TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Ask HN: How to secure a website?

3 pointsby devcheeseover 9 years ago
So I'm new to deploying apps to production, I'm curious of everything I need to do to make a website secure. As of now, I only know to setup SSL, I imagine there is more beyond that.

4 comments

rmdossover 9 years ago
SSL doesn&#x27;t have much to do with securing your website. If you are worrying about security, I would recommend to try to find solutions to solve the:<p>-integrity -availability and -confidentiality<p>Of your server and app. For integrity, look for file integrity monitors (OSSEC is a good open source project that does that).<p>For availability: load balancers, ddos protection, auto scaling are all things to look for. Products like CloudFlare and Sucuri can do it in the cloud for you automatically.<p>For confidentiality, try isolating your server, setting up firewalls to deny all by default, restricting access, keeping it updated, etc.<p>thanks,
mtmailover 9 years ago
<a href="http:&#x2F;&#x2F;guides.rubyonrails.org&#x2F;security.html" rel="nofollow">http:&#x2F;&#x2F;guides.rubyonrails.org&#x2F;security.html</a> is a good introduction for webapps written in Ruby&#x2F;Rails and their countermeasures.<p>It&#x27;s better to ask the same question on a &lt;insert your programming language&gt; forum or StackOverflow as most frameworks have countermeasures or configuration options included (salting password, inspecting HTTP headers, preventing SQL injection).
sumodirjoover 9 years ago
Using Cloudflare &#x2F; Sucuri in front of your website won&#x27;t hurt
tmalyover 9 years ago
lockdown all ports except 22, 80, and 443 with iptables.<p>setup a fail2ban to update iptable rules to detect repeated hack attempts and ban their ip address.