Most people on the Internet are good, honest people. However, there are some people who surf the Internet and enjoy fiddling with websites and finding vulnerabilities. A few simple tips can help you protect your website in basic ways. Now, frankly, the issue of data security is complex and far beyond the scope of this column. That said, I'm going to touch on the basics to do, which will mitigate many potential issues that could allow people to see things they shouldn't.
Password Protected Directories
If you have a directory on your server that should remain private, don't trust people to guess the name of the directory. It's better to password protect the folder at the server level. More than 50% of websites are powered by servers, so let's look at how to password protect a directory in Apache.
Apache receives its configuration commands via a file in the directory called .htaccess. Commands in .htaccess have an effect on that folder and any subfolder unless it has its own .htaccess file inside a particular subfolder. Apache also uses a file named .htpasswd to password protect a folder. This file contains the names and passwords of the users who have been granted access. The password is encrypted, so you should use the htpasswd program to generate the passwords. To access it, go to your server's command line and type htpasswd. If you get a "command not found" error, you should contact your system administrator. Also note that many web hosts provide web-based ways to secure a directory; so they may have things set up for you to do it this way instead of doing it on your own. Let's go ahead and block this.
Type “htpasswd -c .htpasswd myusername” where “myusername” is the username you want. You will then be prompted for a password. Confirm and the file will be created. You can double check this via FTP. Also, if the file is inside your web folder, you need to move it so that it is not accessible to everyone. Now open or create your .htaccess file. Inside, add the following:
AuthUserFile /home/www/passwd/.htpasswd
AuthGroupFile /dev/null
AuthName "Secure Folder"
AuthType Basic
requires valid user
In the first line, set the directory path to where your .htpasswd file is located. Once this is set, you will see a popup dialog when you visit that folder on your website. You will be prompted to sign in to view it.
Close Directory Listings
By default, any directory on your website that does not have a recognized homepage file (index.htm, index.php, default.htm, etc.) will instead display a list of all files in that folder. You may not want people to see everything you have there. The simplest way to protect against this is to create an empty file, name it index.htm, and then upload it to that folder. Your second option is to still use the .htaccess file to disable directory listing. To do this, simply add the “Options - Directories” line to the file. Now users will get a 403 error instead of a list of files.
Remove Installation Files
If you install software and scripts on your website, they often come with installation and/or upgrade scripts. Leaving them on your server is a huge security issue because if someone else is familiar with this software, they can find and run your install/upgrade scripts, thereby destroying your entire database, configuration files, etc. can reset. A well-written software package will alert you. you must remove these items before allowing you to use the software. However, make sure this is done. Simply delete the files from your server.
Follow Security Updates
Those who run software packages on their websites need to keep in touch with updates and security alerts for that software. Failing to do so could leave you completely open to hackers. In fact, often a glaring vulnerability is discovered and reported, with a delay before the software's creator can release a patch for it. Anyone this eager could find your site running the software and exploit the vulnerability if you don't upgrade. I myself burned several times, all forums were destroyed and I had to restore from backup. It's possible.
Reduce Your Error Reporting Level
I'm mainly talking about PHP here, because that's what I'm working on, errors and warnings generated by PHP are, by default, printed in your browser with full information. The problem is that these errors often include full directory paths to the scripts in question. It gives a lot of information. To mitigate this, reduce PHP's error reporting level. You can do this in two ways. One is to set your php.ini file. This is the main configuration for PHP on your server. Look for the error_reporting and display_errors directives. However, if you don't have access to this file (most people on shared hosting don't), you can also reduce the level of error reporting by using PHP's error_reporting() function. Add this to a global file of your scripts so it will run across the board.
You must be logged in to post a comment.