Learn how to make your website secure against cyber attacks

With a CMS you can edit both the frontend (the part of the website that is visible to visitors) and the backend (the behind-the-scenes technology and data). But they have to log in first. For that log in to the CMS, an admin should choose a password that hackers cannot crack easily – just like you would with all other online activities. Here, we explain how you can create complex passwords and manage them securely:

Stong passwords contain variety

As a first step, passwords should be at least (!) 8 characters long and should always contain a mixture of uppercase and lowercase letters, numbers and special characters. “The (German) Federal Office for Information Security” (BSI) advises to form a personal sentence (for example: “I prefer to eat pizza with four ingredients and extra cheese”) to develop a combination of letters and numbers that you can remember (in this case, for example: “IptePw4i+eC”).
But that doesn’t solve the problem that you need much more than just a password for the many accounts that you use every day.

You could now add an abbreviation at the ends of the respective account that represents the kind of account that it is (for example, WP for a WordPress website and GM for a Gmail account ). But is it possible to remember them all? More than likely, not. Some people write their passwords down in a text document or Excel spreadsheet. Not only is this cumbersome, but it is also still not secure.
Our recommendation is, therefore: Use password managers!

Password managers help you to remember

Password managers work like encrypted digital notebooks. They generate secure passwords and store them either locally, on the respective device, or in a cloud located on the servers of the provider. The advantage of using a cloud-based solution is that you can use the password manager on multiple devices – because all data is synchronized automatically and at all times.

There are various apps and software programs that allow you to organize your passwords securely. We, at codafish, prefer to work with Zoho Vault because this password storage is very easy to work with and contains a host of comprehensive functions.

A password manager needs security, too

Important: It stands to reason that a password manager would also need a password that allows you to have access. This so-called “master password” should be as long and complex as possible – as was described above. In addition, for the highest possible level of security, the latest updates to the password manager app or software should always be run.

Enable two-factor authentication (2FA)

Two-factor authentication (2FA, for short), during login, increases your online security. With this process, the person logging in has to overcome two hurdles (factors). Usually, the password is first queried. In the second step, either an SMS with a one-time code is sent to a smartphone, for example, or an authorization app would be needed with which you could confirm the action. Biometric data such as fingerprint or facial recognition (Face-ID) are also often used for this purpose.

Plugins for two-factor authentication are available for well-known content management systems such as WordPress, Drupal or Pimcore. Alternatively, there are various so-called authenticator apps that you can use to log in to your website or the CMS that powers it.

Secure your backend, as well

The content management system allows you to work on both the frontend and backend of your website. The backend is the area of a website that is especially worth protecting. This is where the technical system is stored and the databases that feed the content of your website are also located. It, therefore, makes sense to also protect the backend – and not just by means of a secure CMS login. There are several options available:

Set up extra login through Basic Auth

To protect your backend adequately, you can secure it with a server-based password. The admin area can only be accessed using an additional user-password combination. A well-known method for this is Basic Auth. In this way, you can protect yourself from so-called brute-force attacks (repeated short-term password attempts).

Hide the backend behind an alternative URL

You can also change the route of backend access. For WordPress pages, the backend can be reached via the suffix /wp-admin. Assign it a different URL instead, so replace the known route www.nameofyourwebsite.de/wp-admin with www.backend.nameofyourwebsite.de.

Allow access only via a VPN

You can also configure your backend so that only the members of a virtual private network (VPN) have access to it. A VPN is a self-contained network in which members can exchange data over an encrypted connection without being visible to others.