Prerequisites
Website Ownership or Admin Access
DNS Access
SSL Certificate (Optional but Recommended)
Access to Hosting Server (for some configurations)
A Backup of Your Website
Knowledge of Basic Website Security
Subscription to a Sucuri Plan
Introduction
In today's digital age, websites face a growing number of cyber threats, from hacking attempts and malware to DDoS attacks and data breaches. No matter the size or industry, no website is immune to these risks. As a website owner, protecting your online presence is crucial—not just for the safety of your data, but for maintaining the trust of your visitors. That's where Sucuri comes in.
Sucuri is a leading website security platform that provides powerful tools to protect, monitor, and clean your website from potential threats. Whether you’re running an eCommerce site, a blog, or a business site, Sucuri offers comprehensive solutions to safeguard your site against cyber threats. In this guide, we'll walk you through how Sucuri can help shield your website from the most common security risks and keep it running smoothly and securely.
DNS Change
You update the A record of your domain to point to the Sucuri firewall IP's address. This directs all incoming traffic to your website through Sucuri's WAF before reaching your actual server, providing real-time security and protection from attacks like DDoS, SQL injection, and malware.
Propagation Time
You will need to allow up to 24 hours for the DNS changes to propagate fully after enabling the firewall by changing the DNS A record of your domain to point to the assigned firewall IP.
You can check on the progress of the DNS changes here:
Bypass Prevention
When Sucuri’s firewall is enabled, it typically protects your website from attacks. However, if the firewall is bypassed (e.g., through DNS issues or misconfigurations), attackers may still be able to access vulnerable files on your server. Restricting access to only trusted IPs ensures that even if malicious traffic bypasses the firewall, it won't be able to access sensitive resources.
With Sucuri, it's highly recommended to implement bypass prevention to further protect your site from malicious requests and attacks! Implementing firewall bypass prevention will prevent requests from bypassing the firewall hardening and will force all requests to filter through the firewall.
How to Implement This in .htaccess
You can add a rule to your .htaccess file that restricts access to certain directories, only allowing access from Sucuri's IP addresses (or any trusted IPs). You can obtain the bypass prevention rules on the configuration page for your specific web server.
Here’s an example of how to do it:
<FilesMatch ".*"> Require ip 185.53.168.0/22 # Add Sucuri's IP range here Require ip 203.0.113.0/24 # Add other trusted IP ranges as needed </FilesMatch>
- <FilesMatch ".*">: This will match all files on the server.
- Require ip: This restricts access to files, only allowing requests from specified IP ranges. In this case, you're allowing access only from Sucuri’s IP range (and any other IP range you add).
What Happens After Bypass Prevention?
- Requests bypassing the firewall will be blocked by the .htaccess rule and will trigger a 403 Forbidden error, rather than a 200 OK response, indicating that the request has been explicitly denied.
- This approach ensures that even if the firewall is bypassed or misconfigured, attackers will not be able to access the critical parts of your website, effectively preventing them from exploiting your site.
To put this in perspective, you can run the following curl request bypassing the firewall and directly hitting your hosting server if bypass prevention has not been implemented.
Curl Command
curl -ILH "host: yourdomain.com" http://ip
Explanation of Each Part:
- curl: This is a command-line tool used to transfer data from or to a server. It’s commonly used for testing and troubleshooting HTTP requests.
- -I: This flag tells curl to fetch only headers of the response, not the actual content. This is useful for checking things like response status codes and server information.
- -L: This flag tells curl to follow any redirects (like 301 or 302 responses) until the final destination is reached. This can be helpful if your site is configured to automatically redirect from HTTP to HTTPS or if the site has other redirects set up.
- -H "host: yourdomain.com": This is an HTTP header that sets the Host field in the request. The Host header tells the server which domain you are trying to access. This is important if the server hosts multiple websites (virtual hosts), and it lets the server know which one you're referring to.
- http://ip: This part of the command is where curl makes a request to the site's IP address, not the domain (yourdomain.com). In a typical scenario, this would bypass any DNS-based security mechanisms, like a firewall that protects traffic coming to the domain.
The curl command is testing how the server reacts when an attacker tries to bypass the firewall by hitting the IP address directly instead of going through the domain. If bypass prevention is setup correctly, the server should return a 403 Forbidden response rather than 200 OK, effectively blocking unauthorized access and helping secure the website from malicious actors trying to exploit the system.
If you're seeing a 200 OK instead of a 403, it means that bypass prevention has not been correctly implemented, and attackers may still be able to gain unauthorized access to your site.
Benefits of Having a Firewall on Your Website
Improve Speed with Caching and Content Delivery Network (CDN)
A firewall can optimize the speed of your website by caching content and using a Content Delivery Network (CDN). This reduces the load on your server and ensures faster page load times for users across different geographical regions.
Sucuri has a built in CDN which is always active when enabled, so having another CDN enabled at the same time is redundant and can cause configuration issues.
Mitigate Distributed Denial-of-Service (DDoS) Attacks
A firewall can detect and block DDoS attacks, which are designed to overwhelm your server with traffic and take your website offline. With proper protection, your site can continue to operate even under these types of attacks.
Prevent Hacks and Vulnerability Exploit Attempts
Firewalls block malicious traffic before it can exploit vulnerabilities in your site's code or software, significantly reducing the risk of hacking attempts that could compromise your website or data.
Protect Against the OWASP Top 10 (and More)
The OWASP Top 10 represents the most critical security risks to web applications. A firewall can prevent attacks like SQL injection, cross-site scripting (XSS), and others that are outlined in the OWASP Top 10, ensuring your website is protected from a wide range of common threats.
Stop Brute Force Attempts Against Your Website Login Pages
Firewalls can detect and block brute force login attempts, which are automated attacks designed to guess passwords. This adds an extra layer of protection for critical areas like your admin and login pages.
Leverage Geographic Load Balancing and Reliable Uptime
A firewall can ensure that traffic is distributed evenly across multiple servers based on geographic location, optimizing load times and ensuring your website remains up and running, even in high-traffic situations.
Backup Restoration
In case of a severe attack, Sucuri can assist in recovering your website using its backup solutions or by leveraging previous clean site versions.
Sucuri provides several different website monitoring types
Security Checks
Sucuri regularly performs security scans to detect malware, vulnerabilities, and suspicious activity on your website. This proactive monitoring ensures that potential threats are identified and addressed before they can compromise your site.
SSL Monitoring
With SSL Monitoring, Sucuri ensures your website's Secure Socket Layer (SSL) certificate is valid and properly configured. This helps maintain a secure, encrypted connection between your website and your visitors, preventing data breaches and protecting sensitive information.
DNS Monitoring
DNS Monitoring by Sucuri helps detect any malicious changes or attacks targeting your domain’s DNS settings. This is critical to ensure that your website's domain remains pointing to the correct server, preventing DNS hijacking and other domain-related attacks.
Blocklist Monitoring
Sucuri keeps an eye on whether your website's domain or IP address has been listed on popular blocklists, which could negatively impact your site's reputation and traffic. If your site appears on a blacklist, you'll be alerted immediately so that you can take action to resolve the issue.
Uptime Monitoring
Uptime Monitoring ensures that your website is online and accessible at all times. Sucuri regularly checks your site’s status and notifies you if it goes offline or experiences downtime, helping you maintain a reliable online presence and promptly address any issues.
Final Thoughts
In an era where cyber threats are becoming more sophisticated, securing your website is no longer optional—it's a necessity. With hackers constantly looking for vulnerabilities to exploit, having a comprehensive security strategy in place is essential for protecting your business, data, and reputation.
Sucuri provides a powerful suite of tools that can help you safeguard your site against a wide range of cyber threats, from malware and DDoS attacks to unauthorized access and data breaches. By implementing Sucuri's Web Application Firewall (WAF), monitoring tools, and malware cleanup services, you can ensure that your site remains secure, even in the face of evolving threats.
Remember, no website is completely immune to attacks. However, with Sucuri's proactive protection, you can stay one step ahead of potential threats and focus on what matters most—growing your online presence with confidence. Take the time to implement the right security measures today, and shield your website from the ever-growing risks of the digital world.
Don’t wait for an attack to happen—take action today to shield your website from cyber threats with Sucuri. For more information on how Sucuri can help protect your site, visit their official website at www.sucuri.net