The CW Corner – Best practices for mitigating website hacks

We at CharlesWorks are often asked by our web clients if their site is protected from malware and getting hacked. They also want to know if there site IS hacked, whether there be a charge to fix it.

The totally hack-proof website

The totally hack proof website has no access to it. So it’s not connected to the Internet. No one can view it. Such a website doesn’t sound like its of much use if no one can see it.

So, let’s agree that it is unrealistic to believe that a publicly accessible website can be totally hack-proof. Any website that is accessible via the public Internet is consistently subjected to attempts to break into it. Believe it or not, that’s the norm as opposed to the anomaly.

That being said, however, there ARE things you can do to mitigate website hacks. I have to stress the word mitigate here. Mitigation is defined as the action of reducing the severity, seriousness, or painfulness of something.

Site hacks are based on odds

My goal here is to simply remind you of what you most likely already know: that we can reduce the probability – the odds – of your site being hacked. We at CharlesWorks want that probability to be so low that it hopefully it doesn’t ever happen to you.

The major hacking causes

I have been operating CharlesWorks since 1998. In my experience, there appear to be two major reasons why sites get hacked:

    • The access credentials/passwords have been compromised.
    • The software that operates them wasn’t kept up to date.

Lets take a look at each of these below.

Compromised Access Credentials

Compromised passwords and bad actors gaining access to website login credentials is the major reason we see sites hacked. Think about this in terms of your car. You could have alarms on it. But if you make a copy of your car key and give it to someone, they can do whatever they like with the car. Whether its a drive along the beach or to rob a bank, your car is theirs to use with the key you gave them. Credentials – log in and passwords – work pretty much the same way.

CharlesWorks has many clients who want to be able to do things themselves. We are strong proponents of doing it yourself when it’s feasible and convenient. This is especially true for adding posts or page materials. It also makes sense when making other changes or modifications to your site. It is, after all, YOUR website.

However, many people fall prey to phishing schemes. Directly or indirectly, they usually end up tricked into giving out their website access credentials (as well as credentials to everything else they own). This is especially true if your email account is hacked and the hackers are able to access emails containing your website’s (and other) login credentials.

This problem is exacerbated if you have shared your website’s administrative or other access with others. Think of your emails containing various authorizations or login information as a potential weak link in a chain. If you have shared that information with others you have now created more weak links. This increases the odds of a potential compromise.

One of the best ways to mitigate these situations is to change your site’s access passwords so they are different than those possibly stored in your emails. And, to hope that anyone you may have shared your website access with has done the same.

Obviously, should site access be gained in such a manner, it would be your burden to have the site restored. I’ll expound upon this a little more at the end of this article.

Out of Date Security/Software Updates

Malware and virus protection on home computers operates a little differently than the same types of protection on servers. Website servers operate in the publicly accessible Internet. This results in many more entry points for potential issues. There are a number of very standard server protections available (which we utilize here at CharlesWorks).

After bad actors getting (or guessing) your passwords, the next major reason sites get hacked surrounds unapplied security updates and other software update issues. At CharlesWorks we mitigate such issues by running anti-malware software on our servers. Also, WordPress sites hosted on our servers are kept up to date automatically via automatic updating of the WordPress core as well as automatic updating of the the website’s plugins and themes.

There are literally thousands of individual pieces of software that must work in unison to operate most websites. These are developed by many more thousands of developers around the world. Unfortunately, no company can guarantee that a website will never get hacked. They can only mitigate security compromises and hope against the worst.

Restoring your Website

Regardless of which of the two situations above may have led to your website’s issues, your website will most likely need to be restored. That’s because after a bad actor or a hack back doors into the site will most likely have been installed for the bad actors to gain access again.

Many Internet companies claim to have automatic backups. In most of those, those backups are accessible to the user in their account. If the account is hacked, how safe do you suppose that is?

Some Internet companies delete and account upon a website being hacked. In those cases I have seen many left with no website or backup as a result.

What I believe is most important regarding this topic is the manner in which our WordPress sites are backed up every day for 30 days. Our backups are made to separate servers – external to those your the site operates on. For security reasons, the site administrators do not have access to these backups. So even with a site administrator’s compromised passwords there is no access to the backups. With these backups we can usually restore an average site in about 10-30 minutes if it needs restoring. And we can go back as far back as 30 days. We would only bill our web client for the 10-30 minutes (again – for an average website) which results in only a minor charge to restore it. Note that some websites are extremely large and require much more time to restore but these are very rare).

In my experience running CharlesWorks since 1998, we’ve built and handled more than 5,000 websites. At this point in time, I do not recall the last time a website we built and totally maintained was hacked (unfortunately I recall several instances of sites maintained by others that failed to ensure the site was updated and/or had their passwords compromised).

Sites getting hacked for out of date software happens far less frequently (if at all) when security updates are kept up to date and bad actors are kept out.

I hope this helps you understand a little more about this topic.

FacebooktwitterredditpinterestlinkedinmailFacebooktwitterredditpinterestlinkedinmail

The CW Corner – Adding Akismet comment spam protection

Akismet provides a convenient and free way to protect your personal WordPress site or blog from spam.

Many times we’d like to allow comments to be left on our WordPress site. The hassle with this can be the tremendous amounts of spam that come through the forms on websites.

Akismet is a compact WordPress plugin that filters the incoming comments. It is pretty straightforward to use and pretty easy to set up as well.

Install the Akismet plugin

The first step in this process is to ensure that the Akismet plugin is installed in your WordPress website:

      • Log into your WordPress website’s dashboard as an administrator
      • Click on Plugins in the left dashboard navigation column
      • Look and see if Akismet is listed – if it is – and it is not activated you can proceed to the Akismet Setup step below – otherwise
      • Click on Add New under Plugins in the dashboard navigation column
      • If you don’t see Akismet in the plugins, then in the text box to the right of the work Keyword in the row starting with Featured type in Akismet – then click on its Install Now button. Do not activate it yet.

Perform the Akismet Setup

To set up Akismet in your website, you will need an API code from the Akismet site. The first step in that process is to navigate to:
https://akismet.com/plans

This (as of the time of this writing) brings you to a page that should look similar to the screenshot below.

Akismet offering pricing page

Akismet offering pricing page

To get the free version of Akismet comment spam protection, you will need to click on the Get Personal button on the above page.

Once you’ve done that, you should see a page similar to the one below. Before attempting to fill out anything on this page, we need to set that $36 / YEAR to $0 / YEAR. Click on the $36 / YEAR box and drag it to the left.

Akismet Default $36 per year page

Akismet Default $36 per year page

Dragging that $36 / YEAR box to the left should change the page to display something like the one below showing 0$ / YEAR. You can also see that the information to fill in has changed.

Akismet $0 per year page

Akismet $0 per year page

Akismet $0 per year page

Now fill in the information completely. Note that you need to be able to check all three checkboxes indicating the following:

      • you don’t have ads on your site
      • you don’t sell products/services on your site
      • you don’t promote a business on your site

If these are the case, then you will qualify for a free, personal plan.

All you have to do once you have gotten this far is follow the directions on the page below.

Akismet signup complete page

Akismet signup complete page

Finally, it is suggested that while on that settings page in Akismet, you can choose to show the number of approved comments beside each comment author and choose whether to show a privacy notice or not. Then just click the Save Changes button and you are on your way!

FacebooktwitterredditpinterestlinkedinmailFacebooktwitterredditpinterestlinkedinmail

The CW Corner – SEO Scammers

Almost all businesses get the usual spam SEO (Search Engine Optimization) phone calls.

Recently, one of my web clients took one. As a result of such calls, she emailed me. She expressed a lot of concern about having been told very negative things about her web traffic and website operation. It sounded like he was trying to get her to spend money. Money she’d never see a return on her investment for.

High-pressure sales tactics are something I have instructed staff in all our years in business to avoid. CharlesWorks policy forbids selling clients anything they don’t need. The difficulty is that there are so many spammers and scammers out there sending the same messages that people believe them. You can tell the same lie a thousand times and it’s still a lie.

Among the thousands of websites we’ve handled, her particular business is very unique – especially during the COVID-19 epidemic. Her classes are limited regarding how many people she can have in them at any given time. I told her that she is the one who knows best what should be on her website. And she is the one who knows best what she has to offer and when she can offer it.

The nature of her business, it seemed to me, is based more on a following she has developed over time. And she is limited as to how many people at a time she can physically handle. And – much as I hate to say this – COVID is going to remain a thought in many people’s minds – at least through this upcoming winter season. Things will change when a vaccine is widely available. However, common sense dictates it will be a while before everyone generally has access to it.

I suggested she shouldn’t spend more than she absolutely has to – to just keep her business operational. Those small business owners who can stay in business through this pandemic will be the ones who do great once they reach the other side of this.

It’s troubling that someone had pressured her enough to do work on her site that she became stressed over it. Sales people who proceed with such a hard sell attitude are clearly desperate for work. Desperate people are not working with their customer’s best interest in mind. My advise is to not talk to these people.

My suggestions for dealing with these really hard line sales calls are:

  • “Remove me from your calling list.” Tell them to remove you from their calling list. Once you say those words, they are supposed to do so by law. I regularly tell spammers this, and they generally don’t bother to call back.
  • Block their phone number. Block their number through whatever mechanism your telephone carrier has set up to do that. I do this on a pretty regular basis with the robocalls (which are actually illegal in most cases) and take a few minutes to report them at the https://www.donotcall.gov/report.html site.
  • Visit the National Do Not Call Registry. Go to https://www.donotcall.gov where you can put your phone numbers on the National Do Not Call Registry. Mine have been on this for many years.

While these suggestions don’t stop all the spam calls you’ll get, they do stop many.

Every small business owner can and should review their website. They should ensure that everything is up to date for offerings and schedules. That only costs them a few minutes. Because CharlesWorks charges for changes by the minute, those kinds of changes only incur those minutes of charges.

I hope this is helpful to you!

FacebooktwitterredditpinterestlinkedinmailFacebooktwitterredditpinterestlinkedinmail

The CW Corner – Domain Name Review

We’ve published plenty of information in the past about domain names. We’re always learning a little more and how to explain information to out clients as time passes.

Whether your domain name is for personal use or for your business, we hope you find the following tips to be helpful.

Keywords

Having words pertinent to your business in your domain are increasingly important. Simplistically put, search engine algorithms (the math formulae used to compute the importance or value of words contained in your site) rank the importance of web sites according to words. Many businesses use a domain name to describe the name of their business and, in addition to that, own domains which contain keywords which are present in their website.

Association

If possible, you should use the name of your business as all or part of one of your domain names. This will make it easier for your clients or potential clients to remember you and to find you on the web (like CharlesWorks.com – CharlesWorks is the name of our business).

General Names

More general domain names are most likely already registered to other businesses (of course it doesn’t hurt to check with us first). It’s still a good idea to have more general name(s) associated with your business as one of your domains (that’s why we also own HostingNH.net, which will take visitors to our CharlesWorks.net site).

TLDs

TLDs stands for Top Level Domains. TLDs are the extensions on the tail end of the domain, such as .biz, .club, .co, .com, .net, .org, .ws, etc. The most popular TLDs are .com and .net. If you find that your domain is already registered, you might try for an alternate TLD (for example, RobinSnow.com was already taken, so Robin acquired and uses RobinSnow.net).

Hyphenated Names

Although you can obtain them, we recommend not using hyphens for your business domain name. Most people who are searching for your site will not use a hyphen. You are better off to try a different TLD or a variation of your domain name.

Variations

Variations can be an option if your general business name is already registered (for example ScrapbookCabin.com was not available to one of our clients, so at the time she registered NHScrapbookCabin.com instead).

Relinquishing or giving up existing names

We have seen many horror stories concerning giving up existing domain names. Sometimes one will end up having to get a similar domain name because control over the preferred name could not be gained. An example would be where another party has control over one’s .com name and the website is down and the webmaster cannot be reached or is non-responsive. If we are to take over the services we would recommend getting the .net to the original .com of the domain name if it were available. This allows us to get the site up and at least people can be sent to that site pending transfer of the .com when it is possible. In some cases it never became possible and the site will continue using the .net domain.

Once a domain name has been in service, traffic is generated to it. For that reason, many expired or relinquished domain names are snatched up. One situation like this in the Manchester NH area involved a church giving up a domain name they did not want to use anymore (it was a version of the Church’s name that had been in use for many years and they just decided to change it and dropped the domain name). It saved them about $15 a year. However, the embarrassment was priceless when a porn company acquired that domain name and put a porn site up on it. The annual cost of a domain is truly cheap insurance against one’s domain name being used for phishing, porn, Viagra, or whatever.

There is absolutely no obligation of any kind to click the red button below and check out your domain possibilities!

CLICK HERE to find your domain name!

Already have a domain name? Click on the red button below to transfer it so we can get you online here at CharlesWorks!

CLICK HERE to transfer your domain name!

Or CALL CharlesWorks at 603-924-9867 9 am – 5 pm Monday through Friday or go to https://CharlesWorks.com/contact outside of regular hours and we will help you find one!

FacebooktwitterredditpinterestlinkedinmailFacebooktwitterredditpinterestlinkedinmail

The CW Corner – Checking Your Site

Something many folks overlook is occasionally checking their website’s functionality. I recommend doing this every couple weeks, but at minimum once a month.

Most websites and the servers they are on are subjected to ongoing software updates. Unless you are paying an additional fee for maintenance checks, it’s normal for things to occasionally break due to updates.

Most website owners are not paying additional fees for such maintenance. This means you really need to take the time to check:

– that the site appears to work properly
– that your hours of operation are correct
– that any website forms are working
– that email addresses are correct

The site operation and forms are most susceptible to software updates. If you have a good web developer, the fixes will happen quickly and it will not cost you too much.

Website maintenance should be thought of like automotive maintenance. We get oil changes. We get inspections. We even make modifications and do repairs to keep our vehicle operating the way we want. And our older vehicles can cost more to upkeep – just like older websites. As websites age, more work needs to be done to keep them secure and working as originally intended.

So check your site every now and then to keep things working and have the correct information out there!

FacebooktwitterredditpinterestlinkedinmailFacebooktwitterredditpinterestlinkedinmail

The CW Corner – Remote Work Tip

Masks help keep us all safe from the novel coronavirus

Masks help keep us all safe from the novel coronavirus

Around mid-march of 2020 the pandemic started getting taken seriously here in New Hampshire. Quickly workforces transitioned to working remotely wherever possible. Now we’re four months into it. We’d hoped the pandemic would be relaxing a bit but it appears to just be getting ramped up these days in much of the rest of the country.

Most have discovered that working remotely is not as simple and easy as it seemed at first. Now we can see some of the true difficulties.

Here is the one major tip I’ll offer today: work remotely like the boss is watching. Remember that the boss probably IS watching. When you are at that remote workstation behave as though you’re at your office workspace. Seriously. Would you go to work without washing or taking care of your personal appearance? Why risk having an unscheduled remote meeting with fellow employees totally unprepared? Poor impressions will certainly not help you when it comes to reviews.

There’s no reason to not really shine at your job remotely. Think about how fortunate you may be at not having to commute to work. And the ability to make meetings allows you to lose far less time previously afforded to travel.

The key to making remote working feasible is tied to communication. You must communicate either via text, phone, email or Zoom type meetings often enough to stay connected to your work force to complete tasks.

FacebooktwitterredditpinterestlinkedinmailFacebooktwitterredditpinterestlinkedinmail