What is Secure Hosting and Who Needs It?

Photographed by Kevin Bhagat

If you have purchased a domain name for a website’s address, then in order to make use of that domain name you are going to need hosting.  There’s no two ways about it.  Without hosting, a domain name is like a vehicular licence plate without a vehicle – you’ll still need a vehicle. 

In this writing, as well as explaining the need for secure hosting, I will point out sources where you can find items that help to create secure hosting and where you can receive good hosting experiences for the management of a website as well.

What is a server?

“A server is a software which serves web content via htt protocol, it is the foundation of the internet, and every website that exists must be sitting on and be hosted by, a web server.”Hussein Nasser, Software Engineer 

“A web browser sends requests for info across the internet to an electronic machine that works with web server software.  That machine knows how to accept a browser’s requests for information and how to return responses to browsers.  A browser’s request for info is returned to it in the form of webpages: noticeable webpages based on a request are made available to the enquirer.”WinningWP

What is secure hosting?

The whole idea of secure hosting is based on something known as a server.  A server stores information and then makes it available to the internet when requested.  The information stored on a server needs to be protected or secured in order to preserve it and the website that it forms, and where a server is protected and secured there you have secure hosting.

I mentioned a similarity between having a domain name but no hosting, with having a licence plate but no vehicle.  Similarly, a useful vehicle that lacks security can be likened to a server that has no security.

So if you have purchased a domain name, then “What is secure hosting and who needs it?” is a question that is being answered here especially for you.

What is shared hosting?

Shared hosting is where one server is used to serve numerous websites (each having its own domain name).  Most web hosting organisations offer shared hosting.

Shared hosting is like sharing a motorway with other vehicles, hundreds or even thousands of users share the same server.  From a business perspective it means that the costs can be divided and this helps to make shared hosting the least expensive option for hosting solutions.  Most bloggers and small businesses begin with shared hosting to host their websites since the costs are relatively easier to manage.

While shared hosting will cost less money it tends to be inadequate for websites that receive high traffic volumes.  Websites that receive high traffic volumes require a dedicated server instead.

Shared hosting security

If you were sharing a building with others and every other user of the building kept good security practices, there’d be a lower risk of security breaches for that building, and that would benefit all of the building’s users.  Similarly, if there’s a user of the building that fails to keep good security practices, it’s potentially a problem for all users of the building.  The “common effect” that is able to benefit or disadvantage a community is also applicable when it comes to shared hosting – imagine an intruder gaining entry and compare that to a hacker gaining access to a server and then trying to increase their opportunity by attacking other sites connected to the server – this is exactly what is being tried when hackers go to work – this is how other websites on a server have the potential to cause problems for your website.

If you were sharing a house with others and the essential amenities of the house like water, gas and electricity were distributed evenly amongst you, there’d be a lower risk of any of you going without what you need.  Similarly, if there are others in the house who have very high demands of the essential amenities, there’ll be a risk that others will be forced to go without those essentials when they need them.  The “limited resources” situation is one that is also applicable to shared hosting because the amount of electronic resources needed by websites that are hosted on a shared server will vary.  In cases where one or more of those websites is receiving high volumes of traffic, the resources of that server may be tied up to the extent where the performance of other sites are adversely affected.

On every shared server there is a main directory that is linked to every website sharing that server.  If a hacker gains access to this directory they can target every website on that server.  Hackers work at achieving this by running various programs to notice vulnerabilities in sites.  If they notice a vulnerability they exploit it to hack the site, and they work to further the exploitation by reaching for the server’s main directory.

A hacked website on the server hosting your website could affect your website’s performance.  Hackers use compromised websites to execute malicious software, send spam, store illegal files and attack other websites, but their main goal is to gain access to the server’s main directory.

One of the ways that hackers bring down a website is by programming thousands of malicious bots and devices to create a flood of traffic.  This is known as a DDoS [Distribution Denial of Service] attack.  The sudden surge in traffic is for causing an exhaustion of the server’s resources and will have a negative impact on other websites on the server (slower speed/performance/responses, crashes).

Every device making use of the internet has a unique identifier code – an iP address.  A server is one of many devices of this kind and as such each server has an iP address.  On a shared server, if one website conducts illegal activity or sends spam to its customers, it is the server’s iP address that will be noticed and blacklisted and marked as “malicious” and this blacklisting and labelling will affect all websites sharing that server for the continuation of that tarnished status.  The result?  Firewalls providing security will identify every website of the server as being malicious and will block their communications, e-mail service providers like Gmail will block the iP address of the server causing e-mail sent from the server’s websites to be received in the spam folders instead of inboxes, and search engines like Google will blacklist the server’s websites and mark them as ‘insecure’.

The service provider for a shared server will never reveal to clients who the others sharing the server are, so you could be sharing that server with a hacker that purchased a hosting plan.  You never know.  They could run phishing sites and spam programs.  They could be holding malicious software and files.  You never know.  But if it is the case, and they are detected electronically, it’s something that will come to affect your website if you are sharing a server with them.

So am I suggesting that you exchange a shared server for a dedicated one?  Not if it isn’t necessary or affordable to do so.  Instead I’d like you to notice the solutions that are available to you for maximising the security that is available to you in the position you need to grow through.  Yes, there are solutions.  I would also like you to understand that the various problems able to afflict a shared server ultimately decrease the likelihood of websites on a shared server receiving 100% uptime.  An uptime of 100% is far more likely to be received from a dedicated server service.

Below are eight features to enquire of with the provider of a shared server, or to research the availability of, for your website’s security in connection with a shared server:

[1]  Anti-spam filter – if neighbouring websites are prevented from sending spam there’s a reduced chance of the server’s iP address being blacklisted

[2]  Anti-virus – anti-virus software can be installed onto a server and may come as standard with some shared servers.  Seek an anti-virus solution that features: direct malware detection, sandboxing, HIPs (host intrusion protection), virtual desktop and rescue disc.

[3]  Automated backups

[4]  DDoS Protection

[5]  Domain Name Privacy – for concealing personal details connected with the purchase of a domain name

[6]  Firewall Security – to help prevent hackers that gain access to the server through a neighbouring website

[7]  HTTPS/SSL certification – for concealing sensitive data electronically

[8]  Security Protection – best if installed centrally to the server for protection all-around

Dedicated Server Security

When working with a dedicated server the potential for security breaches can be significantly less in comparison with a shared server, but in the same way that you would be doing yourself no favours by leaving your keys in the ignition of your vehicle whilst entering a petrol station to make a payment, or by leaving your PIN number written down beside your bank card, there is a requirement of care if the advantages of security available from a dedicated server are to be received.

Here are six things to do for ensuring and maintaining the security that is available when working with a dedicated server:

Smart Password Policy: the first thing to do after acquiring a new dedicated server is to change the password(s) for accessing your system.  This would be because your service provider may have a default password that they offer to all their clients.  So to ensure the security of your server, change the password right away and before you begin your use of the server.  An example of a strong password is one that combines upper and lower cased characters with numbers and symbols.  Try not to use passwords which relate to you or to the password’s holder, and try to change the password to equally strong passwords regularly.

Database Maintenance: make a special and personal effort to check that the database is maintained and that it is perfectly updated.  Personal means a non-delegable duty.  Make sure the database or databases are protected from SQL injection.  Delete all unneeded data and review the access that others have to the database(s).  If your site(s) collect sensitive data from visitors or customers then this is an especially important security step, it is also a safeguard against the misadministration of a database since the tools for administrating a database require permissions to access.

Software Updates Maintenance: a failure to update a dedicated server’s software can be a huge mistake in the maintenance of security.  New software updates include new security considerations and new protections for keeping data safe.  So, when new software updates for the dedicated server are available, it is within the best interests of the server’s users for the update to be installed immediately.  There’s always a chance for forgetfulness to strike and for security to be risked if updates are not installed when noticed.  The interface for some servers will permit a scan for new software updates to be performed.

Regular Scanning and Testing: installing software to a dedicated server is extremely easy but this also means that it is easy for malware to find its way onto your server.  Malware is capable of copying databases and can be concealed within legitimate scripts and applications.  To resolve the possibility of a problem with malware, complete scans of your server for vulnerabilities on a regular basis, also check with your service provider for whether they offer an ongoing vulnerability scan as a part of their service.  

Backup your Data: attacks and security breaches which cause the loss of important information for small and large businesses occur every day; they are the last thing to be expected and they are impossible to predict.  To safeguard against the possibility of becoming the next victim setup regular data backups for your dedicated server.  In this way important saved data can be recovered from an alternative location, and in the event of a security compromise at least you can recover your data instead of losing it altogether.

Data Response Protocol: with the guarding of data being of some importance to your organisation, now would be a good idea to establish a chain of command and a protocol for handling security risks and data breach situations.  It should be known who to contact, how to reset passwords, and how to complete any important steps should also be clear.  Preparing statements ahead of security breaches for affected customers is also a good idea.

By doing the above you will maximise the security available to your dedicated server.  If you should find that you are too busy to complete these things, consider a service provider that offers an extra customer service aspect by providing your organisation with these as a professional service.

Hosting Service Providers

To add to this writing I will research to find hosting service providers that offer the security, performance and customer service features that match the needs of domain name owners.

Before I close off I’d like to add that clients of a dedicated server service could also do with the eight points of security solutions that I have pointed out to people interested in shared hosting solutions.  I mean, even though the risk of bad neighbours is eliminated, you just never know what hackers can do before they strike, so take preventative precautions anyway – is my advice.

You now know what secure hosting is, who needs it and why 😉 

Digiprove sealCopyright secured by Digiprove © 2020

Leave a Reply

Your email address will not be published. Required fields are marked *

Translate »