security on my website

Ashwinayadav

Ashwinayadav

Registered Member
Joined
Jun 12, 2023
Messages
73
Reaction score
16
My team, how can I keep security on my website, which plugin can I keep?
Somebody help me
 
Advertise on BHW
Wordfence is one option. Cloudflare is another option, it's not a plugin though...
 
Use Wordfence, delete xmlrpc.php if you are not using the Wordpress mobile app and use cloudflare as well.
 
Ashwinayadav said:
My team, how can I keep security on my website, which plugin can I keep?
Somebody help me
Click to expand...
There is no single answer to this. The attack vectors depend on the source code. The most common pitfalls are:

1) Sql injection- Make sure each and every plugin/theme only uses prepared queries (this is why you shouldn’t trust a theme/plugin before auditing it yourself).

2) RFI, or remote file inclusion - This is how hackers upload those shells onto your server. If you are not sure how to secure the uploads, don’t enable any kind of upload in the public site atall (example: upload your cv, send us document etc).

3) Cookie stealing - Under no circumstances should a plugin/theme add some kind of authentication cookie that is not httpOnly. If it does, it could be hacked using another attack vector like xss.

4) xss - this is quite uncommon these days, but still, some theme/plugin might have this vulnerability, which can be used with other vulnerabilities to get admin access to your site.

5) DO NOT use a shared host. They are almost always crappy, and have incorrect folder permissions. I probably am going to get some heat for saying this, but if you are serious about your website, stop using shared/reseller hosting. Switch to a vps instead. That way, you are the only tenant in that virtual machine, and you will have much less chance of getting hacked.

There are more, but these are the most common ones I have seen.
 
BlurryBit said:
There is no single answer to this. The attack vectors depend on the source code. The most common pitfalls are:

1) Sql injection- Make sure each and every plugin/theme only uses prepared queries (this is why you shouldn’t trust a theme/plugin before auditing it yourself).

2) RFI, or remote file inclusion - This is how hackers upload those shells onto your server. If you are not sure how to secure the uploads, don’t enable any kind of upload in the public site atall (example: upload your cv, send us document etc).

3) Cookie stealing - Under no circumstances should a plugin/theme add some kind of authentication cookie that is not httpOnly. If it does, it could be hacked using another attack vector like xss.

4) xss - this is quite uncommon these days, but still, some theme/plugin might have this vulnerability, which can be used with other vulnerabilities to get admin access to your site.

5) DO NOT use a shared host. They are almost always crappy, and have incorrect folder permissions. I probably am going to get some heat for saying this, but if you are serious about your website, stop using shared/reseller hosting. Switch to a vps instead. That way, you are the only tenant in that virtual machine, and you will have much less chance of getting hacked.

There are more, but these are the most common ones I have seen.
Click to expand...
Bad advice, for someone who doesnt know how to manage a VPS you will instead end up getting hacked, I don't like shared hosting either but most share hosting have Immunify360 and Modsecurity installed which protect you to a good extent.
 
ManageManga said:
Bad advice, for someone who doesnt know how to manage a VPS you will instead end up getting hacked, I don't like shared hosting either but most share hosting have Immunify360 and Modsecurity installed which protect you to a good extent.
Click to expand...
I don’t think so. Many providers these days come with one click installers as well. No you don’t need to be very good in managing a vps. Use some panel if you want.

Again I say, Don’t use a shared hosting unless you like being hacked just because some stupid person decided to use a nulled theme for his site.

Either use a completely managed wp solution, or use a vps.
 
Cloudflare but mention what are you using, like wordpress?
 
ManageManga said:
Bad advice, for someone who doesnt know how to manage a VPS you will instead end up getting hacked, I don't like shared hosting either but most share hosting have Immunify360 and Modsecurity installed which protect you to a good extent.
Click to expand...
keeping VPS secure is pretty easy and straightforward most of the times, dont open too much useless ports, use SSH keys for authentication and dont install suspicious stuff
most hacks happen because of plugins or the the software installed, unless you use crappy passwords to authenticate to vps
 
You can use a hoster like https://www.mechanicweb.com/web-hosting.php which protect your website with
- ImunifyAV+ Enhanced Protection
- CloudLinux Operating System (this OS comes with hardening)
- KernelCare Kernel Security
- CageFS Hacker Protection
- CSF & ModSecurity Firewall
- JetBackup Incremental Backup
-...

On the Website/CMS layer, you can install CleanTalk antispam & firewall
https://cleantalk.org/
On the DNS layer you can use Cloudflare
https://www.cloudflare.com/
 
paja93 said:
keeping VPS secure is pretty easy and straightforward most of the times, dont open too much useless ports, use SSH keys for authentication and dont install suspicious stuff
most hacks happen because of plugins or the the software installed, unless you use crappy passwords to authenticate to vps
Click to expand...
+1. To add to this, be sure to run this command once every month perhaps (take backup first)..

Code: 
sudo apt update && sudo apt upgrade -y
The command is for upgrading your operating system, and may vary depending on what flavour of linux you are using. Google how to upgrade your linux if the command above doesn’t work.
 
For wordpress: Cloudflare+AIO WP security+updraft plus with remote google drive for backup
 
The less plugins you have, the safer you are

With the core functionality in wordpress, you don't really need plugins for much these days
 
What tyoe if security? do you need to keep user data safe, or security to prevent hacks?
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top