blackhat SEO).
Why would my website be targeted?
Hackers use bots to automatically scan thousands of websites looking for common vulnerabilities. The targeting can be random, or be based on the website software used on your site. If the bot finds a vulnerability, it will be exploited, usually at a later time.
Any website’s server logs are filled with bot visits looking for vulnerabilities. In fact the visits can be so bothersome that they will sometimes use up server resources for websites hosted on inexpensive shared hosting accounts. This can cause the website traffic to be throttled, or slowed down, making the website very slow loading until the bot attack is over with.
What happens when my website is hacked?
The hacker will generally use the vulnerability to upload a backdoor administration program. With that program they have full control of your website files. They can hide viruses in many places, or add malicious code to files your website software actually uses.
Another type of attack is called a brute force attack. The attacking bot will try to log into your website’s administrative control panel using sophisticated software that tries to guess username and passwords many times. Once logged in, the hacker can install software to control your website.
How do I know if my website has been hacked?
If you DON’T have security software installed on your website, you’ll need to find out, in the best case, from your web host, or in the worst case, from Google. If Google finds malware on your website it will post a warning in the search results, and make your site difficult to visit (for good reason).
If you DO have security software installed, if it does not block the attack, if will alert you, if configured to do so.
How do I keep my website safe from hackers?
The number one thing you can do to keep from being hacked is to update your website software frequently. This should happen at least monthly, but ideally whenever a new software version becomes available. Website software developers are constantly updating their software to plug security holes or fix newly found vulnerabilities. It goes without saying that you should only use software that is currently being supported and updated by the developer. Once their support stops, your website will start to be vulnerable.
It is also a good idea to install website security software such as a firewall and malware scanner. The firewall can block suspicious visits, and the malware scanner can detect and notify you of any successful hacks so the vulnerability can be fixed and the malware can be removed.
Another step that you can take is to use a Content Delivery Network (CDN). The CDN can act as an additional firewall to block bad actors who have tried to attack other websites on the network, thus providing immediate protection for your website against those same attackers.
TP Designs builds, maintains and promotes websites for businesses in Northern California.