Website security (need it or not)

ndwgolf

ndwgolf

Messages
4,361
Name
Neil Williams
Edit My Images
No
Around about 7 years ago I got interested in the internet due to my interest in photography. Prior to that the internet was just a source of pleasure “if you know what I mean”
Anyway it was around 7 years ago when I contacted a guy in India about starting my own photography website. I sent him some links from the internet that of other people’s websites and in return he sent me a Mickey mouse link to what my new website was going to look like. I was well impressed and decided to hire him to get the website live (I actually bought leicamm.com because I just bought a Leica MM).

Anyway I guess it took a week or so to figure out how to add photos and then it was full on, I would go out and shoot and post shoot and post. Internet security, virous or malware never crossed my mind and I just kept adding plugins updating without checking first etc etc.

About two years ago my website crashed and it cost me over 200 quid to get it back, at that time I was told to install yet another plugin to back up my website so that’s what I did and over the last 2 years I have had to go back a few days to a backup because the Whocommerse wasn’t compatible or one of the other plugins didn’t like one of my pictures.

Last week I got an email from WordPress saying that my site had been attacked and it needed my attention. So I tried to open my bebsite and I got a “your website is a security risk” or something to that effect and I needed to contact the administrator ( WTF. That’s me).

I no longer have the Indian guys contact details so I decided to message my website host and seek there help. I was talking with a guy called Andrew and he informed me that my website has been disabled due to a malware attack, he told me that it was outwitted there scope of work and recommend a few website security providers. I looked on the internet and decided to go with ABC as they have a FREE malware removal scan. I gave them my website details then they started emailing me asking for DNS and cpanel details and I didn’t have a clue what they were talking about. I told Jim that I was a roughneck and that he needed to talk to me like a roughneck not a IT geek.

Cut a long story short. Jim started blaming Andrew and Android was blaming Jim. Eventually Andrew messaged me and suggested that I deleted my old website and he would reinstall a new WordPress for me with the same domain. I hummed and hadded and decided that my old website was starting to look like sh!t and now was a good time to do a refresh and start a new website. I emailed Andrew and asked him to go ahead with the new install, whereupon he hit me with a bunch of disclaimers.......... 5 emails later my old website was gone and a new one was waiting for me to decide what theme I wanted. I searched the internet and decided on ABC as there theme is designed for photographers. It cost me $90 something bucks for there software and a promise of a email with the link to the download. It’s 8pm and I’m waiting, waiting’s and bloody waiting. No confirmation email from Paypal no download email from ABC. I went to bed p***ed off at 11pm. I got up at 4 am and still no email. I emailed them and told them in roughneck terms what I thought of there software and still no email.

Next morning I went to play golf and mist have restarted my iPhone 6 times to see if I would get there email. Google was warning me that there was something wrong with my email. I’m thinking the bastaed have now hacked my email. When I got home from golf I went online and tried to get email via google (no luck) then like a light switching on I decided to chat with the host of my website in the UK to see if there was a connection between deleting my website and me not receiving emails ( I must have called at least 6 friends and asked them to email me, no reply).

Andrew cane online and we started chatting, I was like what’s happened to my email where open he told me to wait... 10 minutes later he told me that when they deleted my website they didn’t redirect my domain name back to Google and that I needed to give him my DNS and MX details. What I gave him was a mouthful of xxxxxx.

After I calmed down he asked me to be patient again while he tried to fix the problem. 30 minutes later Andrew (bless him) had sorted my email issues and said I was going to go in 24 to 48 hours time. I’m like WTF. This can’t be happening.

Anyway about 2 hours later I got my first emails in two day and the first one was with my new theme login details.
Here we are 2 days later and I now have a new up and running website..............Im sure that there will be some glitches but at least this time I have security along with an SSl, DNS, MXS and all the bells and whistles 

New website can be sean HERE
Neil
 
I think that sounds more like Wordpress vulnerability rather than SSL related.

Wordpress over the years has had a tonne of security flaws allowing people to gain control over sites. Always make sure it, and any Wordpress plugins, are up to date.
 
Hi ndwgolf, I feel your pain, I had my wordpress website hacked numerous times despite it having a 17 character complex password and admin username changed to something else. It was becoming a pain that is until I installed the security plugin WordFence.
After I configured Wordfence to block the IP addresses of all incorrect password attempts and lockout period was set to two days. WordFence by default also blocks things like sql injections and forced use of password reset form. This has stopped successful hacks of my website but the very regular emailed reports from the Wordfence plugin shows that the B'Stards from all over the world are from trying. to hack my site. Unfortunately having a desirable URL attracts more of these hacker t***s.
 
Last edited:
Just in case anyone thinks different let me just put this out there.. you do not need wordpress or any other "thing" like it to have a website.. if your going to pay someone to make a website i would pay someone to actually make it and not use a third party website making kit :(

PS you can tell a wordpress website a mile off.. they all look bog standard IMHO Well the ones i see on here do :)
 
For those of us that are not natural born natural coders, WordPress, Joomla, Drupal and all the other similar frameworks are the only option as far as I know. If there are any better please tell.
 
Last edited:
redsnappa said:
For those of us that are not natural born natural coders, WordPress, Joomla, Drupal and all the other similar frameworks are the only option as far as I know. If there are any better please tell.
Click to expand...


Surely if your getting paid then you should be a coder ? It's not hard to learn..
 
KIPAX said:
Surely if your getting paid then you should be a coder
Click to expand...
Thankfully nobody in their right mind would pay me to code a website & thankfully options like WordPress exist for those of us strange people who do not find coding easy.
 
Last edited:
Jeez......anyone can learn to build a website from scratch..... !

Who're you kidding?

My site was hacked a few months ago and it took a lot of work by a kind and knowledgeable neighbour to clean it up. I'm still working on a new off-the-shelf site with more security but tbh, it's a pain in the butt.
 
I’m sure kipax means that if you are paying someone good money to make you a website they should be coding it themselves not just using a template software
 
Even then, you'd likely be getting the coder's own templates, bolted together into what you want.
A secure, web-facing blog style dynamic site, plus a shopping cart, coded from scratch would not be an economic investment for a private individual.
 
LCPete said:
if you are paying someone good money to make you a website they should be coding it themselves not just using a template software
Click to expand...
So you end up paying your tame coder more money than is necessary as you demand that they write code that is already out there in the public domain.

Kipak If you have coded your website yourself congrats. Ok It does not look polished like template sites especially the 1990's clipart but it works extremely well, drilling down to any required photo is as easy as pie, the user experience is great. well done.
 
Last edited:
Thanks for all the feedback. I now have my website secure (well as secure as I am willing to pay) and I am happy with the outcome. There are still some SEO stuff too do but to be honest Ive already started getting bored with that, so will do some more when i feel the urge
Neil
 
KIPAX said:
Surely if your getting paid then you should be a coder ? It's not hard to learn..
Click to expand...

Why pay some loads of money to create something not quite as good as a template can be?

I get your needs are different to me, but it doesn’t make much sense.
 
ndwgolf said:
What I gave him was a mouthful of xxxxxx.
Click to expand...
Good job (for you) you're not our customer, as you'd have lost access to support for that. Immediately, as in the phone would have been put down and further contact would not have been accepted until a formal written apology and undertaking to be polite and courteous in future was received in the post by our CEO.

We have a zero tolerance policy on abuse of our employees by customers.
 
onomatopoeia said:
Good job (for you) you're not our customer, as you'd have lost access to support for that. Immediately, as in the phone would have been put down and further contact would not have been accepted until a formal written apology and undertaking to be polite and courteous in future was received in the post by our CEO.

We have a zero tolerance policy on abuse of our employees by customers.
Click to expand...
Exactly mate
 
I produced my own website originally many years ago straight HTML code but the current version is produced using Dreamweaver and jquery. I make no special claim but it suited me and was mainly to provide a means of explaining some photographic techniques along with a few of my images. This is mainly useful to me to direct other club members and sometimes forum members to specific topics rather than to explain them many times. I had envisaged expanding to more techniques and updating regularly but finding the motivation and time is difficult. Last year my ISP contacted me and said my files had been contaminated and they had to delete all my files; I would need to remove the infection from PC. I was very surprised for several reasons; my PC was clean but I had not updated the website files for over 2 years and it had been fine all that time. It seems obvious to me that the infection came from an attack on their server. Perhaps my code makes it a little more vulnerable but they did not claim this and insisted, I must have infected it from my PC. In the end all I did was to copy the files to the server again from my PC and the site has been fine for another 12 months; I must update soon!!!!

Dave
 
Some interesting points of view aired above.

WordPress is just a content management system (or CMS for short). There are a good number of them out there. Using a CMS makes a lot of sense in many situations and I wouldn't condemn a website provider for using it. There are other CMSes I prefer, such as GravCMS because they don't depend on a database. That makes both deploying them (and backing them up) much easier.

When I develop a website (which is essentially just a set of files), I commit changes to a Git repository and those changes are then automatically deployed ('copied') to a demo site. Using a Git repository (source control) means that I get a full history on each change and why it was made. When I am happy with the changes, I simply press a button and latest version of the website is deployed to a public web server. If I am making changes to a website for a 'customer', that person can see and approve the changes first.

This is good. Essentially, I never have to back a website up. It is in a source controlled Git repository (which itself gets backed up) and if something happens to the live website*, all I need do is re-deploy it by pressing a button.

*assuming the hosting environment is okay

WordPress is difficult to manage in a deployment pipeline such as this, because of the database aspect of it.
WordPress was also bad choice because they dragged their heals on implementing any cryptography for signing updates and plugins so that they could be authenticated before getting applied. That meant anyone could potentially hack an update that would then be automatically applied to dozens if not thousands of websites. It looks like this was finally fixed in version 5.2.

Website security is not binary. It is not fair to say that a website is or is not secure. Security runs on a spectrum.

The website itself is only part of the picture as far as security is concerned. The hosting environment has to be considered as well, both from the perspective of the server that the website is running on, as well as the servers that the website itself is relying on for content. When you load a webpage these days, chance are that it is loading javascript, images and plugins from other servers and content delivery networks (CDNs).

Many websites share hosting with other websites, which increases the risk profile substantially. It also increases the reliance upon the hosting provider to provide sufficient isolation between the websites that are hosted on the same server/cluster/infrastructure. It is possible that a nefarious actor would deliberately upload malware onto 'their website' because they are trying to exploit a shared hosting environment in which many other legit and trusted websites are hosted.

To really have a secure, highly available website, you either need to know what you are doing or be able to involve someone else who does know what they are doing, irrespective of whether they use a CMS/WordPress or not.
 
Last edited:
I have hired Comodo to look after the security of my website and up to now I’m very happy with there service
 
You must log in or register to reply here.
Back
Top