Creating website backups should be one of the most important recurring tasks for a website administrator, and yet backups are often forgotten when thinking about website security. Creating backups using command-line tools are available to all Linux/Mac users for free. If you’re not on Linux/Mac, we have step-by-step guide on how to create website backups […]
Tag Archives: Website Security
Setting Expectations For Your Website Security
I have a website. Sweet! What happens next? Well, it’s a natural question. I had a brilliant idea and purchased a domain name, but what do I do next? Storks don’t fly by to deliver a basket of tasks upon the purchase of your domain. For most new website owners, a core understanding of expectations […]
What is Cross-Site Contamination and How to Prevent it
If you suffer multiple reinfections and your site is one of many in an account, the odds are high that you’re suffering from cross-site contamination. Cross-site contamination is when a site is negatively affected by neighboring sites within the same account/server due to poor isolation on the server and/or account configuration. This phenomenon is one […]
Code Injection in Signed PHP Archives (Phar)
PHP contains an interesting but rarely used feature called Phar, which stands for PHp ARchive, that allows developers to package entire applications as a single executable file. It also boasts some additional security benefits by signing archives with a digital signature, disallowing the modification of the archives on production machines. According to the official PHP […]
New Non-HTTPS Websites Blacklisted for Phishy Password Practices
We submit hundreds of blacklist review requests every day after cleaning our clients’ websites. Google’s Deceptive Content warning applies when Google detects dangerous code that attempts to trick users into revealing sensitive information. For the past couple of months we have noticed that the number of websites blacklisted with Deceptive Content warnings has increased for […]
The Principle of Least Privilege
If you own a website and collaborate with others, the principle of least privilege should never be questioned. It is a computer science principle which has applications and benefits to strengthen your website security posture. This principle is about: Using the minimal set of privileges on a system in order to perform an action. Granting […]
Testing the Impacts of Website Caching Tools
Try to remember what you ate for lunch yesterday. It took you about 3-5 seconds, right? Ok. Now recall that memory once more. Took you less than a second this time, for sure. You remembered much faster the second time around because you didn’t have to “query” that information again from your brain’s “storage”. The […]
The Story of an Expired WHOIS Server
We write quite often about SEO spam injections on compromised websites, but this is the first time we have seen this blackhat tactic spreading into the WHOIS results for a domain name. If you are not familiar with “WHOIS“, it is a protocol used to check who owns a specific domain name. These simple text […]
Website Application Firewalls (WAF) – Practical Approach to Website Security
In 2016, I shared some thoughts about firewalls in general; their history and purpose in the information security domain. The point of the article was to help website owners differentiate between the types of firewalls they might encounter. Today, I will shift my focus specifically to website application firewalls (WAF). WAFs are not new, but […]
WordPress Performance Optimization Guide
Since launching our website performance testing tool we have been getting a lot of questions about how to improve the speed and performance of WordPress websites. Many website owners are not aware how slow their sites are, so we are excited to help shed some light on the matter. There are a number of different […]
