Web security: 5 common mistakes and how to avoid them

Most of the hacked websites we are asked to fix have not been the target of a sophisticated attack. They were found by bots that scan the web for known vulnerabilities – and found one. Here are the five mistakes we come across most often.

Mistake No. 1: neglecting updates

A disclosed vulnerability is exploited within days, sometimes within hours. A website whose content management system, plugins or PHP version are out of date is like leaving a door wide open.

• Apply security updates as soon as they are released;
• remove any plugins you no longer use, and be wary of those that are no longer maintained;
• keep an eye on the end-of-life date for the PHP version used by your hosting provider.

The number of plugins matters: each one adds more code, written by someone else. This is one of the reasons why a WordPress site loaded with plugins requires constant vigilance, as we explain in our post on bespoke versus off-the-shelf solutions.

Mistake No. 2: Poorly secured access

• Long, unique passwords, stored in a password manager: the CNIL’s guidelines set out the rules.
• Two-factor authentication wherever it’s available: site administration, hosting, domain name registration, email.
• One account per person; never share accounts; and access rights for former employees or contractors must be revoked on the day they leave.
• Check whether your email addresses feature in any known data breaches using Have I Been Pwned.

Mistake No. 3: Incomplete HTTPS

A security certificate is no longer an expense: Let’s Encrypt provides it free of charge, and we offer it for every site hosted with us. The mistake today is half-baked HTTPS:

• pages still accessible via HTTP, without redirection;
• images or scripts loaded via HTTP on an HTTPS page;
• a certificate that expires because it isn’t renewed automatically.

A free test with SSL Labs shows you in a minute how your site is doing.

Mistake No. 4: Vulnerable forms

A contact, search or login form is a gateway to your site. If poorly secured, it allows code to be injected into the database or into the pages viewed by your visitors. The OWASP Top 10 lists these risks.

• Development side: parameterised queries, validation and escaping of all user input, minimal database privileges;
• Operational side: a privacy-friendly CAPTCHA, such as hCaptcha which we use, to prevent bots, and monitoring for unusual submissions.

Mistake No. 5: no contingency plan

On the day the website is hacked or the server is destroyed, it is too late to be wondering where the backups are. You need to know in advance:

• where the backups are — off the website’s server —, how far back they go, and whether attempts have been made to restore them;
• who to call, and who will notify customers;
• how to get the site back online, even in a scaled-down version.

We experienced this scenario in March 2021, during the fire at the OVHcloud data centre in Strasbourg: our remote backups enabled us to get everything back up and running, and we have learnt from the experience.

In the event of an attack, the public website cybermalveillance.gouv.fr provides guidance on how to respond; ANSSI’s recommendations help you prepare.

If your website has already been compromised

Call us: we’ll deal with the hacked sites, then put in place maintenance measures to prevent it from happening again.