Hello friends,
This is Prince Ade-Johnson sharing this quick advice that was e-mailed to me few hours ago. Now read on.
Here is a quick advice on how to secure your hosting account to avoid hacking.
Please make sure to always update all your scripts (such as WordPress, Joomla!, Drupal etc), plugins/modules/components are updated to the most recent released version as new versions are released primarily to address known security vulnerabilities in these scripts.
Failure to do this will result in terminating your account, so please make sure you update your script to the latest version.
Here are the tips:
Tips for securing your hosting account
1. Ensure that all database configurations for your account are using a custom generated user and password combination and that this information is not stored in plain text if at all possible.
2. Do not ever use your cPanel username and password to access your databases for your site as that is an extreme security risk.
3. Ensure that all scripts (such as WordPress, Joomla!, Drupal and the like), plugins/modules/components are updated to the most recent released version as new versions are released primarily to address known security vulnerabilities in these scripts.
4. Change the permissions for all configuration files (such as wp-config.php or configuration.php) to 600 or 400 (either read only for the user only, or read and write for the user only), that way the file is only readable and editable for the user.
5. Disable any and all plugins that you are not using and/or are not critical to your site. Plugins that you’re not using can lead to compromises later as they are likely to be forgotten and thus not updated and can also lead to resource issues with your site as well.
6. If you have an images directory, add this code to the .htaccess in there to prevent execution of scripts in that directory, as malware is often added in there:
AddHandler cgi-script .php .pl .py .jsp .asp .htm .shtml .sh .cgi
Options -ExecCGI
—-
The following steps can be used to help secure your computer:
1. Use the following online vulnerability scanner and ensure your software is up to date:http://secunia.com/
2. Download an anti-virus program and fully scan your computer for malicious files. Here are some free scanners:
a. MalwareBytes: http://www.malwarebytes.org
b. ComboFix: http://www.bleepingcomputer.
c. These have been reported to be able to clean a recent strain of malware that resists detection by almost all other anti-virus agents. It is highly suggested that you use both of them and one of the following:
1. http://housecall.trendmicro.
2. http://www.bitdefender.com/
3. http://www.kaspersky.com/
4. http://support.f-secure.com/
3. Update all passwords for any account that you access/own that may not be up to standards. Standards for secure passwords are as follows:
a. Contains uppercase and lowercase letters, numbers and symbols
b. Does not contain any dictionary words and is not resembling any dictionary word
c. Is 12 or more characters in length
d. An example of a secure password is S9LX1FpF:9VZP?Dy8q{RSQFy
e. An insecure password would be sm@rt,w$b,com.ng or word12345hey
f. Your password should not be something that you can easily remember, purchase a thumb drive and install KeePass or KeePass portable to store your passwords and keep the thumb drive on you at all times. This allows you to access all passwords at any PC without having to remember them.
Please note that you should ensure that any PC that you insert the thumb drive in to is secure prior to accessing your passwords.
g. You can get KeePass here: http://keepass.info/
h. KeePass portable is obtainable here: http://portableapps.com/apps/
i. Each password that you use should only be used for one location or account. Reusing passwords is highly insecure and can allow even a single password’s compromise to compromise every account that uses the same password.
4. Keep your computer secure from malware infecting it. If your computer is compromised your accounts can be compromised by the malware sniffing out the passwords that you use.
a. Ensure that you use the latest browser version and ensure that the browser subscribes to Google’s blacklist API (such browsers are Mozilla Firefox, Google Chrome and Safari)
b. Disable javascript (only allow it on websites that you trust)
c. If you use FireFox, use the addon NoScript
d. Make sure your anti-virus program has a subscription to new database and version releases. This may cost some money but it’s well worth the expense.
e. Use http://www.avg.com.au/index.
Thanks
Courtesy: Smartweb Team
Related articles








