The hosting provider will take care of many security measures, but, depending on the plan you select, you should ask questions to learn exactly which features the company provides and what you need to do.
1. Backups and Restore Points:
People often overlook backups as an element of security. Backups both provide and require security. Backups must be kept in a secure location away from the main server, following the other security steps we will outline. A secure backup provides a trusted repository for the latest copies of the system and data that can be deployed to restore a known, clean system to operation.
2. Network Monitoring:
Diligent monitoring can stop server-to-server spread of malware before it gets to the server hosting your site.
3. SSL, Firewalls, and DDoS Prevention:
Distributed-Denial-of-Service (DDoS) attacks happen when an overwhelming amount of traffic is sent to your site, rendering it useless to visitors. Prevention starts at the edge of the network with a good firewall.
4. Antivirus and Malware Scanning and/or Removal:
You should understand which protective actions your hosting provider will perform and what you must do on your own to protect your website.
5. High Availability and Disaster Recovery:
Look for a hosting company that will keep your site running with 99.9% uptime or better. This goes beyond file-level backups. Is a bare-metal image available for your server? This is a complete copy of a clean, functioning server operating system for a speedy recovery from system failures.
The host’s network should have redundant hardware to guard against downtime caused by hardware failures. Firewalls can be configured to run in pairs, with each one ready to take over the full load in case the other one fails. The same concept extends to servers. Hardware failover is an important component of high-availability networks.
6. Access and User Permissions:
At the host level, access means physical access to the machines, as well as the ability to log into the server. Physical access should be limited to trained technicians with security clearance.
You and your host company should use Secure Socket Shell (SSH), or equivalent, to log into the server to maintain the operating system (OS) or the website. For extra security, use RSA keys protected by a passphrase.
Another good security step is to whitelist IPs that are allowed to access the server for maintenance. This can be done and modified through the hosting company’s control panel provided for your account. You should also disable logins from the user root. Malicious players will commonly attempt to exploit this access point because the root user has full administrative privileges. You can always give equivalent permission to authorized admin logins.
Files are protected by file permissions. Incorrect permissions cause time-consuming errors, and it is tempting to fix these errors by granting full permissions to all files. Don’t do this. It gives any criminal hacker full control of your system if they get in.
7. File Management:
All access to your server is remote. No one will go to the server to add, remove, or move website content files. You should use secure FTP (SFTP) with a secure and robust password for all file transfer and maintenance while also following other FTP and SFTP best practices.
8. Applications and Logins:
The hosting company should have a strict password policy for employees with mandatory password changes at regular intervals as well as when equipment or personnel changes. You should have similar policies for your server access passwords. Establish and enforce policies for strong passwords. Those who want to can exploit weak passwords within hours.
Remove any unused, unmaintained apps on the server so no one can exploit unpatched vulnerabilities. Install — and maintain — utilities that monitor the server CPU, disk use, memory use, and application uptime.
The databases on your server are potentially vulnerable targets for online criminals.
9. Passwords and User Access:
At the website level, you will have passwords for people who administer the site, guest authors, and potentially website visitors, depending on the nature of the site. Establish and enforce password strength policies for everyone who has backend access.