Hosted Websites

Posted on 2014-09-25
Last Modified: 2014-09-28
Hello, I have 15 wesbites hosted by various 3rd party providers such as Go Daddy and fast hosts. Sometimes people have to input their personal information such as name, date of birth and address. What should I be looking for in terms of security that the 3rd party hosting Companies should be providing to protect the websites from being hacked and its data ?

Question by:DNRRP
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 17

Expert Comment

ID: 40345407

For starters, if your domains do not have SSL certificates, that is a must as the user is submitting personal information.  GoDaddy offers SSL certs for about $70 a year starting.  I don't know about the other.  Once the certificate is applied, verify that you can access your form page with the HTTPS protocol.  If so, update your form pointer links to go to the HTTPS version and/or configure the form page header or the server's htaccess file to force that form page to only show in HTTPS.

Next, where is the data being submitted to?  Is it emailed, or is it stored in a database or file?  It would be best to store in a database which you can retrieve from GoDaddy's hosting tools such as phpMyAdmin.  Alternatively, you can create a password protected administrative page that has access to the database records.  Strong Password protection can be setup with a session login script or HTTP authentication.  The administrative page should not be advertised, i.e. don't have a link to it on other site pages.  Also if possible, if the link is discovered, the bad guys will naturally try to break into it with the methods below or brute force.  So create a lockout based on IP or even restrict page access based on IP.

Lastly, to help prevent hacking, make sure your form page has the appropriate protections against cross site scripting and SQL injection.  In other words, cleanse the data being submitted by using form validation.  Insert the cleansed data into your database.

Hope this helps.
LVL 14

Expert Comment

ID: 40345467
Besides of bigeven2002's tip - which focus on security by means of cracking the website's user interface - you should also have an eye on the security of your management access interfaces and the system ressources ... recent versions of the underlying software and a tight update schedule, fast reaction on security leaks, complex passwords and SSL when accessing the management interfaces (web & ftp).
LVL 58

Expert Comment

ID: 40346426
If all you are storing is name, date of birth and address then there is no security implications as that data can be found easily from many public sources.

It becomes a security issue if you are storing things like credit cards where you need to be using SSL and db encryption
When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.


Author Comment

ID: 40347322
Thank you all for this valuable information.

From reading your comments I would need to ensure the following for.anu 3rd Party Hosting Company that hosts my websites and stores personal data.
1) SSL Certificate.
2) Use of Complex passwords to the website backend management interfaces.
3) Prompt update schedule  of the website software as soon as this has been released.

There has been no mention of encryption of the data submitted on the website or data access contr? .  I.e Who has access to the data submitted on the hosted third party servers by the hosting company themselves or how long they keep the data ?

LVL 17

Expert Comment

ID: 40348130
Encryption is used by SSL During the transmission of data.  You can use encryption on the data itself before storing into database if desired.  if your form uses PHP, it has encryption functions for the variable data.  But of course if you store the data encrypted you will need a way to read the data. So use a two way encryption algorithm and then have your administrative page supply the key to decrypt the data that is selected for viewing.  The data will stay in the databases indefinitely until you manually remove it or cancel your hosting plan.  The hosting companies may have different retention policies for data after a plan is canceled, so you will need to confirm that with them.

Author Comment

ID: 40348299
bigeven2002 - Really appreciate the information you have provided, I have never setup two way encryption algorithm on a Go Daddy or fast host site. Do you have any links or information on this ?
LVL 17

Accepted Solution

bigeven2002 earned 500 total points
ID: 40348904
Certainly.  Mcrypt is probably the most common method and a good starting point.  You specify the key and cipher strength as parameters.  Here is the official page on that function.

Another thing I would recommend is using base64 to translate the encrypted string into a hex data format which makes it more data store friendly.  Then decode the base64 before decrypting the data for viewing.

So basically it would work like this.  When the form data is submitted to your handler page, use Mcrypt to encrypt the data, then use base64 to encode the encrypted data, then store the encoded data into your database.

Then on your administrative page, select the data from your database, have the handler decode the data from base64 and then use Mcrypt to decrypt the data and then output to your page.

It may be a bit confusing but this is how I have done it in the past.

Featured Post

SharePoint Admin?

Enable Your Employees To Focus On The Core With Intuitive Onscreen Guidance That is With You At The Moment of Need.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Before we dive into the marketing strategies involved with creating an effective homepage, it’s crucial that EE members know what a homepage is. In essence, a homepage is the introductory, or default page, of a website that typically highlights the …
For many of us, the  holiday season kindles the natural urge to give back to our friends, family members and communities. While it's easy for friends to notice the impact of such deeds, understanding the contributions of businesses and enterprises i…
Use Wufoo, an online form creation tool, to make powerful forms. Learn how to choose which pages of your form are visible to your users based on their inputs. The page rules feature provides you with an opportunity to create if:then statements for y…
Learn how to set-up custom confirmation messages to users who complete your Wufoo form. Include inputs from fields in your form, webpage redirects, and more with Wufoo’s confirmation options.

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question