Important Information: Website's Common Vulnerabilities and Recommendations

July 30th, 2018

 

Dear Valued Customer,

 

Vulnerable Software or Content Management System

======================

We request you check all versions of software and web applications running on your web pages and ascertain that they are up-to-date or patched with latest security updates. Examples of these types of applications are website CMS such as joomla, wordpress or drupal, including plugins, modules or themes. Content Management System (CMS) communities work hard to identify security breaches and fix them proactively. However, common CMS known vulnerabilities are the most exploited security breaches. Thereby it is very important the keep your CMS up-to-date.

 

It is important to verify your or clients' CMS versions and have them apply updates. Shared server security is only as strong as the weakest link.

 

Insecure Files/Folders Permissions

======================

No files/folders in your websites content should have full read write execution permissions for everybody. Most files only require permissions of 644 (-rw-r--r--) and directories usually only require permissions of 755 (-rwxr-xr-x). Please be sure to check the ownership of those files and directories as well.

 

Weak/Stolen Passwords (including email, FTP or SSH accounts)

======================

Please ensure you are enforcing a secure password policy and change all passwords of the compromised account. Do not use default passwords. At a bare minimum, a password should contain both uppercase and lowercase letters as well as at least one number and not be based on a dictionary word.

 

Modified .htaccess Files or Other Malicious Files

======================

Quite often files are uploaded on the website such as php backdoor, php mailers, or php files containing a malicious javascript or iframe code. These must be removed.

- Please also check any recently modified files in the involved website content and any other files in the same involved folders or other vulnerable folders.

- Investigating your access_log file can sometimes provide useful information about the attack.

 

Presented by:

 

KEKhost/KEKhosting Technical Team