The following checklist is a good collection of security tips offered for review to ensure your web site is as secure as possible.
While many PHP applications generate files you may not be familiar with, it is important to watch for files or directories that may sound suspicious such as 'wellsfargo' or 'abbybank'.
Old security holes are updated and remedied in new versions of software, so updating to the newest versions available ensures that you are running the most secure option available. If you installed these applications using MOJO Marketplace, automatic updates are available by clicking the 'Upgrade' button. For installations done with Fantastico, the main Fantastico screen will show a link on the right-hand side of the screen with the available versions you can upgrade to. In addition, go to the script's official site and subscribe to their updates list or security announcements list/feed.
Just because your applications have been updated doesn't mean the plugins you use have been also. Popular plugins for Wordpress, Joomla, Drupal, etc are created for specific application versions. When updating your applications, make sure the plugins you're using are also certified to work with the newest version of your software. In addition, go to each plugin's official site and subscribe to their updates list or security announcements list/feed.
In case a hacker got one of your passwords, change them all
Each database/application you have installed on your account is another possible point of entry for attackers. By removing applications/databases that are no longer used, you will be eliminating the potential for those outdated scripts to be exploited.
Most website files should be set at 644, and folders should be set to 755. This can be adjusted in an FTP client or by manually changing it in the Control Panel File Manager by selecting the file, and clicking on the icon at the top of the screen that says, 'Change Permissions'.
Moving your config.php and other files containing passwords to a secure directory outside of the 'public_html' folder will make them inaccessible to general web surfing.
'php.ini' is a configuration file containing PHP interpreter settings. The syntax of the php.ini file is quite simple, which allows you to edit it without possessing deep specialized knowledge. By adjusting the properties of this file, you can greatly increase aspects of your security. This file is generally located in your 'public_html' directory. If you're unable to see this file, you may need to manually generate one. You can manually generate one by logging into your Control Panel and clicking the 'PHP Config' icon located in the section called 'Software/Services'. You'd then click the button that says, 'Install Master PHP.ini File'. This will install a file in your 'public_html' directory called 'php.ini.default'. To make this file active, you will then need to rename it to 'php.ini'.
If you're connecting to the internet using a wireless connection, make sure the wireless network is using a method of security such as WPA or WEP encryption.
One of the biggest security holes in Internet site security is accessing your site from an insecure computer. Viruses, malware, and keyloggers can be installed on your computer covertly and can be used to obtain your username/password credentials or to infect your website files themselves. Practice good at-home computer security by regularly running a reliable anti-virus/spyware scanner.
If you use an email application, like Outlook or Mac Mail, be sure to use SSL when connecting to the email server. This will help prevent theft of sensitive information from your email as it travels from your computer to the email server.