However I’m back now and have started work on a few new articles for you to look over including some new security articles, as well as some programming tutorials.

As ever if you’d like to get involved on the site contact me!

Restart your computer:

shutdown -r -t 0

Shutdown your computer:

shutdown -s -t 0

One thing to note about this list is that it’s meant as a checklist for you, not an introduction into programming. If you wish to get an introduction to php programming there are some great resources out there at php.net, W3School and more.

1. PHP.ini Settings – turn safe_mode = off

Your php.ini file provides loads of settings which create your php environment. It includes modules to let you connect to databases, upload images and loads more as well as providing settings to do with max upload file sizes and some security settings. One of the most important settings is safe_mode. Ensure it is set to off (if you don’t know as your hosting company of use the function phpinfo(); ) Why should you do this? Well this is a whole discussion topic in itself which we’ll be covering at a later date. For now – turn it off!

2. PHP.ini Settings – turn display_errors = off

Another setting in your php.ini file is to do with what errors are displayed. Ideally you should turn this to off unless you are in your development area i.e. have it set to display errors on your home  computer but off on your live environment. If PHP needs to show you an error it means you haven’t programmed your script to cater for that type of error in the first place and as such the error message itself can allow people to potentially understand your programming and hack it.

3. PHP.ini Settings – Set Max_Upload_Size = 5MB

It’s tempting to increase your max upload size to be huge but if you have a website where you allow anyone to upload files setting this to too higher a number can cause problems, not so much from being hacked but from using up your servers connection processing massive files. Set it to no more than  you actually need – usually 5-6MB will do it.

4. Databases – don’t use the root user.

Sounds straight forward but we’ve seen so many times that people use the root MySQL details to access their database. On your home computer that’s fine but on a live environment it can prove to be a disaster. For instance if you do have a vunreable part of your programming which gets hacked the most they can do is ruin that one website. If they have root access they could delete every single database on the server which would be a nightmare.

5. Databases – SQL Injection Attacks

I’m sure this isn’t the first time you have come across this type of hack however if it is in a nutshell it’s where people alter the SQL you send to your database to get it to do extra things. For instance if you take a variable over a $_GET and pass it straight to a query with no validation an sql attack could add an extra statements to alter, show table information or even delete everything. At a basic level it’s quite easy to protect yourself against it by using functions like php’s addslashes function or other MySQL specific ones. PHP.net is the best resources for this and you can find a full article on this topic here

6. Databases – Clean you’re data before doing any SQL

A golden rule of programming is to never trust anything a user gives to you – it doesn’t matter if it’s a job website or a CMS for your granny, don’t trust the data. As such if you recieve data and are about to use it to work a calculation out, run a command line tool or insert it into the database clean the data. What do we mean by this? Well a first step is to ensure it’s of the type you expect – if you expect an integer you can use the settype function to double check it is, if you are expecting an image file ensure it’s not a .exe or .pdf or anything else.

7. HTML Forms – Validate your data server side as well as client side

With all the great javascript form validation tools out there it’s far too easy to just use javascript to validate data coming from a form. However what if the person has javascript disabled or even a hacker who blocks javascript – they can then send whatever they like. So always ensure you have server side PHP validation as well.

8. Session Security

Sessions can be hijacked so if you base all your logic of password protecting a directory based on checking that $_SESSION['AM-I-ACTIVE']==1 then think again as whilst it isn’t easy to hijack a session it is possible. Check out the PHP Security Consortiums guide on protecting yourself against session hijacks

9. Third Party Scripts – Be Careful

When starting out in PHP it’s very easy to get stuck trying to achieve something, google for a script that does what you need and then make use of it. Hopefully you’ll be just fine however even the best scripts can have security flaws and if you didn’t write them it’s hard to track them down or protect them. Whilst I’d never say to not use third party script as sometimes they are great (big up to wordpress!) sometimes you can land yourself in a big heap of doo doo!

10. Backup – If all else fails ensure you have a backup

At the end of the day the only way to 100% protect yourself against a hacker is to unplug your server from the internet, put it in a fireproof safe with no power and leave it in a bank – and even then it could be broken into! As such a key to protecting yourself starts with backing up. If you do get hacked then you can restore from a backup to get yourself online whilst you try to figure out how you were hacked.

Summary

Hopefully you’ve found the above helpful. I’m sure I’ve missed many security considerations but as a checklist the above has always serverd me well. Want help with this? Come over to Swordfish Hosting and we’ll walk you through protecting yourself.

Choosing Your Password

First step to password security is selecting your password. I’m sure everyone knows what makes a secure password but there has to be a compromise between security and being able to remember it. A rough rule for passwords is:

1. Password Length must be between 6-10 characters. Any shorter is insecure and any longer is plain crazy!
2. Mixture of Upper and Lower Case letters
3. At least one number in the password
4. Try getting a symbol in there like ! or @

Sounds confusing to make a password doesn’t it? Thankfully you don’t have to work one out for you thanks to the guys at pc tools who have made this great password generator.

So what are you waiting for? Generate a couple of passwords so you can use them on different sites. Why generate a few? well read on!

Using Your Password

Now you have generated your safe passwords you need to ensure you use them in the right way. Get together a list of your top few websites you visit and write them down. Now look at the type of web hosting website they are – some will be secure, some will be shopping sites and some will be social websites or random other ones. For instance you’re list might look like:

• Royal Bank of Scotland
• Amazon
• Ebay
• Paypal
• web-hosting-support (I hope!!)
• Your latest fashion website
• Facebook
• Twitter

Having a secure password isn’t just a case of creating a safe one and using it for everything. You need to ensure you use your passwords for different things. Have one password for sites which would be a disaster if they got hacked (banks / paypal etc..), have another for shopping sites like amazon which if got hacked might cause a headache but you could recover and another for everything else.

Splitting websites you use up like this ensures your passwords remain secure and don’t get into the wrong hands. For instance if you have a secure password you use for paypal you don’t want to use it on a random site you haven’t been to all that much before – keep it close to your chest!

Emails Don’t Vanish…

The first thing to say is that emails don’t simply vanish never to be seen again (or very very rarely).  Usually an email problem is reported back to you so if it’s a customer of your’s you can start the tracking by asking some very simple questions:

1. When did they send the email
2. Who did they send the email to
3. What bouceback did they get
4. Did an error message appear when trying to send and what was it

Very simple questions but ones which 9 times out of 10 can solve the problem. You can immediately see if they mis-spelt the address (more common than you might thing!), if they sent an email at a time you were restarting something on the server.

If neither of the above find the solution then onto the next steps, what error messages were received? This is key to tracking things down so if your customer either can’t remember or doesn’t have it to hand get them to send it you as otherwise you’re in the dark.

Email Error Messages

Typically email errors come in 2 forms, a direct error from the email client like outlook or a bounceback email.

Email Error From Outlook (or other client)

If the error comes from the email browser than usually the error is to do with either their connection to the server or local setup. Therefore a quick test is to simply setup the email account on your computer, test it and if all works the issue is on your customers computer and then thats a troubleshooting pc connection issues kind of thing. Issues like username / password / server address being incorrect are quite common.

Email Bounce Backs

The other type of warning an email has not gone through is from an email bounceback. Bouncebacks contain some great information if you know where to look. Typically the bounceback will come with a load of technical information in it but somewhere in it will be a key sentence like ‘recipient not found’ or ‘user doesn’t exist’. However some common bouncebacks are:

Mailbox does not exist
As the name suggests, the email address you are trying to send to doesn’t exist.

Mailbox Full
Again, as the name suggests the mailbox is full and can’t take any more emails

You have been greylisted
Greylisting isn’t as bad as you might think. Greylisting simply means that it’s the first time you have sent an email to that mailserver and they want to vet you’re a valid email sender. As such all you need do is send the email again and you’ll be allowed to send to the recipient.

You have been blacklisted / listed on a DNS blacklist
This isn’t so good – it means you have been listed on one of the many DNS blacklists for spamming. The first thing to do in this case is see if you are indeed blacklisted. An easy way to check blacklists is over at mx toolbox who provide a free dns blacklist checker for you to double check.

If you have been blacklisted then it means you’re server has been caught sending spam. If you are on a shared server then contact your web hosting company who should deal with this for you. If it’s your server then you need to identify and stop the source of the spam immediately. You should begin with looking at the email server logs and see if you can identify a email address which is sending out vast quantities of emails. It won’t be hard to spot as you need to spam a fair bit to get blacklisted. If you need help you can ask us or pop along to the guys at swordfish hosting for some free email security advice.

Once you have identified and stopped the cause (and only then) get in contact with the blacklist you are on and ask to be de-listed giving all the steps you have taken to stop the spamming.

Next: Tracking down missing incoming emails

Above we’ve looking at things to look for if you’re client can’t send or has missing sent emails but next we’ll look at how to track down missing inbound emails and the checks you can do.

Thankfully there are number of great options out there for you to quick and easily check the status of your website. You may ask “why do I need to monitor my website when my host does it for me?” and it’s a good question so we’ve tried to explain why it’s always a good idea for you to monitor things for yourself:

Why Monitor Your Websites Status

1. If you are with a host with poor up-time you may not realise it as you might not be checking when your website is down – but you can be guaranteed a potential customer is!
2. If you have your own dedicated server monitoring isn’t always included and as such your server could be offline for an entire weekend leaving you to deal with a barrage of complaints on Monday morning
3. Peace of Mind – you know things are ok if you have monitoring. If a customer you host rings to say they can’t see their website and you haven’t received any offline reports chances are it’s their Internet connection so it reassures you
4. If you notice the server go offline at certain times of the day every day/week then it will help you track down a potential issue.
5. Be pro-active not re-active.

Those are just a few reason why you might consider getting your own monitoring in place but don’t be put off by the technical aspect of it as thankfully there are some great companies out there which can help you and we’re going to look at a couple.

Server Monitoring Providers

1. Pingdom

One of the first and possibly the best. They are relatively cheap and the great thing is if you are only monitoring one website it’s completely free! The control panel is incredibly easy to use and they can even send text messages to you to let you know if there is a problem. You even get the first 20 or so texts free to start off with!

2. Phone Applications

Having recently turned to the dark side and brought an iPhone I’ve found some great applications out there which allow server monitoring. Whilst there are a few I’ve found ‘portability’ to be the best. It is still in an semi early stage of developing but covers all your basics and lets you see very easily at-a-glance if your servers are only. It only costs about £1 and is well worth the investment

There are lots of other options out there and we’ll be adding to this post later on but for now do a google search for ’server monitoring’ and you’ll see all the possible results!!

This article hope to demonstrate those system which specifically allow you to design, manage and host your website online without having to find a hosting provider and with a very limited knowledge of websites. There are plenty of open source systems out there which provide amazing features for free but we hope the below will help you setup if you don’t want to download and install software / find a hosting provider – just have a website in a few clicks. Some of these sites are online blogging websites which, whilst customizable, aren’t typical websites and so if you are looking to create a website for your business they are possibly worth giving a miss. Please bear in mind – whilst these are listed 1-10 they aren’t in any order as everyone is individual in their needs to it’s worth looking through all of them before deciding!

1. Plesk Sitebuilder

Type: Online Hosting Control Panel
Cost: Free with Plesk Hosting

Please site builder comes with a lot of hosting accounts and allows you to pick from a large range of templates and edit your website all through a easy to use interface. You can see a demo of it online here: http://sitebuilder4.win.demo.parallels.com/Wizard/
Web: http://www.parallels.com/uk/products/plesk/sitebuilder/

2. Wordpress Online Blog

Type: online editor
Cost: Free

Wordpress is one of the most popular pieces of blogging software out there and with good reason – its fast, easy to use, full of features and completely free. It comes in 2 versions, one you download and install and with this one you simply sign up and it creates it all for you. The great thing about this is for a small charge you can add your own domain name and have email addresses with a few clicks. This highly recommended piece if kit is well worth looking at
Web: http://wordpress.com/

3. Blogger

Type: online editor
Cost: Free

A few years back Google brought out this free blogging software and with good reason, it’s great! Very easy to use and is constantly being developed to improve on this – with Google behind the steering wheel now would you expect any less? Others would argue not but ultimately wordpress and blogger argue it out amongst themselves who has the best blogging software out there. One thing i would say is that once setup you can’t download this software and move it somewhere else – with wordpress it is portable. Either way 2 thumbs up from us!
Web: http://www.blogger.com

3. Blog.com

Type: online editor
Cost: Free

Blog.com is another popular blogging site where you can signup and start your website for free. As with all these blogging sites they let you create your website, choose a theme and start writing.
Web: http://www.blog.com

4. Yola

Type: online editor
Cost: Free

Yola is a popular choice to create a free website, is easy to use and best of all (unlike many website creators) doesn’t have advertising on your website so you can create a professional site. You can pick from a range of templates or have a professional design your website and still allow you to edit all the content.
Web: http://www.yola.com/

5. Wix

Type: Online Editor
Cost: Free

Wix allows you to create really nice looking flash websites for free. Its’ great as it gets you up and running in moments and looks really nice. It has it’s downfalls though in that you are tied into their templates and with it being flash google won’t read it quite as well as a html/ text website.
Web: http://www.wix.com/

6. Moonfruit

Type: downloadable software
Cost: Free with adverts / Subscription without ads

Moonfruit has been providing free website design tools since 1998 and has a massive number of websites which use them. As a result their product is very well tuned and has had a lot of development time spent on it making it easy for you to use. There are 2 version of the software you download, a free one which places adverts on the website and a subscription one which removes them.
Web: http://www.moonfruit.com/

7. Webs

Type: Online Editor
Cost: Free with and upgrades option on a cost basis

Webs is an established online editing system that has been around a long time and looks after loads of websites. As with anything that has been around for a long time it’s nice and easy to use and free for all the basic options. On nice thing is they have loads of built in templates and features you can use but if you want to include extras like custom designs, shopping or forums you can buy the bolt on’s.
Web: http://www.webs.com/

8. Weebly

Type: Online Editor
Cost: Free with and upgrades option on a cost basis

Weebly allows you to create a free website online in minutes and is well worth taking a look at. Having been named in Times 50 best website backin 2007 it’s grown in strength and allows lots of easy to use features for free. You get the usual options of templates or you can design your own. In addition You can pay to have you’re own www.domainname.com and still have it all hosted by them – great hey!
Web: http://www.weebly.com

9. Jimdo

Type: Online Editor
Cost: Free with and upgrades option on a cost basis

Jimdo is a great, relatively new, online website creator. It’s packed with great features like a blog, photo gallery, unlimited traffic and hop ups to get optional extras for a small fee.
Web: http://www.jimdo.com/

10. Wet Paint

Type: Online Editor
Cost: Free with and upgrades option on a cost basis

Wet Paint is our free website creator and has built in just about any feature you might want whether it be images, video, bloggin  or just plain text. This one comes with advertising on it’s free version although for a small fee you can have this removed
Web: http://www.wetpaint.com/

Conclusion…

As you can see there are loads of great options to get you a website in a few clicks. All of the above require no installation, no costs and no effort really. So now there really is no excuses – you can put a website online about your family – start a blog about your favourite sport or even just put online all your holiday photos!

All the above being said, when deciding whether on the the above might fit your needs it is worth bearing in mind that they are all limited in one dimension or another and once you have set it up, gone to the time and effort to populate it then it’s difficult to transfer to another hosting company or alternatively get a professional web developer to do the work for you. As such, as with anything, if you are series about your website why not ask us for some help and support – we can put you in touch with some great developers and even better web hosting!

So you have a backup either made by plesk either on your desktop and now you want to test restoring it or you’re in trouble and need to restore it? Well fear not – plesk makes it very simple to restore your website which is why no website owner should be without a backup, it takes minutes to do and can save your bacon!

The first thing to do is to get your backup onto the server. If you only backed up your plesk server to the same server then you can skip this step however it is highly recommended that you keep a copy of your plesk backup on your own computer, off-server as if your host has a problem with their disk then your backup isn’t worth anything!

uploading your backup
Uploading is easy, just click this button:

And upload your backup. If it’s a really large backup it’s going to take some time so sit back and relax

Once your backup is uploaded
Once it’s uploaded you will see the backup in your list of backups available to use. The next steps follow the plesk restore wizard and it guides you through it but if your unsure about any of them just leave the default plesk restore options – they usually work well. That being said you usually want to do the following:

1. Once you have clicked on a backup you want to select to restore the domain configuration, virtual host content, mail and databases (i’m assuming you want to restore everything).
2. It’s a good idea to enter your email address as it can take a while and it’s easier to get an email once it’s complete rather than sit and wait.
3. Your screen will therefore look like this (in the bottom half):

The next step is to click on the restore button. If you took the original backup on this server then it shouldn’t require any further details other than to sit and wait. If you are moving a backup from a different server to this one then it may require information about IP addresses and mappings. In this case usually it’s ok to leave the default plesk suggestions but if in doubt submit a comment below and we’ll try and help!

Next Time: Ways to backup in a non-plesk environment

To back your domain login to your control panel and select the domain in question. Once you’re editing it you’ll see a little area of the screen which looks like this:

As the name suggests select ‘backup manager’ and you’ll be presented with a screen listing all your backups. If you can’t see any backup’s here then shame on you!! I say that however I like a lot of other I.T. professionals who know haven’t backed up their personal machine in years – however do as I say and all that!!

To create a backup click on the backup button in the top left and you’ll be given a screen like this:

If this is your first time leave all the settings alone and simply click the backup button in the bottom right hand side and begin backing up. The backup might take some time so at this point go make yourself a cup of tea!

After your tea break…
you’ll see your new backup in the list of backups. Here’s the important part, whilst you now have a backup it is held on the server so what we want is to get a copy of it onto your own computer so you have an external backup. Again Plesk makes this very easy – just click on the little disk icon on the far right hand side to download it. Please Note: if your website is big this can take a while so guess what? take another tea break – as you can see this I.T. work isn’t all that hard, do a little, make tea, do some more, make tea – easy

Next Time: We’re talked backing up, next installment will be restoring and we’ll jump into some more technical aspects like how to schedule a backup and how to have that schedule FTP the backup somewhere else.

1. Web Hosting Support Technicians (who time to kill! )
2. Sys Admins
3. Anyone with an interest, even if you don’t have loads of experience.