Securing Your Personal Website: Accounts, Domain and Updates

It is easy to assume nobody would bother attacking a small personal site. CISA, the US Cybersecurity and Infrastructure Security Agency, disagreed in its 2021 website security guidance, now kept in its archive of older material: it said cyberattacks against public-facing websites, regardless of size, are common, and can lead to the site going offline, data being exposed, or an attacker taking control of it.

The good news is that a personal site has few moving parts, and most of the risk sits in a handful of accounts. Protect those accounts, keep the software current and keep a backup, and you have covered most of what matters. This guide walks through each piece in plain terms.

Map what you are actually protecting

Before changing any settings, list the accounts behind your site. For most people that is:

• The domain registrar account, where your domain name is registered and renewed.
• The hosting or site-builder account, where the pages live.
• The email account that receives password resets and renewal notices for both.
• Any add-ons or connected services, such as analytics, forms, plugins or embedded widgets.

The email account deserves special attention. Password resets and renewal notices for the other accounts usually go there, so whoever controls your inbox can often reset everything else.

If someone else built or manages your site, ask who holds each login. CISA's website guidance also suggests talking with your hosting or managed service provider about who is responsible for which security measures.

Lock down the logins

CISA's current advice for everyone comes down to four core steps: avoid and report phishing scams, use strong passwords, use multifactor authentication and a password manager, and update software. Its earlier Secure Our World guidance, now archived, described a strong password as long, random and unique to each account, and a password manager as a program that generates, stores and fills in passwords for you. Since nobody can remember dozens of unique passwords, the manager is what makes the habit practical.

Then turn on multifactor authentication (MFA) everywhere it is offered, starting with email, your registrar and your host. CISA explains that MFA requires a second method of verifying your identity, so even if one credential, such as your password, is compromised, an intruder still cannot meet the second requirement. Look for it in account or security settings, sometimes under the name two-factor or two-step authentication.

CISA's 2021 website security guidance adds two account basics:

• Change any default passwords provided by your registrar or DNS provider. Default credentials are often readily available online.
• Use the principle of least privilege. If a friend once helped edit your site, remove their access when they no longer need it, and disable accounts nobody uses.

Protect your domain name

If someone takes over your domain, they can point your address anywhere. A few steps from ICANN's security guidance reduce that risk:

• Use a contact email on a different domain. ICANN's Security and Stability Advisory Committee recommends that the contact addresses for a domain be outside that domain and its registration account. If your only contact address is on the domain you are protecting, an attacker who changes its settings can also stop your warning emails.
• Keep the transfer lock on. Many registrars let you lock a domain against transfers. ICANN's Transfer Policy summary notes that registrars must give you a reasonable way to remove the lock when you do want to move.
• Watch for renewal scams. ICANN warned in 2014 about fake renewal emails that copy its branding and steer people to payment pages. ICANN says it does not process domain registrations or collect fees from registrants directly. Renew only by logging in to your registrar yourself, not through a link in an email.
• Review your DNS records once in a while. CISA recommends reviewing registrar and DNS records for all of your domains, so you notice changes you did not make.

Keep software and add-ons current

Updating software is one of the four core steps CISA asks everyone to take, because updates fix flaws that attackers could otherwise use. Its 2021 website guidance also recommends enabling automatic updates whenever possible, replacing unsupported software, disabling features and modules you do not need, and auditing third-party code such as ads and analytics to make sure nothing unexpected is delivered to visitors.

How much of this falls to you depends on the kind of site you run:

• On a fully hosted site builder, the provider generally maintains the platform software. Your job is mainly your account security and any add-ons you choose to connect, but confirm the split with the provider, as CISA suggests.
• On a self-managed site with installable software and plugins, you are responsible for updates. Turn on automatic updates where the software supports them, and delete plugins and themes you do not use instead of leaving them disabled.

Use HTTPS and keep a backup

CISA's website guidance recommends enforcing HTTPS, which encrypts the connection between your site and its visitors, and enabling HTTP Strict Transport Security (HSTS) where possible. Many hosting services and site builders provide HTTPS certificates; check that yours is turned on and that the plain HTTP version of your address redirects to it.

It also recommends a backup that runs automatically and is stored somewhere separate from the site. For a personal site, that might mean using your host's backup feature plus an occasional export of your pages, images and text to a drive you control. If your site is ever damaged, or you simply change tools, a backup turns a disaster into an afternoon.

Signs of trouble, and what to do

Warning signs include pages you did not create, unfamiliar admin accounts, unexpected redirects, password-reset emails you did not request, or visitors reporting browser warnings. If you use Google Search Console, its Security issues report shows when Google determines a site was hacked or exhibits harmful behavior such as phishing or malware.

If you think something is wrong:

1. From a device you trust, change the passwords for your email, registrar and host, and check that MFA is still on.
2. Check each account's recovery email and phone number to make sure they are still yours.
3. Contact your host or builder's support and your registrar.
4. Restore clean content from your backup, then update all software.

If you lose money, are extorted or are threatened, report it. The FBI's Internet Crime Complaint Center (IC3) is the central hub for reporting cyber-enabled crime. If you or someone else is in immediate danger, call 911 or your local police.

Key takeaways

• Most risk lives in a few accounts: your registrar, your host or builder, and the email behind them.
• Use strong, unique passwords stored in a password manager, and turn on MFA everywhere it is offered.
• Keep your domain locked, use a contact email on another domain and renew only through your registrar's own site.
• Update software promptly, remove unused add-ons and keep an automatic backup stored separately.
• Report cyber-enabled crime to IC3, and call 911 if anyone is in immediate danger.

Sources

• CISA, Website Security (February 1, 2021; archived content)
• CISA, Cybersecurity Awareness Month
• CISA, Multifactor Authentication
• CISA, Secure Our World: Use Strong Passwords (archived content)
• ICANN Security and Stability Advisory Committee, SAC044: A Registrant's Guide to Protecting Domain Name Registration Accounts (November 5, 2010)
• ICANN, Be Careful What You Click: Alert of New Fraudulent Domain Renewal Emails (September 29, 2014)
• ICANN, 5 Things Every Domain Name Registrant Should Know About ICANN's Transfer Policy
• Google Search Console Help, Security Issues Report
• FBI Internet Crime Complaint Center (IC3)