How to fend off hackers?
- Thread starter Alice Du
- Start date
- Nov 16, 2011
- 19,800
- 11,280
You need to take help from a security researcher (ethical hacker) to make security more tight on your website.
Captain_Nothing
Power Member
- Mar 13, 2018
- 632
- 241
Cloudflare would be a good start if you don't already have it.
RobertTheShark
Regular Member
- May 10, 2018
- 214
- 82
What ecommerce software do you use?
In general:
For any further help, It would be good, if you could specify WHAT kind of attacks did happen, like someone trying to login as admin or so.
In general:
- Always keep your CMS updated to the newest version
- never use database with root account (mistakes that A LOT of people do, out of laziness)
- Don't use too many plugins (specially if you youse wordpress, the more plugins you use, the more security holes you can have)
- Use ddos protection
- Use strong password for the admin account
For any further help, It would be good, if you could specify WHAT kind of attacks did happen, like someone trying to login as admin or so.
fd55
Regular Member
- Oct 24, 2016
- 348
- 152
if there's direct and purposeful attacks this would probably be beyond your scope. Cloudflare can help, depending on the type of attack. Cloudflare paid services might be a tad better, but depends on type of attack as well. I wouldn't rely too much on plugins/software on the site, that's like the last line of defense, if they're getting up to that point it's probably too late.
Hire a security team/individual to help address. Ask for references.
Otherwise talk to your host, they might have it as a service/additional feature perhaps or can send you to someone who can help so long as your not on EIG host.
Hire a security team/individual to help address. Ask for references.
Otherwise talk to your host, they might have it as a service/additional feature perhaps or can send you to someone who can help so long as your not on EIG host.
plottsch
Power Member
- Jul 18, 2016
- 567
- 293
What's your username, password, CC and SSN? I can help.
rickydzine
Power Member
- Jun 6, 2011
- 580
- 321
Using google recaptcha on your login page can help 
, unless the attacker is determined in which case it still helps by making the process more costly for said attacker. I'm assuming they are trying to bruteforce your password. Also change it every 3months and ensure you get a nice strong password.
, unless the attacker is determined in which case it still helps by making the process more costly for said attacker. I'm assuming they are trying to bruteforce your password. Also change it every 3months and ensure you get a nice strong password.
Chris.Roark
Elite Member
- Aug 16, 2016
- 1,942
- 687
I agree, you need to put a CDN between your servers and the Internet, Cloudfare has a free account, so you can try that first.
Also, do you use any ecommerce CMS or your website is custom built?
An e-commerce CMS is usually a better choice for simple e-commerce websites because the technical stuff and vulnerabilities are fixed and updated on a consistent basis.
CrustyBillyGoat
Junior Member
- Feb 14, 2018
- 100
- 18
Like others said, you MUST keep your ecom software updated (which software do you use?)
I personally use Sucuri, I think they are the best. You can set some pretty extreme filters if your site is constantly under hacking attempt. They also will text you/email you the second any file has been changed on your server. They also usually virtually patch your server with latest updates from wordpress/magento etc.
Lastly, if it's just you running the site, set all your ftp/ssh/backend software to whitelisted IP's only. Also use two factor on your ecom backend.
***Again biggest thing keep software updated, use some sort of third party firewall.
I personally use Sucuri, I think they are the best. You can set some pretty extreme filters if your site is constantly under hacking attempt. They also will text you/email you the second any file has been changed on your server. They also usually virtually patch your server with latest updates from wordpress/magento etc.
Lastly, if it's just you running the site, set all your ftp/ssh/backend software to whitelisted IP's only. Also use two factor on your ecom backend.
***Again biggest thing keep software updated, use some sort of third party firewall.
