How should I protect my website from hackers adding malicious code to my html files and js files

  • language fail -1 – Phil Nov 22 '09 at 18:26

There is no one solution, security comes in layers - like an onion ;p

Follow best-practices for configuring the software suites and platforms you're using, keep everything updated (patch management) and design for robustness. Servers and operating systems have hardening guides, use them.

Learn, stay up to date in the industry of new and old threats, get experts to do real analysis and penetration testing. Rest assured that there's still no guarantee it's secure.

Educate all the people involved, someone calling say the hosting company and asking for a file change on your web site, impersonating a valid person like yourself, might be much easier than programatically attacking it.

Get a few scary but well-trained dogs.

Run automated test tools to start with like Nessus from some top ten list just to check for the obvious known vulnerabilities that automated attacks could be leveraging. Note that someone out to actually attack you for real won't rely on any of these known vulnerabilities (unless you've not protected against them).

When it comes to coding, use modern frameworks, don't write data access stuff by hand.

|improve this answer|||||
  • 3
    Also: hire a security ogre. – womble Nov 22 '09 at 12:50
  • 2
    Or rather, two - for redundancy ^^ – Oskar Duveborn Nov 22 '09 at 13:01

I think this should belong to Stack Overflow, but anyway, in generally:

  1. Prevent Cross-Site Scripting (XSS) Attacks
  2. Prevent SQL Injections, by instead of doing something like this:

    SQL = "SELECT * FROM [Author] WHERE Name = '" & Request.QeuryString("name") & "'"

You should do something like this:

    SQL = "SELECT * FROM [Author] WHERE Name = @Name"
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.