Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How should I protect my website from hackers adding malicious code to my html files and js files

share|improve this question
language fail -1 – Phil Nov 22 '09 at 18:26
up vote 2 down vote accepted

There is no one solution, security comes in layers - like an onion ;p

Follow best-practices for configuring the software suites and platforms you're using, keep everything updated (patch management) and design for robustness. Servers and operating systems have hardening guides, use them.

Learn, stay up to date in the industry of new and old threats, get experts to do real analysis and penetration testing. Rest assured that there's still no guarantee it's secure.

Educate all the people involved, someone calling say the hosting company and asking for a file change on your web site, impersonating a valid person like yourself, might be much easier than programatically attacking it.

Get a few scary but well-trained dogs.

Run automated test tools to start with like Nessus from some top ten list just to check for the obvious known vulnerabilities that automated attacks could be leveraging. Note that someone out to actually attack you for real won't rely on any of these known vulnerabilities (unless you've not protected against them).

When it comes to coding, use modern frameworks, don't write data access stuff by hand.

share|improve this answer
Also: hire a security ogre. – womble Nov 22 '09 at 12:50
Or rather, two - for redundancy ^^ – Oskar Duveborn Nov 22 '09 at 13:01

I think this should belong to Stack Overflow, but anyway, in generally:

  1. Prevent Cross-Site Scripting (XSS) Attacks
  2. Prevent SQL Injections, by instead of doing something like this:

    SQL = "SELECT * FROM [Author] WHERE Name = '" & Request.QeuryString("name") & "'"

You should do something like this:

    SQL = "SELECT * FROM [Author] WHERE Name = @Name"
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.