what are best ways to keep a website safe without web security and cybersecurity knowledge?
Shut it down, delete the code.
But since this is not the answer you want to hear, let's take a deeper dive:
Depending on the website we're talking about - Is it a CMS like WordPress? Is it something an intern clicked together in Dreamweaver? Is it a simple index.html
only containing an address and a phone number? - it's impossible to give informed recommendations. So try to get a basic understanding of what area you want to improve next and ask a more focused question.
However, as a general rule of thumb you can do the following:
- Keep it up to date!
- Get a pentest from a reputable source to get your most critical vulnerabilities and fix them ASAP.
- If you use a regular CMS you can start by scanning it with a vulnerability scanner like OpenVAS/Nessus
- If you coded/customized it yourself (e.g. no off the shelf CMS) you can additionally run it through SAST (static application security testing) and DAST (dynamic application security testing) tools.
- OWASP has a plethora of guidelines, checklists, cheat sheets etc. - read them, apply them.
- Don't forget about key-, password- and access management to the website and infrastructure. The best website security is useless if you enable unauthenticated SSH to your production server. Same goes for social engineering.
- Get another pentest after you fixed your issues to find even more issues (quality management is a cycle for a reason).
- Set up secure network segregation between dev, test and prod.
- Monitor network traffic with IDS/IPS.
- Logging, logging and more logging - log everything: access, failed logins, destinations, successful logins etc. etc. (but beware of GDPR et al).
- And most importantly, get educated. Read up on everything web security related. Watch tutorials, read books, news sites, blogs etc.
Or, if you really care about your website's security, hire a professional to guide you through this process. My guess is that this option will be more thorough, more secure and a lot cheaper than trying to fix this on your own.