I have Backdrop running on a shared server, and today had some malware files discovered by Sitelock. I deleted the files. However, the Sitelock phone support person says that I have no firewall, and that is a problem. I called the web hosting provider, and they said the firewall is normally a module in the CMS. He referred to it as a "Personal Firewall" to distinguish it from the server firewall, which they do have. My question is this: what should I use as a firewall to protect Backdrop?
Weekly office hours
Bring your questions to our weekly virtual office hours, every Wednesday. Everyone is welcome.
Recent topics
Posted 19 hours 10 min ago by (NormPlum) in How-To and Troubleshooting
Posted 6 days 22 hours ago by (Irina Zaks) in How-To and Troubleshooting
Posted 1 week 9 hours ago by (onyx) in How-To and Troubleshooting
Posted 1 week 13 hours ago by (NormPlum) in How-To and Troubleshooting
Posted 1 week 1 day ago by (bartl) in How-To and Troubleshooting
Recent comments
Additionally, "outside" means a file that is located outside a module folder. The second parameter of module_load_include() is the name of a module, so, this function assumes that you are loading a...
How to include other files in module?
Yes, it does mean outside your functions. You can use module_load_include() within functions but not outside. The YouTube module gives an example: <?php /** * @file * Youtube field module adds...
How to include other files in module?
On D7 project we are using openid_connect. We need to have similar functionality for Backdrop CMS, sooner rather than later.
OpenID?
Why not insert the script using a custom block at the very top of the page? Who said that it won't work correctly if you don't place it in the <head>? Especially when the question...
Google tag and event snippet on the conversion page
You can use https://statichost.host for hassle free static experience.
Comments
I don't know of any "firewall" as a module in a CMS. The best way to secure Backdrop is to keep it updated.
Thanks, herb, for the comment! I found that Wordpress has several "firewalls" you can install as modules. Using Drupal and Backdrop, I had never heard of such a thing. I suppose Wordpress is so ubiquitous that the Sitelock people just assume that is what I am using. Perhaps tech support people are not always the most widely experienced....
I don't think anyone has ported anything Backdrop. Though I did a quick search of Drupal and did see an integration with fail2ban, which needs to be installed on the server https://www.drupal.org/project/fail2ban. You could port or get someone to port it, if your host will also install fail2ban. Though that only helps *after* its known the IPs that are trying to break into your site.
By the way, once your site has malicious files just deleting those files will unlikely help. Your best best, sadly, is to wipe it all and restore from a backup.
Thanks, Herb! I'll take a look at fail2ban to see how it might apply....