This is a subject which raises itself regularly when you work in open source web sites, so we thought that a blog post on the subject might be useful for website owners. For a non-techie this might appear quite complex; perhaps it is, so please pay attention!
Firstly however let's look at the big picture.
If your web site was built using open source software it is because that offers a very wide range of functionality at a good price (often free), built and donated for free by a large community of developers, and which your web designer is then able to implement, style, customise, modify and otherwise massage to fit your unique web site requirements.
This article was first written in 2014 and update in 2024.
Had you gone the "other" route and chosen "closed source" or proprietary software, you would probably have either had to:
- Pay more for it.
- Accept less features.
- Both of the above.
- Get trapped in a relationship with a software vendor that you can never leave - without dumping your whole web site.
Now this is not to say at all that "open source good, closed source bad" or anything, but the world is increasingly finding that for SME businesses the value proposition of open source is very good. And so of course do the SMEs and individuals using it, particularly Joomla and WordPress, perhaps the two most popular CMS (Content managed sites) in the world.
But getting all those advanced web features at a price that you could afford does come at a price, and the price is particularly this:
With open source software everyone (who knows anything about web programming) can view the source code that runs the web site. This means that if there are any security vulnerabilities in it, they can be easily seen and then exploited by bad guys with a sufficient skill set. Now even closed-source sites get hacked, quite regularly, but with open source it is a little easier, because you can easily see the code. Another feature of open source, and the reason why you got all those great features and extensions for your web site, is that many of the add-ons are contributed by a wide community of developers. This is why the open source sites develop so fast and adopt the latest features so quickly, when compared to proprietary software. However the broad range of functionality submitted also implies a degree of variety in the coding practices, and a lack of uniformity in how security is built into each component.
Goodies and Baddies
So in the ongoing game of cat and mouse between the hackers and the web site developers, we have two sides:
The hackers, who for whatever reason seek to damage and deface your or anyone else's web sites. Sometimes web sites are selected specifically for what they represent or supposed ethical issues, at other times they are simply targeted at random ometimes even by "bots"; automated programmes endlessly scanning the net, and looking for signals that a web site is vulnerable or out of date. 2023 saw large data breaches for well known companies including the British Library, Samsung Electronics and Sony. 2024 is no different with Prudential Financial, Loan Depot being targeted by a ransomeware group. How the sites are selected is of little consequence, if yours is found and attempt to exploit it is made, then it needs to be secure.
On the other side of the battle are the software developers and web site owners, trying to develop good sites, good code, new features, and keep their businesses trading online and secure. Their part in this is to keep the sites as up to date and secure as they can, find a way of monitoring and blocking exploit attempts.
A key part of how this is managed is that each CMS software community has a team of people looking after security. Typically they will either find a weakness themselves, or be informed of one by a third party who identifies it, or perhaps when a web site is hacked, and the details of "how" are passed through to that security team, or bug squad. This triggers a bout of frantic activity, where the bug squad tests the flaw, develops an understanding of it, and then develops a fix to close the loophole. This fix then has to be migrated out to the whole community, if all the web sites are to be made secure. These "fixes" or updates do not come necessarily one at a time, but for web sites made up of a number of components, any number of them may be updated at any frequency. So this would include updates to the core version of the web site software (Joomla, WordPress, Drupal, Magento or any other). It could equally well apply to any extensions that have been added to the web site, perhaps a shopping cart, contact form, community chat area, photo sharing gallery, classified ad listing, directory, or any of the other add-ons that web site owners might choose to use.
So what you have is not a simple series of updates, but a fast moving and constantly changing mosaic of software updates, to be managed and applied to keep the bad guys out.
Components of your website
The Server
So let's take a short breath before plunging in again, next to look at the server on which your web site is hosted. Open source websites often run on LAMP servers (Linux, Apache, MySQL, PHP), which form the backbone of the web. Server software, including OpenSSL for secure pages and FTP for file transfers, requires regular updates. Managed hosting providers handle server updates for shared or virtual servers, while dedicated servers require agreements with developers or administrators for timely updates.
Non-Standard Server Software
Additional software on the server, added by developers to support specific website features, also requires monitoring and updates. Hosting providers or developers, depending on the agreement, are responsible for maintaining these components.
Web Site Core
CMS platforms like WordPress and Joomla have dedicated security teams providing updates. Website owners should regularly check for new versions and apply updates promptly to safeguard against potential exploits.
Web Site Extensions
Extensions or plugins contribute to a website's functionality but may lack uniform security standards. Owners or developers must manually update these components to prevent vulnerabilities.
External APIs
We'll bring in one more group of software, this is external APIs, where you call another web site for services, but then show the results on your own site. Services like Google Maps or social media widgets may update independently, potentially affecting site functionality. Website owners must be aware of such dependencies and adapt accordingly.
- Google Maps API, displays Google map on your site, with additional features such as map customisation, proximity search, route navigation, and so on.
- Social Widgets: Twitter, Facebook, LinkedIn and all the rest give you widgets, from simple "follow me" buttons, to large boxes displaying your friends or Social activity. These are provided by the API from that web property, and can give really powerful social functionality to your web site.
- Chat - live chat boxes are typically provided by a third party web site using an API.
- eCommerce sites often use external APIs, for example providing post code / address lookups, shipping quotes, live exchange rates, and more.
- CRM: If you have a CRM system, it can use an API to interact with your web site visitors and help provide a richer and better tracked user experience.
- Financial widgets: exchange rate and share price tickers showing on your site.
- Accounts packages - Sage, QuickBooks and others often have API features, which allow developers to import or export financial data, orders, and stock levels to a web site.
- Vertical Markets: such as estate agents, hotel bookings, yacht brokers, affiliate marketing schemes, which share data between multiple web sites.
And on and on, with the growth of the web there is almost no limit to the variety of extensions that might be included on your site.
So we have several major groups of software now:
- The software which came on the server and runs the server itself.
- Add-ons that may have been included in the server software to support particular web site features.
- The software that was installed during the build of your web site.
- Add-ons and extensions to that web site software.
- Third party APIs called to provide particular rich features.
Any of the above could potentially constitute a security flaw, and even after months or years of successful running it is possible that a new flaw could be created or discovered, or the interaction between any two pieces of software could create a new and unintended flaw.
Who should update each one?
So now that we understand the types of component that work together to deliver your web site, it is time to look at who should be updating them, and the impact that this might have on your web site.
Standard Server Software Updates
Hosting providers typically manage updates for standard server software. Website owners using shared hosting rely on providers to apply updates without disrupting service. For dedicated servers, agreements with developers or administrators govern update responsibilities.
Non-Standard Server Software Updates
Updates to additional server software are either handled by hosting providers or developers, based on the agreed-upon responsibilities outlined in hosting agreements.
Web Site Core Updates
When the web site was built the first thing the developer did was to upload the current "core" version of the CMS you are using, be it Joomla, WordPress, Magento, Drupal or whatever you are using. Each of these has its own system for updates, and notifications which are sent out to subscribers whenever a new version becomes available. It is important to actively monitor and apply these updates, timely application is crucial for maintaining a secure website.
To monitor the updates, there are some links provided below:
- WordPress update notifications or WordPress Security announcements
- Joomla security annoucements
- Drupal update notifications Drupal update notifications Drupal update notifications
Web Site Extension Updates
The responsibility for updating extensions rests with the website owner or developer. Regular checks and manual updates are necessary to address potential vulnerabilities.
External API Updates
Updates to third-party APIs may occur without warning. While these services are free, website owners must be prepared to adapt if changes affect their site's functionality.
Best Practices for Web Site Security
Regular Updates:
- Promptly apply updates for all components to address security vulnerabilities.
- Regularly check for updates from CMS communities, extension developers, and third-party APIs.
Automated Updates:
- Consider using automated update tools provided by hosting platforms for core software updates.
- However, caution must be exercised with automated updates, especially for customised or complex websites, as even the smallest error in an update can crash a website!
Testing Environments:
- Maintain a non-live testing environment to assess the impact of updates before applying them to the live site.
Security Agreements:
- Clearly define responsibilities for updates in hosting agreements between website owners, developers, and hosting providers.
Budget for Maintenance:
- Plan for ongoing maintenance costs, especially as websites grow in complexity.
- Understand that more features may lead to increased maintenance expenses.
Conclusion
We hope that this helps unravel the often complex subject of web site security, why it needs to be done and by whom. A new web site should have a long and productive life in your organisation, but it does need to be nurtured and looked after, this will hopefully shed some light on how that should be carried out.
Channel Digital Security and Back-Ups
At Channel, our websites are built with and protected by our own bespoke security configurations. Ongoing, we offer a variety of Hosting Packages which include support, maintenance and security updates, ensuring your website stays secure and up-to-date. Contact us to see how we can help you keep your website secure.
