How to protect your website from Viruses / Malware
What to do if a virus is found on the website?
Ways to protect resources from viruses
What to do if a virus is found on the website?
Check that you have a backup copy of the site that does not yet contain a virus. If so, restore the site from a backup. If there is no backup, you must remove the malicious code. If you can't do it yourself - just write to us, the support service will do everything possible. Please note that there may be slight downtime of the site during the work (the exact time is unknown, everything depends on the amount of damage).
After the site is successfully restored from backup or freed from malicious code, you need to set up a backup and take the necessary steps to protect the site.
Ways to protect resources from viruses
To automatically search for and remove viruses (or in PLesk), you can use the pre-installed ImunifyAV antivirus program (formerly Revisium) or install the virus die add-on. Both virus protection programs find infected files and code fragments, delete them or send a notification with the path to these files for manual scanning.
You must prevent the code from running using the .htaccess file. To do this, create a file called .htaccess in the directories into which files can be uploaded (usually uploads, media, images, etc.).
File content .htaccess:RemoveHandler .phtml .php .php3 .php4 .php5 .php6 .phps .cgi .exe .pl .asp .aspx .shtml .shtm .fcgi .fpl .jsp .htm .html .wml
AddType
application / x-httpd-php-source .phtml .php .php3 .php4 .php5 .php6
.phps .cgi .exe .pl .asp .aspx .shtml .shtm .fcgi .fpl .jsp .htm .html.
wml
Update the website CMS to the latest version and don't forget to do it regularly. All CMS plugins and scripts used are updated regularly. Some plugins or scripts may have vulnerabilities that could be exploited by attackers. It is risky to use zero versions of (unlicensed) CMS.
Scan all computers from which you manage the server / site for viruses and run them regularly.
One important point - passwords used, passwords change regularly. Also, don't neglect the password security rules:
Never use simple and identical passwords anywhere!
When creating / changing a password for a user / mailbox / site administrator / database user / FTP account, follow these rules:
The password is at least 10 characters long.
The password contains upper and lower case letters of the Latin alphabet (AZ, az), numbers (from 0 to 9). You can also use special characters (\, /,%, *, (,),?, @, #, $,. ~ ,: etc.);
The order of the characters is arbitrary.
There are password generators that can make it easier to create:
https://passwords-generator.org/
Saving passwords simply in a text file is not secure. Use encrypted hard disk partitions / flash drives / files.
You can use this web resource to check how difficult it is to crack your password: https://howsecureismypassword.net
