Security for websites – how to make your website secure
Written by: Trond Olav Ånesen

The importance of maintaining security online is nothing new. Many people tend to only think about security when visiting a website, but as an owner of a website, no matter what the type of website it, you need to think about security. Informational websites, blogs, online newspaper, web shop or any other.

Security is important for you as an owner of the website, and for those visiting and using the website. In this article we will take a closer look at how to maintain basic security and what needs to be done if an incident occurs.

Security on your website involves:

  • It should be safe for everyone to visit the website
  • The website should not be infected with malicious code that may infect visitors
  • The website should not forward visitors to any websites with malicious code
  • Information exchanged between visitors and website/server should not be accessible to anyone unauthorized

The topic is comprehensive and one article cannot cover it all, but we will focus on the most important; It should be safe to visit your website!

security for websites

Make sure the website is not/cannot be infected

When a website is available online it poses a potential target for hackers. A hacker is not necessarily a man in a black hood in a dark basement. In most cases a hacker is an automated “Bot” (robot). These “bots” are constantly scanning known and unknown websites for vulnerabilities to exploit. Vulnerabilities exist in the code running, directly or in add-ons such as plugins.

A classic example is a website created in WordPress, with a theme and a few plugins installed. Since WordPress is quite popular it is also popular to search for vulnerabilities in this type of installation. If a hacker can successfully infect 1 website, they can potentially do the same to thousands of websites.

The motive behind infecting a website may include; a hacker might want to spread their message, send spam from your account, collect sensitive information from visitors, forward visitors to other insidious websites, use the resources of the account for other attacks and so on. All of the mentioned is of course something you want to avoid. In general, it is rarely you directly,  they are targeting.

Checklist to avoid having your website infected

  • Everything must be updated, always
    Since WordPress (and other similar systems) is popular, when vulnerabilities are found, improvements are made and updates released. It is important to update when new ones are released. As soon as a vulnerability is detected and known, it is only a matter of time before the websites not updated will be attacked. The same goes for anything installed on the system. As we mentioned in our example, we have a theme and plugins running. These can also contain vulnerabilities and developers release updates correcting this. It’s therefore important to keep both theme and plugins updated as well as the installation itself.
  • Anything not being used on the hosting should be removed
    Any theme or plugins not being used should be deleted/removed. Even if you deactivate a plugin or a theme everything is not actually gone. Files are often left and can potentially be abused. This means; only what is necessary to keep the website running optimal should be openly accessible. Anything else must be deleted or moved to an unreachable area.
  • Use captcha for forms
    Forms; contact forms, order forms and similar must be secure so they cannot be completed automatically. The “bots” we mentioned before can also be used to abuse forms, when available and send spam from website/account. This will affect the visitors in two ways:
    1. Resources for the hosting can be used for this, preventing visitors from loading the website.
    2. Causing abuse of such a magnitude that the account will be suspended to avoid further issues. Suspension means the website will be offline and not available for visitors. All forms where visitors can fill in information, should have an extra check. Captcha is the most common (and recommended) check for this.

security for websites

  • Password must be secure
    A secure password is long and composed by numbers, small and uppercase letters and other characters. Long password can also be sentences or phrases with random numbers/letters more easy to remember. Password is used on our client portal, hosting, email and the website/installation. The password used the most is also the most vulnerable. You should change password at least a few times each year. You should never use the same password several places.
  • Implement extra security wherever its possible
    For many CMS (WordPress/Joomla/Drupal) special plugins are developed focus solely on security. Check what needs you have and install what you think is best for your website and needs. There are several decent free options, but if you have a larger website with heavy traffic it can be worth paying for the extra security. Sucuri (sucuri.net) provides a free plugin as well as a paid version and is known for value for money.

security for websites

  • Make sure to always have a backup of your content
    You should always make sure to have a backup of your content. All of our clients have access to the best solution in the market for backup. At PRO ISP you have access directly to your backup via the control panel (cPanel). Backup is performed once each day of all the content and is kept for 30 days. In addition to the backup solution with PRO ISP we recommend always having an external backup. Once each month or once each quarter, depending on how critical it is and how many changes you are willing to lose.

Website has been infected, what to do?

What if the damage has already been done? What if your account has been suspended by PRO ISP? This can happen to anyone and most people experience it as unfair.
All hosting companies operate the same way when it comes to hosting; several hosting share resources on the same server. To illustrate, imagine the server as a hotel and the clients account as hotel rooms in the hotel.

When a hosting company detects resources being abused, this must be stopped to avoid it affecting the other clients in the same hotel. Imagine a hotel room with so many visitors that no other guest can get in or out of their room. The room creating the problem will have to be closed to avoid this. Its not always an account will be shut down, but if signs of hacking/abuse is noticed we can notify directly.

The most important in such cases is; follow the instructions given and ask for tips/advice/guidance if you are unsure.

If we detect hacking/abuse, and either give notice or suspend the account, we always give instructions on what needs to be done.
In most cases the hacking is so recent you can use a backup included in the hosting. The procedure is easy:

  • Delete content on hosting related to the website.
  • Restore content from a date before hacking/abuse occurred (if you are unsure, use the oldest backup available)
  • Review all the mentioned measures above to prevent further hacking/abuse. Update everything, secure all forms, change all passwords and implement extra security

If you do what is recommended and follow this you are as secure as possible. Both you as the owner of the website, the visitors, and we who serve the website form our servers will be happy.

Secure information between visitors and server (SSL certificate)

Security certificate is becoming more and more relevant to discuss, and highly useful when it comes to security for websites. We have previously had articles about “SSL certificate- How to chose the right one” and how larger suppliers are planning to force more and better use of this to maintain security online (“Google warns: Secure your website”). Now it is about to get a little technical but we will need to explain some technical stuff:

SSL* is an encryption protocol, or a set of rules telling a server/client (website and visitors) how encryption of the data will be executed. The encryption is the process of making something unreadable or incomprehensible to others.

* In reality TLS is used, but SSL and SSL certificates are used in everyday speech so therefore also in this article.

The end goal for SSL is to make sure the visitor, and the server/website, will be able to read the data sent between these two parties. It is therefore essential when personal and sensitive data is exchanged, such as phone number, username, password, e-mail addresses, credit card information and similar; because we do NOT want this information seen by others.
security for websites
In order to enable this encryption we use “keys”. When the visitor and a server/website have the same kind of “key”, only they can read, and encrypt the information. An SSL certificate is a certificate confirming the ownership of the “keys”, and that they are authentic and valid. How thorough this confirmation is, depends on the certificate, read more about it in “SSL certificate – How to choose the right one”. In short terms the certificate confirms it has been issued by a valid issuer, for the website visited, and its validation for this. As a visitor, you can see this by the green padlock in the address field and that the browser reports the website as secure.

As mentioned in “Google warns: Secure your website” encryption of information is highly relevant since it will be a demand soon. You can of course avoid using SSL certificates, but visitors of the website will be receiving a warning when entering your website. This warning can compare to shouting at your customers: “I do not care about security”. If you have not made the transition from http to https the time is definitely now!

Du you have any questions?

In the beginning of the article we mentioned security is a quite large topic and cannot be covered in one single article. Still, follow the advises given, and be more aware of security you will have come a long way already.

Did you read the article and is left with many questions? Do you want some guidance? Please, do not hesitate to contact us.

Epost: support@proisp.eu
Facebook: https://facebook.com/proisp.eu/

Facebooktwittergoogle_pluslinkedin

WooCommerce: Build a webshop easy as 1-2-3!
Written by: Simon A. Skaar

When you want to build a webshop, there are many options to choose from, such as OpenCart, CSCart, Magento and WooCommerce. All of these are eCommerce platforms where you can administrate everything from orders, products, storage, shipping and taxes. In this article we will take a closer look at WooCommerce, which is one of the largest plugins for WordPress.

What is WooCommerce?

Today WooCommerce is used on millions of webshops and about 39% of all webshops worldwide. In Norway 38% of webshops uses this platform. There are many good reasons why you should use WooCommerce. It is basically free, based on open sourcecode, with the option of buying and adding extensions for all purposes. WooCommerce gives you full control over all your products, customer data, orders and so on. You can also sell any type of products, both physical, virtual, subscription services and other types.

In the video below, you will see an introduction on how WooCommerce works.

 

How to install WooCommerce?

Since WooCommerce uses WordPress as a “base” you will need to already have WordPress installed. If you are a customer at PRO ISP WordPress can easily be installed with a few clicks (follow this guide for installation). When using WooCommerce and WordPress we recommend using LiteSpeed that is included in our Pro Medium/Premium web hosting.

In WordPress admin panel you can easily install and active WooCommerce like this:

Plugins – Add new – Search for WooCommerce – Install – Active

woocommerce

 

 

When WooCommerce is activated you will receive a step-by-step guide for the different functions on the website. After the installation you can add different types of extensions.

How to use WooCommerce

For a thorough guide on how to use WooCommerce we recommend WooCommerce step-by-step-guides with both pictures and videos. You will learn how to set up your webshop and how to administrate it. The video below is one of the training videos and will show you how to get started with WooCommerce.

 

Payment options within WooCommerce

We recommend you give your customers the option of paying directly in adddition to via invoice. Direct payment with VISA/Mastercard (creditcard) can be done via PayPal. The customer can either use their account with PayPal (where all the cardinformation is stored) or without an account.

Another option is STRIPE. This option works the same way most online card terminal does. The customer adds their card details and the amount is withdrawn and transferred to your account within the next few days. The difference between STRIPE and PayPal is with PayPal you need to transfer the money manually.

If you want to use invoice within WooCommerce, we would recommend taking a look at the extension from Klarna. With this extension the customer can choose between invoice and down payment. In Norway Klarna is a well recognized brand so this can boost sales. To be able to use Klarna, you will need to register with them. Only registered companies can create accounts for sales with most vendors such as Klarna. The downside using invoice instead of direct payment is that invoice usually recuires more work in terms of follow-up via bank or other costly services.

Secure your webshop with SSL certificate

You often need an SSL certficate for encryption. We highly recommend having every site on the website secured (not just the webshop). Show your customers you can be trusted because security is taken seriously.

SSL certificate can also increase conversions for your webshop and give your website higher ranking in search engines. PRO ISP have different types of certificates you can read about.

SEO plugin

SEO is one of the most important measures you can take to increase traffic to your website. SEO is short for “search engine optimization” and we recommend you read: “SEO – what do I need it for?”. There are also plugins to help with SEO for your website, such as YOAST SEO (free). WooCommerce also have their own SEO plugin (not free).

Sources:
Statistics for the usage of WooCommerce

Facebooktwittergoogle_pluslinkedin