Knowledge Base

How Did My Website Get Hacked

Common ways how a website is hacked and how to prevent them

Attack type	Description	How to prevent them
SQL Injection attacks	This is considered the most common form of hacking. Most websites use SQL to connect with databases which allows it to retrieve, create, delete, and update database records such as e-commerce transactions. An SQL injection attack places SQL into a web form in an attempt to get the application to run it. For example, instead of typing plain text into a username or password field, a hacker may type in ‘ OR 1=1. If the application appends this string directly to an SQL command that is designed to check if a user exists in the database, it will always return true. This action allows the hacker to gain access to a restricted section of a website. Other	SQL injection attacks can be prevented by correctly filtering user input. Most programming languages have special functions to safely handle user input that is going to be used in an SQL query.
Cross-site request forgery (CSRF or XSRF)	It is another common and known malicious exploit of websites. Hackers take advantage of the privileges that an authenticated user has by sending unauthorized commands like transferring funds, obtaining account information, or gaining access to sensitive information. They do this by transmitting forged commands like including hidden forms, AJAX, and image tags. Users are is unaware that a command has been sent, and the website believes that the command came from an authenticated user	Website owners can prevent this by checking HTTP headers and verifying where the request is coming from and checking CSRF tokens in web forms. These checks will ensure that the request has come from a page inside the web application and not an external source.
Cross-Site Scripting (XSS)	CCC is a major vulnerability exploited by hackers. This type of attack uses malicious Javascript scripts embedded in hyperlinks. When the user clicks the link, it can hijack a web session, take control of a user account, steal personal information, or change a user's advertisement preference. Hackers insert these malicious links into web forums, social media websites, and other prominent locations where users can click them.	To avoid XSS attacks, website owners must filter user input to remove any malicious code.
Denial of Service (DoS/DDoS)	DOS attack floods a website with Internet traffic, overwhelming its servers, which causes it to crash. DDoS attacks are carried by computers that have been compromised with malware. Owners of infected computers may not even be aware that their machine is sending requests for data to your website.	Limiting your web server’s router by adding filters to drop packets from dubious sources, dropping spoofed or malformed packets, setting more aggressive timeouts on connections, using firewalls with DDoS protection, using third-party DDoS mitigation software.
Non-targeted website hacking	Hackers are targeting a vulnerability that exists for a content management system, plugin, or template. To cite an example, they may have developed a hack that targets the vulnerability of a particular version of WordPress, Joomla, or another content management system. Another example is using automated bots to find websites using this version of the content management system in question before launching an attack. They might use these vulnerabilities to delete data from your website, steal sensitive information, or insert malicious software onto your server.	Ensure your content management system, plugins, and templates are all up-to-date.
Social engineering	The greatest weakness of a website's security system is the people that use it. A hacker will convince a website user or administrator to divulge some useful information that helps them exploit the website. There are many forms of social engineering attacks, including: Phishing - Users are sent with fraudulent emails that look like they have come from the website. User is asked to divulge some information, such as their login details or personal information. The hacker will use this information to compromise the website. Baiting - A hacker will leave a device near your place of business, perhaps marked with a label like “employee salaries”. One of your employees might pick it up and insert it into their computer out of curiosity. The USB stick will contain malware that infects your computer networks and compromises your website. Pretexting - A hacker will contact you, one of your customers, or an employee, and pretend to be someone else. They will demand sensitive information, which they use to compromise your website.	The best way to eliminate social engineering attacks is to educate your employees and customers about these kinds of attacks.

For additional protection, make it a habit to:

Change your passwords regularly.
Run virus scans on your personal computer (or whatever device you use to access your website) to ensure it is not infected with keyloggers or other malicious code that could compromise your login credentials.

Our higher-tier technicians can locate and remove malicious content and files, but they cannot correct security vulnerabilities inherent in some Open-Sourced Software. SiteLock is recommended because they scan through your data regularly to check for vulnerabilities and even have services available that can correct vulnerabilities.

If you need further assistance or would like to know more, please contact us at 855-426-0519. Our friendly security specialists will be more than happy to assist you.