0

I have a landing page setup for my business located at www.jdmxchange.com and have been getting some strange error logs from ELMAH. I apparently have users (or bots) in the Ukraine probing the hell out of my site. It seems they are trying to figure out what technology I have running under the hood. I get exceptions for invalid paths such as

.../wp-login
.../webalizer
.../js/javascriptfile.js
.../user

and so forth. At one point I received about 32 errors within a few minutes. This is my first time with a public-facing site and I am not sure which direction to go into reading up on making sure my site is secured. Can anyone point me to a good place to start?

  • 2
    You mean you didn't perform security testing before you placed your website into the hostile environment we know as the Internet? Hire a security firm to review your website's code and your configuration. Get a HIDS. Block entire countries if you don't plan on doing business with them. – Lucas Kauffman Mar 26 '15 at 15:14
  • Thank you good sir. Those sound like some good ideas to delve into. – Adrian Mar 26 '15 at 15:25
  • A company I currently work for uses incapsula which seems to work well but they are too expensive considering I'm a measly little startup :/ – Adrian Mar 26 '15 at 15:29
  • 2
    Well at least look a bit into security management, what you should log, where you should log it, what type of data you are saving (especially if you plan on processing credit card data or personal data). – Lucas Kauffman Mar 26 '15 at 15:31
  • 3
    Putting a internet faced website without security in mind will put it on the hacked sites category. If you don't have security skills to harden your site, pay someone to do it. Pay it now. Otherwise you will surely be paying someone to fix the mess later. – ThoriumBR Mar 26 '15 at 15:37
3

Requests like the ones you are seeing exist ubiquitously on the Internet. It's called "background radiation" and it's something that everyone with a public service has to deal with.

Don't worry about it. They are random probes looking for holes and if you have properly secured your site against this "background radiation", then you just weather it like everyone else. Assuming, of course, that you have secured your site against this type of threat.

If you are a startup, one of the investments you will have to make is to implement basic security, just like a new brick-and-mortar business would have to invest in locks and a security system. Contact a professional consultant to help you through that process.

  • "background radiation" is a good way of thinking of these kind of requests. – Naftuli Kay Mar 26 '15 at 18:27
  • 1
    Yes sir I now have cloudflair up and running thanks to you guys! And I blocked Ukraine from the map lol – Adrian Mar 26 '15 at 19:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.