|
A few key pointers off the top of my head
1) Don't give up any information about your server software or platform. Change favicons, default server headers, default error messages etc.
2) Limit access to known admin ports such as web based server admin ports, ssh, ftp etc. Lock them down to specific ip addresses. Something like IPFilter is good for this.
3) If you use any open source blogging or similar apps change the default file locations especially to admin folders.
4) Ensure all forms thouroughly clean and validate any user input.
5) Ensure you have a strict password policy and learn about username/password enumeration to prevent brute forcing.
6) Don't allow directory listings.
7) Don't use predictable directory names such as "admin".
8) Be paranoid.
|
. Thanks for your advice tho. It really would have been helpful.
