I had SSL certificate on my site but still it has been hacked...how to prevent this from happening?

Question

I used SSL certificate on my site but still it has been hacked.

How do I prevent this from happening?

Do SSL certificate come with a waranty which would compensate me because my site was hacked?

Answer 1

An SSL certificate protects users of your site from having their communications intercepted by a 3rd party. I think it is likely that when you say your site was hacked, this isn't what you're talking about. An SSL certificate does not validate the content of your site, nor does it prevent anyone from accessing it as intended or otherwise. Controls for these are outside the realm of SSL.

There is no warranty regarding SSL certificates other than potential civil liability. Unless your certificate itself was compromised by actions of the issuer, you have no case against them and no warranty is implied.

As far as figuring out what was insecure about your site, how you were compromised, or what needs to be addressed to fix it, you need to have forensic analysis performed on your compromised machine. A review of the website code for the site in question may also be in order.

Answer 2

SSL certificates don't do anything to prevent your site from being hacked, so you're not going to be able to claim compensation. If properly implemented, they prevent your users' traffic from being intercepted by third parties, which is not the same thing at all.

To stop your site from being hacked again, you need to employ or become an expert in Internet security -- there's no other way. There are so many different ways that your site could be vulnerable that I couldn't even begin to list them all here.

Answer 3

I've never heard of a warranty on SSL certificates, and even so, it wouldn't be that your site wouldn't be broken into - it'd be a warranty concerning the link between your server and your user's computer.

You may be thinking of those (ridiculous) "verified by XXX" logos you see on websites. Those are intended to give visitors confidence that the site is indeed secure, but again, they don't function as an assertion that nobody can break into your site, as much as an indication that the site is using SSL to protect communications.

There are other logos out there that sometimes show up on websites, sometimes from the same companies that sell certificates, that purport to speak to the security of the site itself, but even so I haven't heard of any of them warranting that claim. Far from it, usually - almost everyone inserts gigantic disclaimers in their license agreements.

Answer 4

Let's say you have SSL, but an outdated OS, poor passwords, your house/work network compromised, not only by you, but by others that also make use of it. How can your server be secure?

There are so many technical paths a malicious guy can try, and social engineering to do. An SSL certificate, can only protected the communication preventing it to be transmitted as plain text and checking if the parts are who they are claiming to be. It's the same say to the user: "Your information will be transmitted by a verified organization locked in a box with one key to lock and another to open. Only you and I have the keys".

But this doesn't mean that no one will be able to exploit that key during the transmission. For example, the attacker can invalidate the HTTPS transmission before the user even note, forcing the information to be transmitted as plain text (e.g sslstrip).

Second, let's say that everything is ok, but you built your page with Wordpress or Joomla for example, with a feel plugins. If you do not have the appropriate guy to check your code, is just a matter of time to someone break in, since exploits for applications and plugins made by those organizations and their users pop out every day on exploits databases.

Just an example, the same can be done on in-house applications, even with automated tools.

SSL is just the tip of the iceberg.