Forums
New posts
Search forums
News
Security News
Technology News
Giveaways
Giveaways, Promotions and Contests
Discounts & Deals
Reviews
Users Reviews
Video Reviews
Support
Windows Malware Removal Help & Support
Mac Malware Removal Help & Support
Mobile Malware Removal Help & Support
Blog
Log in
Register
What's new
Search
Search titles only
By:
Search titles only
By:
Reply to thread
Menu
Install the app
Install
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Forums
Security
Guides - Privacy & Security Tips
Secure your site/server with SSL/HTTPS and Anti-DDOS
Message
<blockquote data-quote="Bryan Lam" data-source="post: 602704" data-attributes="member: 35868"><p><span style="font-family: 'Trebuchet MS'"><span style="font-size: 26px"><span style="color: #ff0000"><strong><u>Bryan's Guide To Securing Your Website and/or server</u></strong></span></span></span></p><p><u><span style="color: rgb(255, 0, 0)"><span style="font-family: 'Trebuchet MS'"><strong><span style="color: #00b3b3"><u>Prerequisites</u></span></strong></span></span></u></p><p><span style="color: rgb(255, 0, 0)"><span style="font-family: 'Trebuchet MS'"><strong><span style="color: rgb(0, 179, 179)">Before you get started there are some things you'll require -</span></strong></span></span></p><p></p><p><span style="font-family: 'Trebuchet MS'"><strong><span style="color: #00b3b3">- A Domain Name W/ Web Hosting & Cpanel (Most hosting plans include this) for ease of installation</span></strong></span></p><p><span style="font-family: 'Trebuchet MS'"><strong><span style="color: #00b3b3">- An Email</span></strong></span></p><p><span style="font-family: 'Trebuchet MS'"></span></p><p><span style="font-family: 'Trebuchet MS'"><span style="font-size: 26px"><span style="color: #ff0000"><strong>Part 1: Securing your website</strong></span></span></span></p><p></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px">So, for the most part...You've come here because you care for the safety of your site because you've put a lot of time into it. For the first part of this tutorial I'll be teaching you how to secure your site using an SSL Certificate which will add a green site verification bar in the users browser. Please note, Part 1 does work on Virtual Private Servers assuming your host included Cpanel, otherwise you can do a command line installation which I will cover in a further tutorial assuming enough support and the want for it is strong enough.</span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"></span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"><img src="https://www.ssltrust.com.au/assets/images/extended-ssl-browser.png" alt="" class="fr-fic fr-dii fr-draggable " style="" /> </span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px">That is assuming all content delivered from the host to client is from your site and transmitted securely over HTTPS</span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"></span></span></span></p><ol> <li data-xf-list-type="ol"><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"> Visit SSLforFree (<a href="https://www.sslforfree.com/" target="_blank">https://www.sslforfree.com</a>)</span></span></span></li> <li data-xf-list-type="ol"><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px">Enter your domain name</span></span></span></li> </ol><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"><img src="https://cdn.elegantthemes.com/blog/wp-content/uploads/2016/12/free-ssl-certificate-6.png" alt="" class="fr-fic fr-dii fr-draggable " style="" /> </span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"> 3. Pick your verification method and proceed with instructions provided, after completion download your SSL Certificate files to your local PC, you'll need these later.</span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"><img src="https://cl.ly/29172h2B033t/Captura%20de%20pantalla%202016-09-24%20a%20las%2011.57.13.jpg" alt="" class="fr-fic fr-dii fr-draggable " style="" /> </span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"> 4. Log into Cpanel (Web Hosting) of your domain</span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"><img src="https://www.liveinhost.com/wp-content/uploads/2015/08/dashboard-cpanel.png" alt="" class="fr-fic fr-dii fr-draggable " style="" /> </span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"> 5. Locate and click on SSL/TLS in the <strong>Security</strong> section</span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"><img src="http://cdn.inmotionhosting.com/support/images/stories/cpanel/ssl-tls-manager/security-certificates-cpanel.png" alt="" class="fr-fic fr-dii fr-draggable " style="" /> </span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"> 6. Click on <strong>Generate, view, upload, or delete SSL certificates</strong></span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"><strong> <img src="http://cdn.inmotionhosting.com/support/images/stories/cpanel/ssl-tls-manager/generate-crt.png" alt="" class="fr-fic fr-dii fr-draggable " style="" /> </strong></span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"> 7. Click <strong>Choose File</strong> to browse your local computer for the certificate file and click on <strong>Upload Certificate, you should then upload your certificate you downloaded earlier.</strong></span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"><strong> <img src="http://cdn.inmotionhosting.com/support/images/stories/cpanel/ssl-tls-manager/install-3rd-party-cert.png" alt="" class="fr-fic fr-dii fr-draggable " style="" /> </strong></span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"><strong> 8. Click on <strong>Install and Manage SSL for your site(HTTPS)</strong></strong></span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"><strong><strong> <img src="http://cdn.inmotionhosting.com/support/images/stories/cpanel/ssl-tls-manager/select-install-ssl.png" alt="" class="fr-fic fr-dii fr-draggable " style="" /> </strong></strong></span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"><strong><strong> 9. From the <strong>Domain</strong> drop-down, select the domain you're installing your SSL certificate on, and then click <strong>Autofill by Domain</strong></strong></strong></span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"><strong> <img src="http://cdn.inmotionhosting.com/support/images/stories/cpanel/ssl-tls-manager/install-ssl-autofill-by-domain.png" alt="" class="fr-fic fr-dii fr-draggable " style="" /> </strong></span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"></span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"><strong> You're now done with the SSL installation and when you visit your website it should have SSL</strong></span></span></span></p><p><span style="font-family: 'Verdana'"><span style="color: #000000"><span style="font-size: 15px"></span></span></span></p><p><span style="font-size: 26px"><span style="color: #b30000"><strong>Part 2: DDOS Protection for your website or server</strong></span></span></p><p></p><p><span style="color: #000000"><span style="font-size: 15px">For part 2, you can do this on any VPS running a distro of linux or your website, although there are two methods</span></span></p><p><span style="color: #000000"><span style="font-size: 15px"></span></span></p><p><span style="color: #00b3b3"><span style="font-size: 22px"><strong>Linux Distro's - IP Tables</strong></span></span></p><p><span style="color: #00b3b3"><span style="font-size: 22px"></span></span></p><p>Iptables is basically a firewall for Linux but it comes with it and works to mitigate DDOS. Most installations come with it enabled but for those who don't, use the following commands in Terminal or SSH to enable it. </p><p></p><p><strong><u>How to update / Install </u></strong></p><p></p><p><span style="color: #b30000">sudo apt-get install iptables</span></p><p></p><p></p><p><strong><u>Activating/starting IP Tables</u></strong></p><p><strong><u></u></strong></p><p><span style="color: #b30000">service iptables restart</span></p><p><span style="color: #b30000"></span></p><p></p><p><span style="font-size: 22px"><span style="color: #59b300">Websites - Cloudflare</span></span></p><p><span style="font-size: 22px"><span style="color: #59b300"></span></span></p><p><span style="font-size: 15px"><span style="color: #000000">Cloudflare is by far one of the largest CDN's and DDOS Mitigation services, you'll be setting this up to mask your websites IP address and open ports behind Cloudflare's service. This will mitigate DDOS up to 50GB/s which is more than enough. </span></span></p><p><span style="font-size: 15px"><span style="color: #000000"></span></span></p><p><span style="color: #000000"><ol> <li data-xf-list-type="ol"><span style="font-size: 18px"><span style="font-size: 15px">Go to <a href="https://www.cloudflare.com/" target="_blank">www.cloudflare.com</a> and click the Sign up link at the top of the page.<br /> </span></span></li> <li data-xf-list-type="ol"><span style="font-size: 18px"><span style="font-size: 15px">Create a Cloudflare account by typing your email address and password. Click Create account now to proceed.<br /> </span></span></li> <li data-xf-list-type="ol"><span style="font-size: 18px"><span style="font-size: 15px">Enter the domain for your website and then click Begin Scan. It's not necessary to add "<em>www</em>" to the domain. For example, if your website is <a href="http://www.example.com" target="_blank">www.example.com</a>, type example.com.</span></span></li> </ol><p><span style="font-size: 18px"><img src="https://support.cloudflare.com/hc/en-us/article_attachments/201742638/2015-05-05_16-34-39.png" alt="" class="fr-fic fr-dii fr-draggable " style="" /></span></span></p><p><span style="color: #000000"><span style="font-size: 18px"></span></span></p><ul> <li data-xf-list-type="ul"><span style="color: #000000"><span style="font-size: 18px"> Cloudflare will now scan your domain's DNS records.</span></span></li> <li data-xf-list-type="ul"><span style="color: #000000"> This will take approximately 60 seconds to complete. </span></li> <li data-xf-list-type="ul"><span style="color: #000000"> Once the DNS scan has finished, click Continue.</span></li> <li data-xf-list-type="ul"><span style="color: #000000"> A list of all the DNS records found is displayed, including your subdomains. In this step, you can decide which subdomains you want to enable Cloudflare (<a href="https://support.cloudflare.com/hc/en-us/articles/201720164-Step-2-Create-a-Cloudflare-account-and-add-a-website#verify-records" target="_blank"><span style="font-size: 18px"><img src="https://support.cloudflare.com/hc/en-us/article_attachments/201662348/icon-cloud-on.png" alt="" class="fr-fic fr-dii fr-draggable " style="" /></span></a><span style="font-size: 18px">) or bypass Cloudflare (<img src="https://support.cloudflare.com/hc/en-us/article_attachments/201662358/icon-cloud-bypass.png" alt="" class="fr-fic fr-dii fr-draggable " style="" />). Some records, like MX, never go through Cloudflare (no cloud)</span></span></li> <li data-xf-list-type="ul"><span style="color: #000000"> If there are any additional records you'd like to add, you can add them here. After you've reviewed your DNS records, click Process and continue.</span></li> </ul><p></p><p><span style="color: #000000"><img src="https://support.cloudflare.com/hc/en-us/article_attachments/201742658/2015-05-05_16-38-11.png" alt="" class="fr-fic fr-dii fr-draggable " style="" /> </span></p><ul> <li data-xf-list-type="ul">Select the free plan unless you want to pay</li> <li data-xf-list-type="ul">On the final step, you are given the Cloudflare nameservers for your domain. The Cloudflare nameservers are assigned to your domain and listed on this page. Please write down the Cloudflare nameservers. You can also find your Cloudflare nameservers in your <a href="https://www.cloudflare.com/login" target="_blank">Cloudflare dashboard</a><span style="color: rgb(0, 0, 0)"> under Overview.</span></li> <li data-xf-list-type="ul">Optionally, choose the appropriate Performance and Security settings. By default, your Performance settings are set to CDN Only and your Security profile is set to Medium for your domain. You can change your settings at a later time.<span style="color: rgb(0, 0, 0)">Click Process and continue.</span></li> </ul><p><span style="font-size: 22px"><span style="color: #00ffff">Changing Name Servers</span></span></p><p><span style="color: #000000"></span></p><p><span style="color: #000000">To do this:</span></p><p><span style="color: #000000"></span></p><ul> <li data-xf-list-type="ul"><span style="color: #000000">Login to your Domain Provider</span></li> <li data-xf-list-type="ul"><span style="color: #000000">Proceed to go to the management section of your website</span></li> <li data-xf-list-type="ul"><span style="color: #000000">There should be a section relevant to Name Servers</span></li> <li data-xf-list-type="ul"><span style="color: #000000">Modify the Name Servers from your hosting provider to Cloudflare servers</span></li> </ul><p></p><p><span style="font-family: 'Times New Roman'"><span style="font-size: 26px"><span style="color: #b300b3"><strong><em><u>ALL DONE <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite116" alt=":D" title="Big grin :D" loading="lazy" data-shortname=":D" /></u></em></strong></span></span></span></p><p><span style="font-family: 'Times New Roman'"><span style="font-size: 26px"><span style="color: #b300b3"></span></span></span></p><p><span style="font-family: 'Times New Roman'"><span style="font-size: 26px"><span style="color: #b300b3"><strong><em><u>Please leave a comment and tell me how you found this tutorial and if you would like anything else :^)</u></em></strong></span></span></span></p></blockquote><p></p>
[QUOTE="Bryan Lam, post: 602704, member: 35868"] [FONT=Trebuchet MS][SIZE=7][COLOR=#ff0000][B][U]Bryan's Guide To Securing Your Website and/or server[/U][/B][/COLOR][/SIZE][/FONT] [U][COLOR=rgb(255, 0, 0)][FONT=Trebuchet MS][B][COLOR=#00b3b3][U]Prerequisites[/U][/COLOR][/B][/FONT][/COLOR][/U] [COLOR=rgb(255, 0, 0)][FONT=Trebuchet MS][B][COLOR=rgb(0, 179, 179)]Before you get started there are some things you'll require -[/COLOR][/B][/FONT][/COLOR] [COLOR=rgb(255, 0, 0)][FONT=Trebuchet MS][B][/B][/FONT][/COLOR] [FONT=Trebuchet MS][B][COLOR=#00b3b3]- A Domain Name W/ Web Hosting & Cpanel (Most hosting plans include this) for ease of installation[/COLOR][/B] [B][COLOR=#00b3b3]- An Email[/COLOR][/B] [B][/B] [SIZE=7][COLOR=#ff0000][B]Part 1: Securing your website[/B][/COLOR][/SIZE][/FONT] [FONT=Verdana][COLOR=#000000][SIZE=4]So, for the most part...You've come here because you care for the safety of your site because you've put a lot of time into it. For the first part of this tutorial I'll be teaching you how to secure your site using an SSL Certificate which will add a green site verification bar in the users browser. Please note, Part 1 does work on Virtual Private Servers assuming your host included Cpanel, otherwise you can do a command line installation which I will cover in a further tutorial assuming enough support and the want for it is strong enough. [IMG]https://www.ssltrust.com.au/assets/images/extended-ssl-browser.png[/IMG] That is assuming all content delivered from the host to client is from your site and transmitted securely over HTTPS [/SIZE][/COLOR][/FONT] [LIST=1] [*][FONT=Verdana][COLOR=#000000][SIZE=4] Visit SSLforFree ([URL='https://www.sslforfree.com/']https://www.sslforfree.com[/URL])[/SIZE][/COLOR][/FONT] [*][FONT=Verdana][COLOR=#000000][SIZE=4]Enter your domain name[/SIZE][/COLOR][/FONT] [/LIST] [FONT=Verdana][COLOR=#000000][SIZE=4][IMG]https://cdn.elegantthemes.com/blog/wp-content/uploads/2016/12/free-ssl-certificate-6.png[/IMG] 3. Pick your verification method and proceed with instructions provided, after completion download your SSL Certificate files to your local PC, you'll need these later. [IMG]https://cl.ly/29172h2B033t/Captura%20de%20pantalla%202016-09-24%20a%20las%2011.57.13.jpg[/IMG] 4. Log into Cpanel (Web Hosting) of your domain [IMG]https://www.liveinhost.com/wp-content/uploads/2015/08/dashboard-cpanel.png[/IMG] 5. Locate and click on SSL/TLS in the [B]Security[/B] section [IMG]http://cdn.inmotionhosting.com/support/images/stories/cpanel/ssl-tls-manager/security-certificates-cpanel.png[/IMG] 6. Click on [B]Generate, view, upload, or delete SSL certificates[/B] [B] [IMG]http://cdn.inmotionhosting.com/support/images/stories/cpanel/ssl-tls-manager/generate-crt.png[/IMG] [/B] 7. Click [B]Choose File[/B] to browse your local computer for the certificate file and click on [B]Upload Certificate, you should then upload your certificate you downloaded earlier.[/B] [B] [IMG]http://cdn.inmotionhosting.com/support/images/stories/cpanel/ssl-tls-manager/install-3rd-party-cert.png[/IMG] [/B] [B] 8. Click on [B]Install and Manage SSL for your site(HTTPS)[/B][/B] [B][B] [IMG]http://cdn.inmotionhosting.com/support/images/stories/cpanel/ssl-tls-manager/select-install-ssl.png[/IMG] [/B][/B] [B][B] 9. From the [B]Domain[/B] drop-down, select the domain you're installing your SSL certificate on, and then click [B]Autofill by Domain[/B][/B][/B] [B] [IMG]http://cdn.inmotionhosting.com/support/images/stories/cpanel/ssl-tls-manager/install-ssl-autofill-by-domain.png[/IMG] [/B] [B][/B] [B] You're now done with the SSL installation and when you visit your website it should have SSL[/B] [B][/B][/SIZE][/COLOR][/FONT] [SIZE=7][COLOR=#b30000][B]Part 2: DDOS Protection for your website or server[/B][/COLOR][/SIZE] [COLOR=#000000][SIZE=4]For part 2, you can do this on any VPS running a distro of linux or your website, although there are two methods [/SIZE][/COLOR] [COLOR=#00b3b3][SIZE=6][B]Linux Distro's - IP Tables[/B] [B][/B][/SIZE][/COLOR] Iptables is basically a firewall for Linux but it comes with it and works to mitigate DDOS. Most installations come with it enabled but for those who don't, use the following commands in Terminal or SSH to enable it. [B][U]How to update / Install [/U][/B] [COLOR=#b30000]sudo apt-get install iptables[/COLOR] [B][U]Activating/starting IP Tables [/U][/B] [COLOR=#b30000]service iptables restart [/COLOR] [SIZE=6][COLOR=#59b300]Websites - Cloudflare [/COLOR][/SIZE] [SIZE=4][COLOR=#000000]Cloudflare is by far one of the largest CDN's and DDOS Mitigation services, you'll be setting this up to mask your websites IP address and open ports behind Cloudflare's service. This will mitigate DDOS up to 50GB/s which is more than enough. [/COLOR][/SIZE] [COLOR=#000000][SIZE=5][LIST=1] [*][SIZE=4]Go to [URL='https://www.cloudflare.com/']www.cloudflare.com[/URL] and click the Sign up link at the top of the page. [/SIZE] [*][SIZE=4]Create a Cloudflare account by typing your email address and password. Click Create account now to proceed. [/SIZE] [*][SIZE=4]Enter the domain for your website and then click Begin Scan. It's not necessary to add "[I]www[/I]" to the domain. For example, if your website is [URL="http://www.example.com"]www.example.com[/URL], type example.com.[/SIZE] [/LIST][/SIZE] [SIZE=5][IMG]https://support.cloudflare.com/hc/en-us/article_attachments/201742638/2015-05-05_16-34-39.png[/IMG] [/SIZE] [LIST] [*][SIZE=5] Cloudflare will now scan your domain's DNS records.[/SIZE] [*] This will take approximately 60 seconds to complete. [*] Once the DNS scan has finished, click Continue. [*] A list of all the DNS records found is displayed, including your subdomains. In this step, you can decide which subdomains you want to enable Cloudflare ([URL='https://support.cloudflare.com/hc/en-us/articles/201720164-Step-2-Create-a-Cloudflare-account-and-add-a-website#verify-records'][SIZE=5][IMG]https://support.cloudflare.com/hc/en-us/article_attachments/201662348/icon-cloud-on.png[/IMG][/SIZE][/URL][SIZE=5]) or bypass Cloudflare ([IMG]https://support.cloudflare.com/hc/en-us/article_attachments/201662358/icon-cloud-bypass.png[/IMG]). Some records, like MX, never go through Cloudflare (no cloud)[/SIZE] [*] If there are any additional records you'd like to add, you can add them here. After you've reviewed your DNS records, click Process and continue. [/LIST] [IMG]https://support.cloudflare.com/hc/en-us/article_attachments/201742658/2015-05-05_16-38-11.png[/IMG] [/COLOR] [LIST] [*]Select the free plan unless you want to pay [*]On the final step, you are given the Cloudflare nameservers for your domain. The Cloudflare nameservers are assigned to your domain and listed on this page. Please write down the Cloudflare nameservers. You can also find your Cloudflare nameservers in your [URL='https://www.cloudflare.com/login']Cloudflare dashboard[/URL][COLOR=rgb(0, 0, 0)] under Overview.[/COLOR] [*]Optionally, choose the appropriate Performance and Security settings. By default, your Performance settings are set to CDN Only and your Security profile is set to Medium for your domain. You can change your settings at a later time.[COLOR=rgb(0, 0, 0)]Click Process and continue.[/COLOR] [/LIST] [SIZE=6][COLOR=#00ffff]Changing Name Servers[/COLOR][/SIZE] [COLOR=#000000] To do this: [/COLOR] [LIST] [*][COLOR=#000000]Login to your Domain Provider[/COLOR] [*][COLOR=#000000]Proceed to go to the management section of your website[/COLOR] [*][COLOR=#000000]There should be a section relevant to Name Servers[/COLOR] [*][COLOR=#000000]Modify the Name Servers from your hosting provider to Cloudflare servers[/COLOR] [/LIST] [COLOR=#000000][/COLOR] [FONT=Times New Roman][SIZE=7][COLOR=#b300b3][B][I][U]ALL DONE :D[/U][/I][/B] [B][I][U][/U][/I][/B] [B][I][U]Please leave a comment and tell me how you found this tutorial and if you would like anything else :^)[/U][/I][/B][/COLOR][/SIZE][/FONT] [/QUOTE]
Insert quotes…
Verification
Post reply
Top