Security is vital for every website, but especially yours. No matter how well things are going or how much help you've received in driving site visitors to purchases, a digital attack by hackers can be devastating and stressful. When a business gets hacked, the result can be anything from a loss of money to a loss of reputation. If your eCommerce site has been hacked, don't panic! This doesn't have to spell doom for everything you've worked to build. Many quality web-hosting services will alert you of hacking attempts (or successes). You may also notice that a hack occurred when things go wrong:
- Unexplained charges
- Missing or additional files or users
- Changes to your website's pages or links
- Other irregularities
What is the first step if my site gets hacked?
If you can, immediately disable or log out other users besides your main admin account and put your site in "maintenance mode" (or the equivalent) so that visitors will not be able to view it. This is the first step to take if your site has been visibly changed by a hack, perhaps by uploading inappropriate/unrelated content or through a malicious redirect (leading visitors to a different site than yours).Putting your site into maintenance mode will stop visitors from seeing the hacked or changed site, protecting them from whatever the hacker intended and protecting you from having more visitors see your site in a moment of vulnerability.Next, if you noticed the hack before your hosting service did, contact them. They may be able to help you know what to do specifically with their service to react to the hack, and they may even have malware removal or other services which can get your site back on track as soon as possible.
How can I minimize damage?
Consider contacting a hack-fixing or response service
There are companies who can help guide you through responding to a hack, whether they're associated with your web host or come from a third party. Getting in touch with one of these service providers may help you catch issues you weren't aware of and guide you through a difficult situation.
Change all your passwords
Even if you know which account was compromised, it's probably a good idea to change every important account's password: admin user passwords, your password with your hosting provider, database passwords, and so on.
Check for new, unauthorized users
If a hacker is fast enough, or if you don't notice the attack in time, they may have been behind your security long enough to add themselves as a new admin account. This could let them get back in later even if you take some of these other steps, so make sure that you check the administrators on your site and that there aren't any new users who shouldn't be there.
Check for unwanted files
In addition to new admin accounts, hackers could also leave behind malicious or unwanted files in your site. These files could be there to continue disturbing things, or they could be another way the hackers might try to regain access later. Check for and delete any files that shouldn't be there.
Check your plugins
Many websites, especially those hosted on WordPress, are hacked not through the main hosting service, but instead through vulnerabilities in one or more of the plugins that they have added. In addition, it might be a good idea to uninstall and reinstall any plugins or themes, and make sure that they're up to date to avoid future security issues.
Preventing future problems
Of course, once you've taken all these steps and gotten things back as close to normal as possible, you'll want to start thinking about things that you can do to stop any potential security issues in the future. While it's likely impossible to guarantee that you'll be 100% safe from a determined hacker with enough time on their hands, there are definitely some helpful steps that you can take to make sure that you're removing vulnerabilities and making it harder for unauthorized access or other issues to occur.
What could make my site vulnerable, and how can I prevent hacking?
There are lots of things that can make a website vulnerable to hacks. With inspiration from several sites which provide helpful lists and information related to hacking and fraud, we'll look at a few things you can do for your website to make sure that you're avoiding as many vulnerabilities as possible:
1. Make sure your platform and online checkout system are reliable and secure.
Your ecommerce platform underlies much of what you do online for your site, and therefore any vulnerabilities that exist in the platform itself will carry over into your specific site. Ensure that the platforms you are using for hosting your ecommerce site and securing your online checkouts are well supported and up-to-date on their security.Some specific recommendations would be to find platforms which have a secondary authentication system and/or allow you to host your administrative features on an internal network. When it comes to online checkouts, a secure connection is also crucial for security and customer confidence and willingness to make purchases.An easy recommendation for your online checkout system is to make sure that it uses a Secure Sockets Layer, or SSL, authentication system.
2. Look into DDoS protection
DDoS is a common type of attack on websites, standing for Distributed Denial of Service. While it's unfortunate how frequently they occur, that frequency also means that there are some very effective protections and mitigation services for DDoS attacks. You should look for DDoS protection services for your website.
3. Keep up to date with updates and patches
You should always keep third-party systems up to date. The companies maintaining software programs try to keep abreast of security issues as soon as they're discovered, and if they're doing their job, they will frequently release patches that fix those issues. You should always keep every part of your system up to date, since many hacked websites are found to be running out-of-date plugins or other systems which would have been less vulnerable had they been updated appropriately.
4. Use strong login credentials, including passwords
Make sure that you've personalized your usernames (even for the Admin account) and created unique passwords which are complex enough to be difficult for even a computer to puzzle out.
5. Consider adding two-factor authentication protocols
Two-factor authentication requires login attempts to use not only a password and username but also a second form of identification–in most cases, an app or message sent to a personal cell phone, ensuring that you're really the person who is attempting to log in. This is especially helpful for preventing login attempts from remote locations, and can even stop hackers who already know your password from logging in as long as you deny their access attempts (and change your password later, of course!) Your website hosting service may provide this as an option, or you may need to enable or purchase plugins which will set it up for you. Either way, two-factor authentication is another layer of security for your site, making breaches less likely.
6. Make sure that you have backups for your site and data!
Nobody wants to lose everything in a hacking attack, but it is, unfortunately, possible to have massive losses of data or information, or even lose the site itself, if a severe attack happens. To be prepared for the worst, it's a good idea to back up your site and information, whether you do this yourself or find a hosting service that does it for you frequently (daily, if possible!). Having a backup ready will let you recover after losing data, whether due to a power outage or an attack.
Conclusion
Remember, don't panic! If your site hasn't been hacked yet, try to identify any vulnerability that could be used against you and remove it as soon as you can. If you have been hacked, there are steps to respond to that sort of attack. You can get things back up and running sooner than you might think!Looking for ways to take your eCommerce site to the next level? Consider scheduling a strategy call with Ampry, a platform for driving site visitors to purchases.