Hackers at the Gates: 8 Strategies to Defend Your Website from Cyberattacks

28 November 2018 Gary Stevens

Your website is one of the most important business resources you have.

What would happen if someone were able to hack those pages and alter or replace them? Or harvest proprietary data that you collect through your website?

The odds are that some guy or girl with bad intent is testing your website’s security measures right this minute. Now, if not sooner, is the time to make sure you have as many levels of protection in place as possible.

The following measures are a good place to start.

Invest in Security Software

Much of the data related to your website is saved on a company server, but how secure is that server? If you don’t have software that provides decent protection from spyware, malware, and possible viruses, you need to get serious about changing that reality. There are a number of packages on the market that effectively block the most common hacking strategies.

The best among them do more than simply protect and archive data. They will also alert you that an attempt was just made. Knowing the nature of system attacks lets you more precisely target your future security efforts.

You Really Do Need a Firewall

A firewall should not be considered optional. It stands as an effective barrier between the bad guys and your website data. Getting hacked is a personal violation. It’s like coming home to find the carpeting ripped up, photographs on the wall smashed, and clothes in your closet cut to ribbons. It’s a similar feeling when your website is breached. A firewall is the “home security system” that makes it harder for a hacker to get in and mess things up.

A Proxy Server is a Smart Move

An increasingly common choice in the pursuit of maintaining online privacy is to use a proxy server. An easy way to think of it is as a middleman (server actually) that stands between your computer and your usual web server. The purpose is to hide your computer’s physical location by routing the connection through a geographically removed server before it passes through your ISP.

How does that help keep hackers out? While not insurmountable, a proxy server forces a potential hacker to go through an extra step before finding your system. With so many easy targets online, sometimes taking a few simple precautions is all that’s needed to persuade an attacker to look for an easier game.

Use Multi-Factor Authentication

Multi-factor authentication is a great way to prevent hackers from figuring out how to login to your website. Even if the hacker does discover one of the points of authentication and attempts to use it - say a username and password - there will be two, three, or even more bits of information that must be provided from alternate sources such as a one-time code sent to a mobile device..

It’s true that this approach requires extra effort to access your site but keep in mind that this small annoyance means the odds of someone else being able to use your credentials drops significantly.

Be Stingy With Administrative Rights

While on the subject of using authentication to gain access to those web pages, take a good look at how you have administrative rights set up. Review the rights held by every member of your team and decide if access to certain pages or data should be restricted.

The goal is to ensure every employee has access to the information needed to do his or her job, but nothing more. Ideally, there should be a few people as possible with high-level access.

Establish a Document Opening Protocol

One of the first lines of defense against hackers is your own brain. You should already understand that opening certain types of files received via email, text messages, or through some other sort of messaging program is suspect. But what about those that you normally think of as safe? You need specific procedures in place for opening any file that is not created and used only within your protected network.

For example, you receive a couple of PDF files from what appears to be a trusted outside source. The accompanying message asks that you review and make any changes you think are needed. What do you do? What you’re told, of course. Bad idea!

You should never edit PDF files from outside sources without running it through a malware and virus checker. Many people don’t realize that this format can be infected just like any other. If you open it without checking, your network could be penetrated.

Find Out What Your Host Offers

While there’s a lot you can do on your end, it pays to find out what sort of security features are included with your web hosting service.

Today’s security-conscious small businesses realize that a web hosting provider needs to offer a few security tools along with the package. For example, one popular host includes a feature with all plans that warns if your password is weak and susceptible to brute force attacks. You’ll be given several opportunities to strengthen it but then your account will be disabled until you do.

If your host also offers security plug-ins to go with page templates, make use of them. Those plug-ins, when properly installed, will not slow page loading to any significant degree and will serve as a decent obstacle for hackers to overcome.

While such options are not going to make your website completely impervious to attack, they are a good first line of defense. Think of it as a way to create additional barriers that slow hackers down and keep them at bay. A good rule of thumb: if it slows down hackers, it increases the odds your other defenses will trigger and keep them out completely.

Don’t Overlook Physical Security for Devices

It may seem a bit old school, but did you know the easiest way to hack a website is to steal a device that has all the access codes saved on it? That could be your smartphone, tablet, or laptop. A hacker could even break into your office and take off with a laptop computer that functions as a server or have a field day grabbing primary and secondary servers. You won’t know the difference until the theft is discovered. At that point, it’s too late.

Keep track of who has been issued company-owned devices. Lock them up when not in use. Require employees to create tough to guess passwords and not save their login credentials on those devices. Once again, these few seconds you must spend manually entering passwords keeps a would-be thief from gaining easy access.

Final Thoughts

Never assume your website and data protection process is complete. New hacking strategies are developed every day. It’s up to you to regularly review your security processes and tweak as needed. The bottom line is the more barriers you throw in front of hackers, the better your chances of not losing a company or customer data. That scenario makes for a bad day at the office.