How to protect your site from infection

1. Use reliable software.

   • Download distributions of web applications and CMS extensions/plugins from trusted sources.

   • Update your CMS and server software regularly. Follow the news about vulnerabilities of your CMS.

   • Audit security of the servers regularly.

   • After installing the CMS, remove the installation and debug scripts.

2. Use complex passwords for the web server software (FTP, SSH, hosting administrative panels and CMS).

   • A complex password is more than 11 characters long and includes letters of different cases, numbers and special characters.

   • Don't use the same passwords for accessing different services.

   • Even the most reliable passwords should be changed every three months, to insure against accidental leakage.

   • Don't save important passwords in web browsers, file managers, as well as in the FTP, SSH and other clients.

3. Keep track of the computers' security.

   Install antivirus software with regular updates on all computers used for working with the server (webmaster's, administrator's, content manager's, sales manager's computers, and so on). Also, update the operating system and applications in time.

4. Control the data entered by the users.

   • In the user input, filter the HTML markup that can be inserted into the code of the site pages.

   • Check if the received data has the permissible size, values and intervals .

   • Never place information received from the users directly in eval() calls, SQL requests or type conversions. Always check and clean the information received from potentially dangerous elements.

   • Never leave parameters used for debugging, experiments with new or disabled functions in the draft version of the code.

   • Use WAF (Web Application Firewall).

5. Control user access rights, and in particular protect yourself form Cross-site request forgeries (CSRF).

   Restrict access to CMS and database panels (for example, phpMyAdmin), as well as to:

   • Code backups.

   • Configuration files.

   • Version control systems metadata (such as the .svn or .git directories).

6. Hide the server software version if possible (CMS, web server, interpreter, DBMS).

7. Configure your firewalls and network infrastructure only to let through the connections you need.

8. Try to avoid clickjacking. The simplest ways to do it are:

   • The X-FRAME-OPTIONS SAMEORIGIN or X-FRAME-OPTIONS DENY HTTP header outputs.

   • JavaScript structures such as

     if (top.location != window.location) top.location = window.location

     or

     top.location = 'http://example.com'

9. We recommend that web hosting companies check supported websites regularly, for example, using the Yandex Safe Browsing API or Yandex.Webmaster API.

Malware may be present in uploaded content (accidentally or intentionally) if the users are allowed to upload text or files to your site.

1. Protect your site from bots.

   You can use special CMS plugins or search blacklisted users to protect yourself from the hacking bots.

2. Check the information uploaded by users.

   • Don't allow inserting JavaScript code inside script, in tags, or in links.

   • Don't insert code into the iframe, object, or embed tags directly on website pages, and don't upload .jar, .swf, or .pdf files (the website can use them to generate such tags automatically).

   • Keep a “whitelist” of allowed HTML tags to discard everything else without extra processing.

   • Check the links inserted by the user, for example with the Yandex Safe Browsing API.

1. Check the software you use.

   • Download CMS distributions, widgets, libraries only from official sites or from the trusted sources.

   • If you have to download a distribution from a questionable site, check it for malicious code.

   • Carefully study the code of any additional components that you want to add in the CMS.

2. Be careful with advertising blocks and code.

   • Insert on your site pages only the ad blocks provided by proven advertising systems.

   • Before joining a new partner system, look for reviews about it and for examples of distributed content.

   • Avoid “unique offers” (suspiciously high pricing for tracking tags and ad blocks or mobile traffic monetization).

   • If possible, embed static content (links and pictures) on your pages . Avoid the script and iframe elements that load. Accept Flash, Java and ActiveX components only as a source code which you can check and compile yourself.

   • Don't use partner programs with hidden blocks.

3. Carefully check access to service interfaces. Give access to the site only to those who need it and as long as they need it.

   • Revoke the access from professionals who carry out one-time work, previous owners, people who aren't responsible for maintaining the site (for example, marketing professionals or managers).

   • When you engage other people in working on the site try to get some recommendations. After the work is done, remove their accounts or change passwords.

   • If your site is static, some partners may request FTP access to it to be able to change banners on their own. Providing such access is dangerous. If the partner's database is hacked, the hackers will get direct access to the files on your site.

4. Search for reliable and high quality hosting. Not all hosting services can ensure the security of their servers, while others may even intentionally insert malware on the clients' sites.