Secure My Website

HOW TO SECURE MY WEBSITE?

Confidential, Sensitive, and Critical information at stake!

Many websites offer a wide range of services over the Internet. Online services are a way for us to fulfill our dreams and achieve complete satisfaction. It is possible to fulfill your desires or make online transactions.

These are the major vulnerabilities and simple ways to avoid them

SQL Injection

Nearly every website uses SQL statements to access the database based on user input data. If the SQL statement isn’t secured properly, your website could be vulnerable to the injection of small SQL statements that can attack your database from within.

• Potential threats

1. An attacker could gain access to sensitive data
2. Hackers could modify the database’s data
3. Hackers can authenticate unauthorized access to the login page
4. Your system can be completely hijacked by hackers

• Fundamental Solutions

1. To construct your SQL queries/SQL statements, use placeholders
2. To escape, use a special API provided by the database engine
3. Limit the amount of information displayed on the web browser’s error message page
4. Database accounts should be granted minimum privileges

Unchecked Path Parameter

Some websites allow you to specify the name of files on a server by using external parameters. Hackers may be able to execute inappropriate functions if such websites aren’t properly coded. This vulnerability is known as “Directory traversal vulnerability”, and the attack method that exploits it is “Directory Transversal Attack”.

• Potential threats

1. Attackers can disclose sensitive information
2. Hackers can modify source codes, configuration files, and data files.

• Fundamental Solutions

1. Use external parameters to avoid naming files on the webserver.
2. Use a fixed directory to manage filenames
3. You can manage file access permissions and check filenames.

Cross-site Scripting

Few applications require inputs from users to create an output page. An attacker could insert malicious content onto the output page if this process isn’t secured. This vulnerability is known as “Cross-site scripting”. One of the attacks that exploit this vulnerability is the “Cross page scripting attack”. It is possible that the attack may not cause harm to the website, but it could affect the safety of visitors.

• Potential threats

1. Hackers may display a fake webpage on the original website
2. Cookies can be stolen by hackers from web browsers
3. An attacker can instruct the browser to save arbitrary cookie files

• Basic solutions

1. Use variable and hex encoders. Prevent line breaks.
2. When putting URLs into HTML, only allow those that start with certain parameters (HTTP ://, HTTP ://)
3. In HTML text input, nullify script strings
4. Set the charset parameter in the HTTP Content-Type header

What is an SSL Certificate?

SSL Certificate (Secure Socket Layer) is a standard security technology that encrypts communications between web servers and browsers. SSL certificates use a combination of private and public key encryption to secure sensitive information such as credit card numbers, login credentials, email addresses, etc. Additionally, SSL, padlock, and green address bar provide security for online transactions and website browsing.