Nw_Work
Senior Member
- Nov 23, 2019
- 906
- 345
What I mean is not that company like Vercel, Amazon, Godaddy etc will steal but the server admin/customer support etc will do so simply copying off entire site backupI think this needs to be divided into two parts - those that build trust in the hosting provider and strictly technological methods. Let's discuss it step by step:
Trust in the hosting provider is determined by:
The hosting provider cannot guarantee that our data will not be stolen. It can happen through (for example) a breach of our administrator account, not necessarily directly through the hosting company. In both cases, we can protect ourselves by:
- Company size
- Frequency of use by others
- Collaboration with other reputable companies (for Supabase, it's Vercel or Resend)
- Undergoing pentests, security audits, and certifications (https://supabase.com/security)
- Encrypting data at rest - if the database is stolen, it ensures that it cannot be read without decryption keys.
- Encrypting data in transit - we use SSL/TLS to encrypt data between the application and the database (provider) to avoid MITM attacks.
- Setting access control - establishing permissions for each role and limiting them as much as possible.
- Security observability - reviewing logs and detecting suspicious activities (in Splunk, for example, although this can be more automated).
- Backups - in case of losing access, we can easily restore data from backups taken before the incident.
Encrypting data at rest - if the database is stolen, it ensures that it cannot be read without decryption keys.
How to do that in Wordpress?
Setting access control - establishing permissions for each role and limiting them as much as possible.
Not feasible since you don't own the server and thus would have 2nd or 3rd level privilages compared to Server admin/customer support
Also most hosts can directly login to the backend of website as an admin so they can create new admin user and then backup site and then delete new user they made
or they can do reverse sql via database and find your login details to backend
