Hosted Websites

Posted on 2014-09-25
Last Modified: 2014-09-28
Hello, I have 15 wesbites hosted by various 3rd party providers such as Go Daddy and fast hosts. Sometimes people have to input their personal information such as name, date of birth and address. What should I be looking for in terms of security that the 3rd party hosting Companies should be providing to protect the websites from being hacked and its data ?

Question by:DNRRP
LVL 17

Expert Comment

ID: 40345407

For starters, if your domains do not have SSL certificates, that is a must as the user is submitting personal information.  GoDaddy offers SSL certs for about $70 a year starting.  I don't know about the other.  Once the certificate is applied, verify that you can access your form page with the HTTPS protocol.  If so, update your form pointer links to go to the HTTPS version and/or configure the form page header or the server's htaccess file to force that form page to only show in HTTPS.

Next, where is the data being submitted to?  Is it emailed, or is it stored in a database or file?  It would be best to store in a database which you can retrieve from GoDaddy's hosting tools such as phpMyAdmin.  Alternatively, you can create a password protected administrative page that has access to the database records.  Strong Password protection can be setup with a session login script or HTTP authentication.  The administrative page should not be advertised, i.e. don't have a link to it on other site pages.  Also if possible, if the link is discovered, the bad guys will naturally try to break into it with the methods below or brute force.  So create a lockout based on IP or even restrict page access based on IP.

Lastly, to help prevent hacking, make sure your form page has the appropriate protections against cross site scripting and SQL injection.  In other words, cleanse the data being submitted by using form validation.  Insert the cleansed data into your database.

Hope this helps.
LVL 14

Expert Comment

ID: 40345467
Besides of bigeven2002's tip - which focus on security by means of cracking the website's user interface - you should also have an eye on the security of your management access interfaces and the system ressources ... recent versions of the underlying software and a tight update schedule, fast reaction on security leaks, complex passwords and SSL when accessing the management interfaces (web & ftp).
LVL 58

Expert Comment

ID: 40346426
If all you are storing is name, date of birth and address then there is no security implications as that data can be found easily from many public sources.

It becomes a security issue if you are storing things like credit cards where you need to be using SSL and db encryption
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!


Author Comment

ID: 40347322
Thank you all for this valuable information.

From reading your comments I would need to ensure the following for.anu 3rd Party Hosting Company that hosts my websites and stores personal data.
1) SSL Certificate.
2) Use of Complex passwords to the website backend management interfaces.
3) Prompt update schedule  of the website software as soon as this has been released.

There has been no mention of encryption of the data submitted on the website or data access contr? .  I.e Who has access to the data submitted on the hosted third party servers by the hosting company themselves or how long they keep the data ?

LVL 17

Expert Comment

ID: 40348130
Encryption is used by SSL During the transmission of data.  You can use encryption on the data itself before storing into database if desired.  if your form uses PHP, it has encryption functions for the variable data.  But of course if you store the data encrypted you will need a way to read the data. So use a two way encryption algorithm and then have your administrative page supply the key to decrypt the data that is selected for viewing.  The data will stay in the databases indefinitely until you manually remove it or cancel your hosting plan.  The hosting companies may have different retention policies for data after a plan is canceled, so you will need to confirm that with them.

Author Comment

ID: 40348299
bigeven2002 - Really appreciate the information you have provided, I have never setup two way encryption algorithm on a Go Daddy or fast host site. Do you have any links or information on this ?
LVL 17

Accepted Solution

bigeven2002 earned 500 total points
ID: 40348904
Certainly.  Mcrypt is probably the most common method and a good starting point.  You specify the key and cipher strength as parameters.  Here is the official page on that function.

Another thing I would recommend is using base64 to translate the encrypted string into a hex data format which makes it more data store friendly.  Then decode the base64 before decrypting the data for viewing.

So basically it would work like this.  When the form data is submitted to your handler page, use Mcrypt to encrypt the data, then use base64 to encode the encrypted data, then store the encoded data into your database.

Then on your administrative page, select the data from your database, have the handler decode the data from base64 and then use Mcrypt to decrypt the data and then output to your page.

It may be a bit confusing but this is how I have done it in the past.

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
ASP.NET WCF Rest service not working 6 65
WordPress: Need a simple quiz plug-in 2 138
C# and SQL Server with User Defined table 4 95
Woocommerce Webservice 2 87
This story has been written with permission from the scammed victim, a valued client of mine – identity protected by request.
Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
The purpose of this video is to demonstrate how to set up the WordPress backend so that each page automatically generates a Mailchimp signup form in the sidebar. This will be demonstrated using a Windows 8 PC. Tools Used are Photoshop, Awesome…
Use Wufoo, an online form creation tool, to make powerful forms. Learn how to selectively show certain fields based on user input using rules to gather relevant information and data from your forms. The rules feature provides you with an opportunity…

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question