Best Website Security Service

[NileCruises]

Having been hacked twice and, it seems, still suffering from problems as a result (file changes and alterations, etc) I'm wondering if there is a good paid service that provides security for websites?

I'm an online travel agent so our websites "up-time" and search engine position is vital but I'm spending more time trying sort out our websites' security than selling travel.

It would be sensible to pay for a service that would ensure, as much as possible, that our site is secure and any optimisation we do is not cancelled out by hacking and security problems.

If anyone could recommend a good company I would be very grateful.

Colin

[NileCruises]

Thanks very much Matt.

[Matt-Williamson]

No problem - an SSL isn't going to prevent the problem you have, but that is why I mentioned going down the route of an SSL with extras such as daily malware scanning and weekly vulnerability assessment.

Verisign would have most likely alerted you to the potential issue before hand so you could have fixed the vulnerability. Also if your site is compromised with malware it will alert you, so you can take immediate action.

As far as SSL goes; now your site has been compromised and you are acting as a travel agent you want to make sure your pages are as secure as possible and a Verisign logo will help customers trust in entering data into your site.

You will still need to make sure that you employ the help of someone who is knowledgeable on the CMS that you are using to make sure it is setup to the optimum not leaving easily exploited windows open, so to speak.

[matbennett]

Most compromises of that type I've seen have been down to a flaw in either the CMS or the way it was set up (usually permissions).  This type of breech is far more common that cracked passwords, servers being compromised etc.  They can be annoying to track down, but are usually more easily fixed.

[NileCruises]

Thanks Matt. I take your point.

We've added a number of security measures to the CMS but it looks like we havent' successfully added enough.

Your suggestion to search the platform specific communities is really useful.

Cheers.

[matbennett]

Just adding an SSL isn't going to help if you are having the sort of problems that you mention.

Your core issue is most likely to be with your CMS. If that is the case then you are probably best finding someone who specialises in that CMS (or generally in coldfusion) who can find the source of the problem and lock it down.

If you are using an off the shelf CMS make sure that it is up to date and fully patched.  Check the platform specific communities for people having similar issues and see whether they have successfully prevented the problem recurring.

Good luck.  You might just find that there is an insecure upload script or something and once you find that the problems will just end.

[NileCruises]

Hi Matt, thanks for replying.

I have looked at Verisign but wonder if it's comprehensive enough. (If there is such a service).

I wonder if Verisign's service would flag up or better still prevent something like my robot.txt file being altered by a malicious script?

Or whether the malicious script would not have been able to access my site if I was with Verisign?

Colin

[Matt-Williamson]

Have you considered verisign - http://www.verisign.com/ and one of their SSL solutions, with extras such as

http://www.symantec.com/verisign/ssl-certificates/secure-site-pro-ev?inid=vrsn_symc_ssl_SSPEV