Monday, July 27, 2015
If you publish anything online, one of your top priorities should be security. Getting hacked can
negatively affect your online reputation and result in loss of critical and private data. Over the
past year Google has noticed a 180% increase in the number of sites getting hacked. While we are
working hard to combat this hacked trend, there are steps you can take to protect your content on
the web.
Today, we’ll be continuing our
#NoHacked campaign. We’ll be
focusing on how to protect your site from hacking and give you better insight into how some of
these hacking campaigns work. You can follow along with #NoHacked on
Twitter
and
Google+. We’ll also be wrapping
up with a
Google Hangout focused on security
where you can ask our security experts questions.
We’re kicking off the campaign with some basic tips on how to keep your site safe on the web.
Strengthen your account security
Creating a password that’s difficult to guess or crack is essential to protecting your site. For
example, your password might contain a mixture of letters, numbers, symbols, or be a passphrase.
Password length is important. The longer your password, the harder it will be to guess. There are
many resources on the web that can test how strong your password is. Testing a similar password to
yours (never enter your actual password on other sites) can give you an idea of how strong
your password is.
Also, it’s important to avoid reusing passwords across services. Attackers often try known
username and password combinations obtained from leaked password lists or hacked services to
compromise as many accounts as possible.
You should also turn on
2-Factor Authentication
for accounts that offer this service. This can greatly increase your account’s security and
protect you from a variety of account attacks. We’ll be talking more about the benefits of
2-Factor Authentication in two weeks.
Keep your site’s software updated
One of the most common ways for a hacker to compromise your site is through insecure software on
your site. Be sure to periodically check your site for any outdated software, especially updates
that patch security holes. If you use a web server like Apache, nginx or commercial web server
software, make sure you keep your web server software patched. If you use a
Content Management System
(CMS) or any plug-ins or add-ons on your site, make sure to keep these tools updated with new
releases. Also, sign up to the security announcement lists for your web server software and your
CMS if you use one. Consider completely removing any add-ons or software that you don’t need on
your website—aside from creating possible risks, they also might slow down the performance
of your site.
Research how your hosting provider handles security issues
Your hosting provider’s policy for security and cleaning up hacked sites is in an important factor
to consider when choosing a hosting provider. If you use a hosting provider, contact them to see
if they offer on-demand support to clean up site-specific problems. You can also check online
reviews to see if they have a track record of helping users with compromised sites clean up their
hacked content.
If you control your own server or use Virtual Private Server (VPS) services, make sure that you’re
prepared to handle any security issues that might arise. Server administration is very complex,
and one of the core tasks of a server administrator is making sure your web server and content
management software is patched and up to date. If you don’t have a compelling reason to do your
own server administration, you might find it well worth your while to see if your hosting provider
offers a managed services option.
Use Google tools to stay informed of potential hacked content on your site
It’s important to have tools that can help you proactively monitor your site.The sooner you can
find out about a compromise, the sooner you can work on fixing your site.
We recommend you
sign up for Search Console
if you haven’t already. Search Console is Google’s way of communicating with you about issues on
your site including if we have detected hacked content. You can also set up
Google Alerts on your site to notify
you if there are any suspicious results for your site. For example, if you run a site selling pet
accessories called www.example.com, you can set up an alert for
site:example.com cheap software
to alert you if any hacked content about cheap software suddenly starts appearing on your site.
You can set up multiple alerts for your site for different spammy terms. If you’re unsure what
spammy terms to use, you can use Google to search for
common spammy terms.
We hope these tips will keep your site safe on the web. Be sure to follow our social campaigns and
share any tips or tricks you might have about staying safe on the web with the #NoHacked hashtag.
If you have any additional questions, you can post in the
Webmaster Help Forums
where a community of webmasters can help answer your questions. You can also join our
Hangout on Air about Security
on August 26.
How we apply this
We archive Search Central announcements because client questions often trace back to a change that was announced years ago. Reading the original is faster than reconstructing it from second-hand summaries.
Related services