[website operation] Talk about how to avoid the CMS website is hacked as far as possible

First, remove the CMS feature


General hackers will get in bulkWeb site vulnerability, and you canThe only basis for operations is to have certain characteristics that are common to the same type of Web site. That being the case, when we use certain types of CMS, we can start with these aspects. To get rid of these features, you can avoid being scanned in batches by some programs. For example: Some vulnerable directory, dedecms in the plus,date these directories can be changed, but need to understandPHP program to understand, if it is not understand the program, you can change some simple file name can also, such as Dede before the search vulnerability, scanning program is in the scanning search.php, may be changed to s.php can also be run, and will not be scanned by the program. If you do not know how to change, it is recommended to look at the daily Web site log, there must be a lot of scanning traces, some directories to make corresponding adjustments, the basic can avoid the program batch scanning.


Second, control site Write permissions


Get Webshell, how to write a little code in the Web site, whether it is a word or upload horses, you need to have files in the server, strict control of the site's backup function and upload format, the program to detect the upload file format needs to be rigorous, or it is easy to have loopholes poor students. If you can not find a loophole, the author has a small suggestion, each time I put the site write permission to close, I need to update the article, open write, so although relatively stupid, but the effect is good, no write permission, get backstage also no use.


Third, timely attention to the latest patch of the CMS vulnerability


In fact, a lot of access to Webshell site, are unmanned management, not in time to update the program caused by the general vulnerability to large risks, the official in a short period of time will update the patch, otherwise, the loss is very heavy, will lose a lot of users. If you find a loophole, you can also timely feedback to the developer.


Do the above three points, you can effectively avoid the CMS has a loophole when the program batch scan to, before scanning to, your site is relatively safe. To do timely update is the king.

[website operation] Talk about how to avoid the CMS website is hacked as far as possible