Are you a website owner or run a WordPress blog? If yes, then you are responsible for ensuring your web server is safe and secure.
Website server security threats are a constant and growing concern. Hackers, cybercriminals, and other malicious actors are constantly developing new methods to breach website security and steal sensitive data, infect systems with malware, or bring down your website entirely.
For owners of websites and blogs it’s essential to understand the most common website server security threats and how to fix them. In this blog post, we’ll dive deep into the world of website server security, discussing the most significant threats, their potential impacts, and the best practices for mitigating web server security threats.
Whether you’re a seasoned website owner or just starting out, this blog post will provide you with valuable information to help you keep your website safe and secure.
Table of Contents
What are the top web server security threats?
Web server security threats are constantly emerging and evolving, but a number of threats consistently appear at the top of web security threat lists. These include:
Unpatched software
The software needed to run your website or blog needs to be constantly updated as security vulnerabilites are found. What software on your web server do you need to update?
Programming language
The software on your web server uses a specific programming language. For instance, most blogging platforms use PHP. It’s important to keep the programming language up to date to fix security issues.
Blogging software
The software that runs your blog. For most websites this will be WordPress, other CMS’s such as Joomla or Drupal are available.
Your hosting provider will usually provide quick install scripts for various types of software. For instance, this is SiteGround’s app installer options:
WordPress will inform you when updates are available. You should update to the latest version quickly as hackers will be quick to exploit any vulnerabilities found.
Use WordPress if you are not sure what blogging platform to use. It is by far the most popular blogging platform on the internet.
Themes
A theme is a collection of software, CSS, Javascript, images and font files that define the visual layout of your website. Themes can contain security issues and need to be updated quickly as well.
Your theme affects not only the security of your website but also the speed and usability of your site. You should choose carefully as it can have a big impact on your SEO and ranking potential.
For a lightweight and fast WordPress theme (the one I use on this site), check out my review here:
Plugins or modules
Depending on your blogging platform new features can be added by installing plugins. WordPress has over 40,000 plugins available for every conceivable feature.
You need to be careful choosing a plugin as some are poorly maintained or even malicious. Check the ratings and comments on the plugin page to ensure you are using a plugin from a high quality source.
WordPress will inform you of updates for your plugins and you can turn on automatic updates of plugins. You should turn on this feature so plugins are quickly updated to the latest version.
Don’t use too many plugins. They slow down your website and increase the attack surface for hackers.
Failure to keep your software current could put you at risk of…
Ransomware
Ransomware is a form of malware that results in an attacker holding their victim’s data or computer hostage. The attacker threatens to block access to, corrupt, or publish the data unless their victim pays a ransom fee.
66%
percentage of organizations affected by ransomware in 2021
Ransomware attacks are typically initiated through emails that contain malicious attachments or links that lead the user’s computer to download malware. The device gets infected by the malware, which looks for files to encrypt and prevents users from accessing them. Ransomware is also spread via drive-by downloading, which occurs when users visit an infected website that downloads malware onto their device without them knowing.
Keep daily backups of your website. You can always restore a hacked site from your most recent backup.
SQL Injection
Structured Query Language (SQL) is a computing language used to search and query databases. WordPress websites (and other blogging platforms) use databases and are vulnerable to SQL injection attacks.
Software (themes, plugins or even WordPress itself) can allow attackers to insert SQL commands that expose sensitive information including usernames and passwords if not written correctly.
Cross-site Scripting
Cross-site scripting (XSS) is a form of web security issue that enables attackers to execute malicious scripts on trusted websites. In an XSS attack, web applications or pages are used to submit malicious code and compromise user interactions. The attacker can then seize a user’s identity to carry out malicious activity, gain authorized access to corporate information, or steal their data.
The script used in XSS attacks prevents users’ browsers from identifying malicious activity. The attacker is therefore free to browse the user’s cookies, sensitive data, and session tokens stored in their browser.
How to secure your web server
Choose a high quality hosting provider to ensure your web server is properly locked down against major threats. Choose a hosting provider with 24/7 customer support. If your site should go down for any reason you want to be able to resolve it quickly.
Hosting provider
This is probably the most important factor that affects the security of your website. Do your research and ensure they take security seriously. You may not want to choose the cheapest option as professional security experts are not cheap to employ
Recommended hosting providers
WP Engine Review: Grow your business with the #1 WordPress platform
Secrets for using SiteGround as your global hosting provider
I use SiteGround for this site and I have never been hacked. WP Engine is also another excellent choice that is highly recommended.
Although it is necessary to choose an good hosting provider it isn’t enough. You still need to ensure you are following the best practises for keeping your web server secure.
Automatic patching of server software
Ensure your hosting provider makes it easy to keep your server software up to date. For bloggers, this will mean WordPress or other blogging software.
You also need to keep PHP (the programming language used by WordPress and other blogging software) up to date.
Restrict traffic by country
You may want to restrict which countries your web server accepts requests from. Depending on where you do business it may make sense to block countries known to have hacking groups such as Russia and China.
This depends on your hosting provider so I provide the solution using SiteGround tools, other hosting providers may or may not provide this feature.
From the Site Tools section for your website select Security then Blocked Traffic. You will see the Blocked Traffic page below:
Select the BLOCK COUNTRY tab and type in a country from the Country drop down box. Then click the BLOCK button.
You can see all countries that are blocked next to the domain and the actions column let’s you unblock a country.
In addition to blocking an entire country you can block an invidual IP address or range of IP addresses.
Web server security best practices
Your website will inevitably be subject to attack by hackers, spammers and bad actors. Let’s review some of the best practices for keeping your blog or website safe.
Daily automated backups
This is crucial. Many of the threats, such as ransomware, are rendered useless if you have recent backups that can be quickly restored. Don’t try to do this manually, you need automatic backups for peace of mind.
Choose a hosting service that provides daily, fully automatic, backups of your entire website.
Enable Multi Factor Authentication (MFA) on your website
This means in addition to your password to log in to your blog or website you will require another authentication method. Typically these other methods are one of the following:
- SMS
- Google authenticator
- Security key
Various security plugins will provide you with 2FA or MFA authentication solutions. For WordPress, it’s easy to setup 2FA. Here is how do this using the SiteGround Security plugin:
This plugin is completely free and works with any hosting service.
Once enabled you can turn on two-factor authentication and connect it to Google Authenticator. Just follow the instructions to set up 2FA.
You should turn on the other site protections from this plugin as well to harden your web server to hacking attempts.
Final Thoughts
Securing your web server from hackers and ransomware gangs should be a top priority. The risks increase each year and you don’t want to wake up one day to find your website hacked.
Here is a reminder of the practical steps you can take to harden your web server to attackers:
- Choose a high quality hosting provider
- Ensure you have daily, fully automatic, backups of your website
- Ensure your software (including programming language, blogging software, themes and plugins) are fully up to date
- Restrict website traffic from known countries with hackers if you don’t do business in those countries
- Enable two-factor authentication for logging in to your web server
If you liked this article please share with your network. You can use the social media sharing below. Thanks!