Unfortunately, over half (54%) of the businesses surveyed for the 2018 State of SMB Cybersecurity report believe they’re too small to be a target for hackers. But the data paints a different picture:
In reality, businesses aren’t failing to secure their websites because they believe they’re too small to attract the attention of hackers. The truth is, most point to a lack of resources to explain why they forego security. Here are the top three reasons given:
But here’s the thing: websites are not difficult or expensive to secure. You just need to know which security measures are absolutely necessary for a website to have and where to procure them.
Here’s where you should start…
Your choice of web host can affect your website in a number of ways, including how well it’s protected from hackers.
For starters, if security is at all a concern for you (or the client you’re building the site for), then a shared hosting plan won’t be ideal. If any website on the shared server is attacked, it could easily spread to your own.
Secondly, if your web host doesn’t prioritize security on its end, it’s a good idea to look elsewhere. While many web hosts do a good job of this, be wary of the ones who provide no information about their dataccenters, how their assets are secured, or what level of security has been implemented (e.g. physical facility monitoring, server firewalls, etc.).
Finally, look for a web hosting plan with built-in security features. It’s not necessary for hosts to go above and beyond with this, but it’s a good sign when they’re willing to lend a hand.
One of those security features your web host should be able to throw in (even if it’s a paid upgrade) is an SSL certificate. It’s a form of encryption that turns a regular ol’ unsecured HTTP website:
Into one with an extra layer of protection and an HTTPS address:
You can see how my Chrome address bar calls attention to the differences in security. HTTP websites receive a “Not Secure” label while HTTPS get a trust mark either in the form of a lock or a green label.
Google’s algorithm does something similar when it ranks websites, penalizing those without this security feature and rewarding those that have it.
While you may be able to control how you design or code a website on the front end, you may not have a lot of control over the code behind it all. What’s more, any time you add a new extension, the integrity of that code now has a chance to affect your site as well.
To start, choose your software wisely, including:
Even if you don’t know how to review the integrity of the code, look at user reviews. Are there any glaring issues with vulnerabilities introduced by the software? If so, steer clear.
In addition, the software developers should always be working to improve it. That’s why, depending on which software you use, you may see the occasional update to patch bugs, performance issues, and vulnerabilities.
If you don’t see these updates or the provider has a reputation for not supporting their software, that’s another reason to find another solution.
With each new application we add to our workflow, a new password needs to be generated. And while you might know that it’s bad practice to use the same or similar passwords across all applications, do your clients? Or anyone else with access to the website?
A weak login is the easiest way for a hacker to get inside a website. By enforcing a password policy across the board, you can help safe-guard against brute force attacks.
Now, some site builder solutions enable you to hide the login URL or to implement two-factor authentication. It’s a good idea to take advantage of those if you can. I’d also suggest requiring stronger passwords.
A long string of letters, numbers, symbols, and capitalization will help hackers from being able to guess your users’ login information.
Even if spam isn’t too much of a concern, it’s a good idea to keep it from ever going near your website, even if just to remove the nuisance factor.
To protect your contact and comment forms from spam, there are a few things you can do. You can use a spam-blocking plugin, which turns spam into an out-of-sight, out-of-mind matter. You can use a reCAPTCHA like the one used on this website:
It’s just an extra step humans need to take to confirm their human-ness.
You can also implement a honeypot. Essentially, it’s a hidden field laid down as a trap in a form. Humans can’t see it and, so, they won’t know to fill it out. Spam bots, however, will see it and fill it out.
Ideally, your website should be running on a secure server. However, it’s not really the host’s job to ensure that your website is protected from every angle.
To make sure your website is covered as much as possible, look for a high-quality, all-in-one security plugin. It should include things like:
It should also have a monitoring system built it. It will alert you to things like too many failed login attempts, unexpected file changes, and so on.
Finally, don’t forget to have a backup system in place. If all of the security measures above fail, you’ll want a recent backup of the website you can fall back to in order to restore your website to safety.
Some web hosts may include backups in your web hosting plan, but it’s also a good idea to automate the process with a backup plugin and then store frequently saved copies of your site in a safe and remote location (like a free Amazon S3 account).
Hackers are creative. They can get into a website from a comment form, through the login page, and from an exposed file on the backend (among other methods). If a vulnerability exists, they will find it.
Unfortunately, when a website is left open to attack, it can have devastating consequences for a business:
As the designer or developer who built the website for them, failing to properly secure it could be just as harmful to your business. So, it’s best to know what you can do to implement, at the very least, a minimum amount of security to every website you build.
Featured image via Unsplash.
How you present your design solutions (whether it be to another team member or a client) has an impact on how they view the quality of that solution a
In the past, fantastic web design was a simple business. All you had to do was ensure that the design looked good in Internet Explorer or Netscape, an
In the world of User Experience (UX) design, Jakob Nielsen’s 10 Usability Heuristics for User Interface Design have long been the cornerstone for craf
One of the most common pieces of writing advice out there is “know your audience.” Choosing to appeal to either middle-aged lawyers or college freshme
Contrary to the implication in the title, a conversational UX doesn’t have to be a literal conversation, the term refers to back and forth interaction
January is the time most of us cease reflecting on the year gone by, and start looking to the months ahead. It seems everyone has different ideas on w
We are a dynamic information platform dedicated to delivering timely, relevant, and reliable content across a broad spectrum of topics. From the latest in technology and business to lifestyle, health, and global affairs, we aim to keep our readers informed and inspired.
Our editorial team is committed to maintaining high standards of accuracy and clarity, ensuring that every article provides value and context in an ever-changing world. We believe in the importance of accessible knowledge and strive to make complex topics understandable for everyone.
Whether you're here to stay updated on current events, explore thought-provoking features, or simply learn something new, our goal is to offer a trustworthy source of information that meets the needs of a diverse and curious audience.