Importance of SSL Certificates

Chrome/Firefox Shows HTTP Sites as Not Secure

In January 2017, with the release of Chrome 56, a “Not secure” message  presented on pages with password and credit card form fields that are not protected with an SSL/TLS certificate.

Google does not plan to stop there. In a to-be-announced release, Chrome will not show the circle-i, but will show the red triangle for all HTTP pages. This is the same indication that is provided for broken HTTPS sites and will further stress the “not secure” message.

Website owners and administrators need to consider Always-On SSL or the HTTPS Everywhere concept. Now HTTPS will provide the following advantages:

  • Security to all websites and pages regardless of content
  • Mitigate known vulnerabilities such as SSLstrip and Firesheep
  • Provide browser user privacy
  • Higher search engine optimization (SEO) for Google
  • Higher trust indication with a green lock icon and no “Not secure”

In a similar fashion, Mozilla Firefox :

This is a new feature that is available starting in Firefox version 51.

Firefox will display a grey lock icon with a red strike-through in the address bar, when a login page you’re viewing does not have a secure connection. This is to inform you that if you enter your password it could be stolen by eavesdroppers and attackers.

Starting in Firefox version 52, you will also see a warning message when you click inside the login box to enter a username or password.

pw.jpg

With proper installation of an SSL/TLS certificate, the “not secure” warning will disappear and be replaced by a green lock icon. Then the answer to the above questions will be “Yes, the site is secure.”

Secure your site and data now : Buy SSL Certificates here

When To Shift to VPS or a Dedicated Server ?

When is it appropriate to upgrade from a Shared Hosting plan to a VPS or even a Dedicated Server. Below is a breakdown of certain scenarios where you should definitely consider a VPS over your Shared Hosting account.

  • Your cron jobs are not finishing due to resource usage and PHP timeouts.
  • Resource limits are being reached on a consistent basis.
  • Your sites require non default configurations.
  • There are bursts of traffic to your sites with many concurrent users.
  • You have an online store with several hundred products.

    These are general guidelines for when you may need to upgrade. Of course there are several more reasons that would warrant a need to upgrade.

Even if you have a new or smaller site, it’s always a good idea to remain prepared for growth. That’s because over time as your websites grow, you’ll need a little bit more power to keep them running smoothly.

Cloud – The buzz word !

Cloud is more than just a fancy buzzword thrown around in tech circles. Understand the fundamentals of Cloud and how it is different from regular hosting, what makes it superior and what are the downsides, if any. Get a handle on the different flavors – Shared Cloud hosting, Cloud Servers as well as cloud hosted applications. Understand whether you or your customers should choose cloud and learn about the rapid innovations in cloud that have changed the shape of the Web Presence industry. Cloud servers, SAAS, PAAS, IAAS, ready-to-use server images, Virtualization, 1-click RAM, CPU, Bandwidth upgrades, case studies of brands using Cloud and everything you should know is here!

Why Cloud Hosting?

Performance:

  • With a top-of-the-line technology platform, leveraging high-end processors, high-performance storage & memory along with clearly defined resource isolation, our new cloud platform gives you the performance your customers are expecting
  • Low-density servers (fewer customers per server) coupled with Varnish, will help boost your web-page load speed two-fold!

Scalability:

  • If you wish to increase the performance of your site, simply click the upgrade button on the control panel for more resources to be applied to your site
  • No intrusive downtime or platform migration required, no surprise usage fees on your next bill, you are in complete control! In short, you can allocate more CPU (up to 8 additional cores) and RAM (up to 8 GB of Additional RAM) to your Cloud Hosting Package to handle traffic spikes

Redundancy: Since the storage backend is based on ceph  with 3 copies of data stored in different locations, across different drives and cabinets, we will migrate you onto another server if any hardware issues are detected on one server.

Fully Managed Support:  Ready to harness the benefits of cloud but not sure what that exactly means?  Don’t worry, our team of expert support agents is here every step of the way.

Securing a hacked site

This guide explains how to secure your web site after it has been hacked, and how to help prevent future attacks.

Determining the cause

The first step to securing your web site and getting back to normal operation is determining how it was hacked. In general, most hacks occur for one of the following reasons:

Your FTP password has been compromised.

File permissions for files or directories in the public_html directory are too permissive.

You have a software application installed on your web site that contains a vulnerability. The vulnerability is being exploited to run arbitrary code on the server.

Software vulnerability hacks are more common than FTP/SSH password hacks, primarily because of the huge growth in pre-bundled software applications. Users often set up an application and then forget to apply security updates, leaving their sites vulnerable to attack.

Similarly, if a file or directory in the public_html directory has permissions set to 777 (full access), code or data may be exposed and potentially exploited by an attacker.

Looking for FTP password compromises

Change your account password in cPanel immediately.

Stop using FTP. Regular FTP transmits your password over the Internet in unencrypted plaintext and is easily intercepted. Use SFTP or SSH instead. For information about how to do this, please see these articles.

Verify that you are running up-to-date virus and malware protection on any computers you have used to access your account.

After you have followed these steps, go to the Cleaning up after a hack section below. Otherwise, if you did not find any suspicious behavior, go to the next section.

Looking for software vulnerabilities

Out-of-date software applications often contain well-known security vulnerabilities that malicious actors can exploit using automated scripts. Software applications include anything you have installed using Softaculous, as well as any packages that you have installed manually. Usually these are applications such as blogs, image galleries, forums, shopping carts, content management systems, etc.

You should review all of the software applications that are installed on your web site. Make sure you have installed the most recent version and all updates. When you update software applications, make sure you check the plugins as well. If you have any non-standard plugins installed with your applications, do a web search for the plugin name and the term “vulnerability” to see if there are any known issues with your version. If you discover any known vulnerabilities, either update the plugin or disable it.

You should also check for recent errors on your web site by using cPanel’s Error Log feature. Error messages can help you determine which software applications or files are vulnerable. For more information about how to access the error log in cPanel, please see this article.

After you have updated your software applications and plugins, go to the Cleaning up after a hack section below.

 Cleaning up after a hack

After you have secured your web site, the next step is to clean up the mess left behind by the perpetrators and restore normal operation.

Removing hacked files

You should go through all of the files in your account and delete anything that you did not put there. If you are using an FTP client, make sure it is set to show hidden files. Similarly, if you are using the command line in SSH, make sure you use the -a option with the ls command so it shows all files. (Many malicious files try to “hide” from casual observation by making themselves hidden.)

Although we recommend going through all of your files, you can prioritize your search. Look first for file modification timestamps that have changed since you last modified your site, or that occurred around the time the hack took place. If you identify a file that was modified during the hack (such as a defaced index page), you may be able to locate other affected files by searching for similar timestamps.

Setting correct file permissions

By default, every directory beneath the public_html directory should have its file permissions set to 755 (full access for the owner, and read and execute access for everyone else). Additionally, every file should have its permissions set to 644 (read and write access for the owner, and read access for everyone else).

After you make these changes, you may need to adjust permissions for a few individual files, depending on the applications you have installed. Nevertheless, it is a good security practice to set secure permissions initially, and then make any individual adjustments as necessary.

Restoring databases

Some hacks, particularly SQL injection attacks against vulnerable Joomla! installations, may alter the database with malicious code. These modifications can grant an attacker access to your account even after you update applications and remove altered files.

Therefore, you should review your databases to see if there are any suspicious changes. You may also want to restore the database from a backup that was completed before the attack occurred.

 Restoring lost and modified files

You can use the Server Rewind feature in cPanel to restore files in your home directory that have been lost or modified within the past month.

Re configuring WordPress

If you use WordPress, there are additional steps you must take to secure your site after an attack. For example, you must reset the WordPress security keys.

How ICANN’S new transfer policy will affect domain transfers

If you or your customers plan to transfer a domain name in the near future, read on to find out about new policy changes that may impact your transfer process.

Through this blog we hope to cover the following points,

  • What the IRTP is
  • How this impacts you
  • What aalpha net solution (ANS) is doing to aid you in this process
  • FAQ’s

What is the IRTP?

‘The Inter Registrar Transfer Policy’ is a new transfer policy by ICANN that affects all ICANN-accredited registrars and takes effect from the 1st of December 2016.

In our email dated November 3rd, we outlined the new process that would apply to any domain registrant who changes or modifies contact information post the 1st of December, 2016.

How the IRTP affects you?

ICANN has revised its IRTP to curb domain hijacking and fraudulent transfer of gTLDs. An IRTP action is triggered when you or your customers make any material change to the registrant’s name address or organisation – while transferring ownership of a domain name or merely updating contact information.

Since these policy changes will impact you and your customers, you need to complete additional steps in order to confirm a transfer to another party.

Electing the privacy protect feature on your domain name will also trigger a change and affect you and your customers as per the revised IRTP policy.

Note: We have also updated our Registration Registrant Agreement.

FAQ’s

We hope this was helpful and if you have any further questions please feel free to get in touch with us.