3 Common Security Mistakes that Webmasters Make

Even the most skilled and advanced webmasters make mistakes that lead to security problems. This is most often due to webmasters not giving much thought as to how even the simplest action could be valuable to a hacker, or the general denial that something bad could happen. Here are three simple mistakes that webmasters commonly make during the course of maintaining a website:

1. Not maintaining website software

Website maintenance is not limited to content. Most website applications are not the type that you can install and forget about, especially if you’re using common and/or open-source software. Security problems are discovered all the time, and therefore require that the software be patched to prevent any vulnerabilities from being exploited. If you are utilizing custom website software, you should be regularly reviewing the security of your website. 

2. Leaving backups in public directories 

A very common blunder that hackers often take advantage of is the likelihood of webmasters backing up files to publicly-accessible locations. This includes making copies of the website while doing upgrades/maintenance, or making database backups in these locations. Unmaintained versions of your website should not be stored publicly to where they may be exploited. Additionally, storing archived backups (tarballs, zipped files, etc) of your website or raw MySQL dumps are security hazards, as it can allow hackers to view website source code or sensitive information stored in the database backup (such as user passwords, etc).

3. Making files and folders world-writable 

Depending on your web host’s setup and/or your website software, setting files and folders to 777 may be unavoidable. However, doing this facilitates the ability for hackers, or even other users on your server, to upload files to your hosting account. If you find that your website requires open permissions in order to function normally, consider asking your web host if this is due to a configuration of the server (such as running PHP as ‘nobody’ rather than your account user) or check whether the requirement is within your website software itself.