SECURITY

Our Website Security Practices

Security is a big tech topic these days. Sites have been hacked and people are worried. But there’s plenty you can do to secure your site.

We’re going to talk briefly about security and websites, covering some big picture concepts to help you keep your site safe. The easiest thing you can do to keep your site secure is to sign up to our “Managed-Website-Service“. Our security-team can take care of a lot of the practical matters. But here we’re just going to cover some of the conceptual ideas about security.

A website can never be 100% secure

Hackers are always trying new things and discovering new vulnerabilities to exploit. The online world changes quickly and the same is true of security. Good security is about minimizing risk. If anybody tries to sell you a 100% secure solution, they’re scamming you. You’ll never be completely safe, but there’s a lot you can do to minimize your risk.

Some people like to say that the CMS-System isn’t secure. That’s not necessarily true—it depends on how you set up and use it. If you’re not keeping it updated or following bad practices, then no, it’s not secure. The reality is that 18% of the world’s websites are using for example WordPress, which makes it a huge target. So you need to be smart. You need to keep things updated and follow the best practices to lock your site down. Many security issues have little to do with the system and more to do with server vulnerabilities, cross-contamination and poor passwords. Bad decisions can undermine your site, and that’s true whether you’re using WordPress or any other solution.

There’s a fine balance between security and usability. Sometimes locking down your site makes it secure, but it’s hard to use. Sometimes making your site easier to use makes it less secure. We have to find the balance.

Our website security practices

Protection

First and foremost you need to lock down your site and keep it safe. You’ve got to raise the drawbridge, lower the gate, ignite the flammable moat and do whatever else you can to stop attacks before they start. This is the obvious first step and kind of hard to ignore: protect your site.

Detection

No matter how good your protection is the bad guys might find a way to hurt your site. And you need to know when an attack is happening. The attack won’t always be a full frontal assault that makes it painfully obvious your site has been hacked. Sometimes they’re sneaky and bots will put a bunch of hidden code into your site. It’s no good to have all kinds of protection but then not know when some malicious virus found a weak spot and broke through. Malicious bots and hackers may have already infiltrated your site. You’ll never know without detection.

Recovery

Finally, you need a plan to get your site up and running again after it’s been knocked down. These things happen. The best protection and detection strategies can still be foiled and you need to be prepared. Why worry about the worst-case scenario when a little preparation will have you covered? Plus, a good backup is important for other reasons besides security. We recommend backing up your site with our “Managed-Website-Service”, which also handles restoring your site if something happens, so you’re prepared for anything.