Learn how to make your website secure against cyber attacks Explained
How to secure your website!
When a person owns a shop, they make sure to lock everything up when the day is done. For particularly valuable products, special roller shutters are sometimes lowered and alarm systems are activated. And even during opening hours, there are numerous ways to protect goods from unauthorized access. And online?
Of course, you should also add such security measures for yourself! In this blog post, we explain what you need to pay attention to so that your company’s online presence is well protected. Behind a website, there is usually a content management system (CMS) that allows the admin to access the website.
Use complex passwords
-
Strong passwords contain variety
As a first step, passwords should be at least (!) 8 characters long and should always contain a mixture of uppercase and lowercase letters, numbers, and special characters. The German Federal Office for Information Security (BSI) advises creating a personal sentence (for example: “I prefer to eat pizza with four ingredients and extra cheese”) to develop a combination of letters and numbers you can remember (in this case: “IptePw4i+eC”). But this still doesn’t solve the problem that you need much more than just one password for the many accounts you use every day. You could add an abbreviation at the end of each respective account that represents the type of account (for example, WP for a WordPress website and GM for a Gmail account). But is it possible to remember them all? More than likely, no. Some people write their passwords in a text document or Excel spreadsheet. Not only is this cumbersome, but it is also not secure. Our recommendation is, therefore: Use password managers!
-
Password managers help you to remember
Password managers work like encrypted digital notebooks. They generate secure passwords and store them either locally on the device or in a cloud operated by the provider. The advantage of a cloud-based solution is that you can use the password manager on multiple devices, as all data is synchronized automatically at all times. There are various apps and software programs that allow you to organize your passwords securely. At codafish, we prefer to work with Zoho Vault because this password manager is easy to use and offers a wide range of comprehensive features.
-
A password manager needs security, too
Important: A password manager also requires a password that gives you access. This so‑called “master password” should be as long and complex as possible, as described above. In addition, to achieve the highest possible level of security, the latest updates of the password manager app or software should always be installed.
-
Enable two-factor authentication (2FA)
Two-factor authentication (2FA), used during login, increases your online security. With this process, the person logging in must pass two hurdles (factors). Usually, the password is requested first. In the second step, an SMS with a one‑time code may be sent to a smartphone, or an authentication app may be required to confirm the action. Biometric data such as fingerprint or facial recognition (Face ID) are also often used for this purpose. Plugins for two-factor authentication are available for well-known content management systems such as WordPress, Drupal, or Pimcore. Alternatively, you can use various authenticator apps to log into your website or the CMS that powers it.
Do the website security check
- Do you use secure passwords or a password manager that generates complex passwords for logging in to the CMS?
- Have you enabled two-factor authentication for all logins?
- Have you also protected your backend with extra logins, an alternative URL for the admin area and / or access through a VPN?
- Do you use anti-malware programs that protect your business from digital attacks by viruses and other malware?
- Do you regularly sort out unnecessary admin permissions so that only a limited number of people have access to the sensitive backend?
If you have answered, “Yes”, to all of these questions, then you can sit back and relax. Any “No” or “Don’t Know” answers, on the other hand, could signify a security gap. If you want to play it safe, we would be happy to support you!
Secure your backend, as well
-
The content management system allows you to work on both the frontend and backend of your website
The content management system allows you to work on both the frontend and backend of your website. The backend is the area that is especially worth protecting: this is where the technical system and the databases that feed your website’s content are located. It therefore makes sense to protect the backend as well – and not only through a secure CMS login. There are several options available.
-
Set up extra login through Basic Auth
To properly protect your backend, you can secure it with a server‑based password. The admin area can only be accessed with an additional user‑password combination. A well‑known method for this is Basic Auth, which protects you from brute‑force attacks (repeated rapid password attempts).
-
Hide the backend behind an alternative URL
You can also change the backend access route. On WordPress sites, the backend is usually reached via /wp-admin. Assign an alternative URL instead, replacing the known route www.nameofyourwebsite.de/wp-admin with www.backend.nameofyourwebsite.de.
-
Allow access only via a VPN
You can configure your backend so that only members of a virtual private network (VPN) have access. A VPN is a closed network in which members exchange data over an encrypted connection without being visible to others.
-
Malware
Malware is short for “malicious software,” meaning harmful software you should protect your website from. There are many anti‑malware programs, often called “anti‑virus programs,” although malware and viruses are not the same. Malware is an umbrella term for viruses and other harmful intruders such as spyware, adware or ransomware. Our tip: invest in software that comprehensively protects your company against cyberattacks. Make sure it detects and blocks spyware, adware and ransomware in addition to viruses. The product name alone is not always reliable, as some tools use the term “anti‑virus” even when designed to fight other malware types. Always check the product description carefully.
-
Check the admin permissions
How many people in your company have CMS admin access? In larger companies, it is advisable to review permissions regularly and consider whether you really need that many administrators. Admins have special privileges, and every intervention carries the risk of mistakes. Therefore, admin rights should not be distributed too generously.
Let's get in touch
With us, you have one partner for all your digital needs. From strategy and consulting to development, marketing and ongoing support, we help you build, connect and optimise your digital systems. We work with you from the initial idea through implementation and beyond, supporting your digital transformation every step of the way.
codafish ><> your digital agency
+1 888 9263234
hello@codafish.netFeel free to contact us for a free initial consultation. We’d be happy to hear from you!
The data provided will be transmitted in encrypted form and treated in accordance with the data protection law. You can find our data protection information here.
Create digital growth that fits your business.
From strategy to SEO, development and support – let's build it together.
Don’t hesitate to call us for a free initial consultation. 30 minutes, with no obligation. We’ll be happy to speak with you! +1 888 9263234
