31,19 €
Mehr erfahren.
- Herausgeber: Packt Publishing
- Kategorie: Wissenschaft und neue Technologien
- Sprache: Englisch
In Detail
Joomla! is one of the most powerful open-source content management systems used to build websites and other powerful online applications. While Joomla! itself is inherently safe, misconfigurations, vulnerable components, poorly configured hosts, and weak passwords can all contribute to the downfall of your site. So, you need to know how to secure your website from security threats.
Today every website needs to take security into consideration. Using the knowledge here, your Joomla! site can be ahead of the security threats so prevalent today.
This book will take you all the way from the most basic steps of preparation to the nuts and bolts of actual protection. It is packed full of relevant and real-world topics such as security tools, configuration suggestions, setting up your test and development environment, reading and interpreting log files, and techniques used by bad hackers on the Internet. In addition to this you will learn how to respond to a site emergency should one occur and how to collect the evidence needed to pursue law enforcement action. This book covers Joomla! 1.0.x as well as 1.5.x.
The book provides a concise overview of all the parts needed to construct a defence-in-depth strategy for your Joomla! site. At the end of the book you will have a solid security foundation to take your Joomla! website to a higher level of security than the basic site setup.
Are you concerned about the security of your Joomla! website and you don't know what to do? - read this easy-to-use practical guide and learn how to implement strong security measures.
Book Reviews
Slashdot: "There is a ton of good information here and I recommend the book."
Mylro.org: "Technical books can be sometimes boring, especially when they talk about things you already know. This is not the case with Joomla! Web Security. I enjoyed Tom Canavan's detached writing style and I learned some interesting things that I applied to all my Joomla! websites. What I especially liked was the fact that the book discusses not only the Joomla! part of a website but also the server side and gives some nice hosting tips. If you're a junior or intermediate Joomla! user I would highly recommend it."
JoomlaNYC: "This is "a must" read book for all people that care about the security of a website. The book offers an excellent primer on basic web-security. It is written for the person who has not yet mastered the skills needed to properly secure a website."
Approach
This book will give you a strong, hands-on approach to security. It starts out with the most basic of considerations such as choosing the right hosting sites then moves quickly into securing the Joomla! site and servers. This is a security handbook for Joomla! sites. It is an easy-to-use guide that will take you step by step into the world of secured websites.
Who this book is for
This book is a must-read for anyone seriously using Joomla! for any kind of business, ranging from small retailers to larger businesses. With this book they will be able to secure their sites, understand the attackers, and more, without the drudging task of looking up in forums, only to be flamed, or not even find the answers.
Prior knowledge of Joomla! is expected but no prior knowledge of securing websites is needed for this book. The reader will gain a moderate to strong level of knowledge on strengthening their sites against hackers.
Das E-Book können Sie in Legimi-Apps oder einer beliebigen App lesen, die das folgende Format unterstützen:
Seitenzahl: 343
Veröffentlichungsjahr: 2008
Ähnliche
Table of Contents
Joomla! Web Security
Tom Canavan
Joomla! Web Security
Copyright © 2008 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the authors, Packt Publishing, nor its dealers or distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.
First published: September 2008
Production Reference:2160908
Published by Packt Publishing Ltd.
32 Lincoln Road
Olton
Birmingham, B27 6PA, UK.
ISBN 978-1-847194-88-6
www.packtpub.com
Cover Image by Nilesh Mohite (<[email protected]>)
Credits
Author
Tom Canavan
Reviewer
Kenneth Crowder
Acquisition Editor
Shayantani Chaudhuri
Development Editor
Ved Prakash Jha
Technical Editor
Darshana D. Shinde
Copy Editor
Sneha M. Kulkarni
Editorial Team Leader
Mithil Kulkarni
Project Manager
Abhijeet Deobhakta
Project Coordinator
Brinell Lewis
Indexers
Hemangini Bari
Rekha Nair
Proofreader
Chris Smith
Production Coordinators
Aparna Bhagat
Rajni Thorat
Cover Work
Aparna Bhagat
About the Author
Tom Canavan has been in the Computer and IT industry throughout his career. Currently, he is the Chief Information Officer of a very large .com. He has worked in this industry for twenty-four years in various capacities.
He authored the book Dodging the Bullets: A Disaster Preparation Guide for Joomla! Web Sites and is very active in the Joomlasphere.
He and Kathy Strickland of raptorservices.com.au are the co-hosts of the popular podcast REBELCMS.COM.
I commit this book to my God and Savior Jesus Christ.
I thank my wife Carol Ann for putting up with me while I wrote yet another book.
Thank you the reader for taking a moment to look at this, may it bless and care for you.
About the Reviewer
Kenneth Crowder has been involved in the Joomla! Community since the days of Mambo. He has volunteered countless hours to help out the Open Source Project and is considered an expert in all Joomla!-related things. He also is known as the patient, helpful global moderator in the Joomla! Online forum.
Currently, Kenneth is the Senior Software Engineer at BIGSHOT (www.thinkBIGSHOT.com), a full-service marketing and advertising agency located in Kansas City, Mo. Kenneth holds a bachelor's degree in Computer Science from Northwest Missouri State University. He and his wife, Michelle, have a son, Ryland, and a new baby due in March 2009.
I thank Tom for giving me the opportunity to contribute to this book.
Preface
You might be wondering what compelled me to undertake a Joomla! security book, I thought I would share some thoughts. Oddly enough, as I write this, America is moving into the 2008 presidential elections. Again it reminds me as to why I wrote this book.
Security in your website and PC is not much different from politics. Few people ask critical questions. Fewer still search for answers or check out the postings for help that abound on the forums. Everyone seems to be blindly accepting their software's and host's security, and freely downloading from the various sites offering cool extensions.
This lack of critical thinking has caused a near epidemic problem on the Internet with compromised sites, stolen identities, billions of dollars in theft, and so on all because many people are too lazy to not be ignorant. They are too lazy to "think" for themselves.
As harsh as this may sound, I hope it resonates with you before you read this book. I hope that you take the countless hours of work, research, and thought that went into this book and turn your ignorance into wisdom.
You do not have to sit idly while your server is taken over by a bot-net to be exploited (in the truest sense of the word) and sold by the MIPS (millions of instructions per second), the bandwidth, and the disk store. You can fight back! And you should!
Sit no longer by and claim that you "don't have the skill". With this book you are well on your way to not only having the skill, but also having the power in your hands to deliver a crushing blow to the bad guys!
Hence, the reason I wrote this book is to level the playing field for the good guys.
My hope is that this book will be a great read, a wonderful security companion, and a shield for your websites!
Godspeed!
What This Book Covers
Chapter 1 : This foundational chapter gets the reader ready by reviewing terminology, understanding hosting companies, and how to select them. It also deals with learning to architect Joomla! correctly at first, including where to download Joomla! from, its important settings, permissions and trip-ups, and lastly setting up metrics for security.
Chapter 2 : Once you have your site planned, setting up a test and development environment allows you to make sure each extension will work with the others as planned. This chapter gives the reader a methodology to effectively set up and use a test/dev environment, with a review of a great tool, Lighthouse, for software development project management.
Chapter 3 : There are a few key tools every Joomla! administrator should have in his or her security arsenal. This chapter covers the tools used to protect your site.
Chapter 4 : What is a vulnerability? It is anything that can be used against you to harm your site. This chapter introduces some common vulnerabilities and how they work.
Chapter 5 : Specific attacks such as SQL Injections are discussed here with live examples of code used to attack sites, kiddie scripts, and other more advanced attacks.
Chapter 6 : Do you ever wonder what tools the bad guys use? This chapter covers some of the commonly available tools, and how they are used against you.
Chapter 7 : This chapter details out the two important safeguards to your infrastructure. It offers a detailed view with code samples of each of these critical files.
Chapter 8 : Without a doubt, log files are the first and the best indication of a coming attack. Yet many administrators do not know how to interpret these critical files, or worse yet, ignore them. This chapter will teach the reader how to read log files and take care of them for forensic purposes.
Chapter 9 : SSL is the guardian of e-commerce on the Internet. In this chapter, you will learn how SSL works, where to obtain a certificate, and how to implement it in your Joomla! site.
Chapter 10 : Even the best laid plans go astray. If a site is actually hit, you have an incident to handle. This chapter will educate you on some best practices for handling the incident in an effective manner.
Appendix : Looking for that one bit of information? This chapter is a concise reference to highly important items of security information that will be important to your daily efforts in protecting your site.
Who is This Book For
This book is a must-read for anyone seriously using Joomla! for any kind of business, ranging from small retailers to larger businesses. With this book they will be able to secure their sites, understand the attackers, and more, without the drudging task of looking up in forums, only to be flamed, or not even find the answers.
Prior knowledge of Joomla! is expected, but no prior knowledge of securing websites is needed for this book. The reader will gain a moderate to strong level of knowledge on strengthening his or her site(s) against hackers.
Reader Feedback
Feedback from our readers is always welcome. Let us know what you think about this book, what you liked or may have disliked. Reader feedback is important for us to develop titles that you really get the most out of.
To send us general feedback, simply drop an email to <[email protected]>, making sure to mention the book title in the subject of your message.
If there is a book that you need and would like to see us publish, please send us a note in the SUGGEST A TITLE form on www.packtpub.com or email <[email protected]>.
If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide on www.packtpub.com/authors.
Customer Support
Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.
Downloading the Example Code for the Book
Visit http://www.packtpub.com/files/code/4886_Code.zip to directly download the example code.
Note
The downloadable files contain instructions on how to use them.
Errata
Although we have taken every care to ensure the accuracy of our contents, mistakes do happen. If you find a mistake in one of our books—maybe a mistake in text or code—we would be grateful if you would report this to us. By doing this you can save other readers from frustration, and help to improve subsequent versions of this book. If you find any errata, report them by visiting http://www.packtpub.com/support, selecting your book, clicking on the let us know link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata added to the list of existing errata. The existing errata can be viewed by selecting your title from http://www.packtpub.com/support.
Piracy
Piracy of copyright material on the Internet is an ongoing problem across all media. At Packt, we take the protection of our copyright and licenses very seriously. If you come across any illegal copies of our works in any form on the Internet, please provide the location address or website name immediately so we can pursue a remedy.
Please contact us at <[email protected]> with a link to the suspected pirated material.
We appreciate your help in protecting our authors, and our ability to bring you valuable content.
Questions
You can contact us at <[email protected]> if you are having a problem with some aspect of the book, and we will do our best to address it.
Chapter 1. Let's Get Started
Today, personal computer systems and servers are being compromised at an alarming rate. Servers such as yours that are hacked into are often used to sell "time" by organized criminals around the world. They are selling time on desktops and servers by the minute, hour, purpose, speed available, and other attributes. The reason for their sale is to send out SPAM (unsolicited bulk email), to use as denial of service attack points, or for any other unintended purpose.
Introduction
Joomla!, a very popular Content Management System (CMS), is as you may know an easy-to-deploy-and-use content management system. This ease of use has lent itself to rapid growth of both the CMS and extensions for it. You can install it on almost any host, running Linux or Windows. This highly versatile software has found itself in such lofty places as large corporate web portals, and humble places such as the simple blog.
All of these share a common thread. They exist on the Web, which is one of the most lawless places on the planet. Every day the "bad-guys" are out pacing the good guys—and for a good reason. An ordinary user, who wants a powerful and yet an easy-to-set-up website might choose Joomla!. He or she is not a specialist in security, either good security or bad security. He or she is merely a target to be taken down. While Joomla! itself is inherently safe but misconfigurations of the CMS, vulnerable components, hosts that are poorly configured, and weak passwords can all contribute to the downfall of your site.
You will need to ensure that your copy of Joomla! is original and not compromised. Once you install it, you will need to check a few key settings. And lastly, we'll establish the permission settings of various files and folders. The intent of this chapter is to get you prepared to have a good, solid setup before you go live. So let's take a detailed look at the following:
Common Terminology
For clarity, the following are a few terms that you may or may not be familiar with:
More grammatically, it's a program that exploits an exploit.
Hosting—Selection and Unique Needs
In the "dot-bomb" days, everyone had an idea for the next Million Dollar deal. The Internet enabled the clicks and bricks strategy of taking traditional businesses to the Web or even an 'Internet' only business. Some like eBay and Amazon, survived the "dot-bomb" days, as did others. But many failed to survive.
One interesting type of business that rose up to support the growth was hosting companies. In those days, I met with several hosting companies in my career and they were running very well, in fact, most of them are still running quite well. Yet the advent of cheap hardware, the demand for growth in the Internet landscape, and the abundance of high-speed software have caused a glut of cheap hosting. Many of these hosts are not the best choices for you, due to the inadequate security models they have set up.
In this section, we'll discuss a little about what a host is, and how to select one that will fit the needs of your Joomla! site and your business.
What Is a Host?
For the completely uninitiated, a "web host"' or host is a company that houses your website on its servers. They typically provide DNS, email, tech support, registration of your domain name, firewalls and security, and much more.
Choosing a Host
If you've spent any time at all searching for a host, you will no doubt have found about eight-bazillion different hosts, each claiming to be the best hosting site on the Web. While this book will not be recommending one, we will cover ways to evaluate and learn more about them; what the different terms mean, and some important differences between hosts such as "shared" versus "dedicated". These are all critical to know if you want to have a successful launch of your Joomla! site. Typically, the hosts are housed in a physically secure facility, and provide emergency power in the form of a generator or other means of battery backed-up power. Often, they have more than one connection to the Internet. Most of them can provide you with as much bandwidth and speed as you need, allowing you to buy what you need. These facilities should provide a great deal of protection for your website. They should be enabled with fire-suppression and protection, water-detection, security personnel, caged and locked access to servers, and more. One data center the author is familiar with personally, has a fully-redundant network, meaning, if a backhoe were to cut through their data lines leading to the Internet, the hosts would be able to continue their operations through another path. This is important to understand because if they are down, you are down. Another mark of a good host is 24-7 network monitoring with live personnel.
For instance, if you call them at 2:00 am local time (local to you), they should pick up the phone and be able to address your questions. If they cannot offer you this support, then find another host. One question you may wish to ask when evaluating a host is to ask about their "emergency power". Chances are they will say "we have a generator". Ask them- How long will it run without refueling? This is expressed in hours, such as seventy-two hours or forty-eight hours, and so on. The next question is to ask them if they have fuel-contracts and what is the delivery time? What you are asking them is—Can you get these noisy beasts refueled before they run out of fuel? The person you are speaking with may or may not know it, but ask them to find out. This is an industry norm.
You will need to determine right away the type of hosting you need, shared or dedicated. The questions to help you determine which one you need are beyond the scope of this book, but we will discuss the differences between the two.
Questions to Ask a Prospective Host
You may be a two-person shop in your field, but that makes you a leader. As a leader, you cannot sit still; you must be planning for the future. You must be on the lookout for threats to your business, and the opportunities to grow. Your host has to be flexible to accommodate your needs in this area. Face it, if you select a host simply due to them being the lowest cost provider, you are being "penny wise and pound foolish", which is to say that you are saving a penny through your efforts that is costing you a dollar! Remember, selecting a provider on cost alone is a terrible mistake; one that will cost you dearly. Take some time and review your competition in your field. Where are they hosted? Why are they hosted there? What are the costs and the associated setup fees to set up there and so on. I am not advocating that you follow them into the abyss of hosting. However, they may know something you do not. Hosting is not your business, unless you are a hosting company. Your business is whatever it is, yet, hosting is an integral part of your business web strategy and should be considered as such. It's not an after-thought, anymore than, 'gee' I don't care if I live in a terrible, crime ridden neighborhood while I don't have to; its 'cheap'. Take the time to review what your web strategy is. Evaluate your strategy in terms of your questions.
Facilities
What physical security measures do the hosts have in place? I have visited countless data centers in my career; yet, the ones that stand out in my memory are those that had a very strong security. This is not to mean that they have a card swipe on the server room door. No, this is a strong perimeter set at the front door, a strong authentication at the check-in desk that you are supposed to be there. Once there, can you open the rack or cage of anyone's servers? If you can, this is a bad sign.
Having a strong security presence on the floor always gives me a sense of security about the data center. Of course, there are cameras but so what! A guard who's wearing a weapon, and walking on the floor will do a lot to deter a social engineer who might have made it to the floor.
Things to Ask Your Host about Facility Security
As you are researching or interviewing the prospective host, one thing that is usually not asked by the average consumer is the security of the facility. It's important because this will often tell you if the host is simply reselling, or if it runs the facility. If they do not know, or brush it off, they are probably only 'reselling' someone else's hosting. That does not mean it's bad; it means they do not know.
If that is not the case, then the person you email or speak with by telephone should be able to address your questions. These are some of the questions a large company would ask during the interview of a "co-lo" or co-location facility, during the sales process. Why should your business be any different?
Asking the following questions and obtaining answers that satisfy you is another step in your security chain:
Environmental Questions about the Facility
Site Monitoring and Protection
Note
Did you know that in the US, the Government maintains flood zone maps?
Is your data center in a flood zone? I know of a one large sitting next to a river that 'tends' to get out of its banks quite often; something to consider.
http://msc.fema.gov/webapp/wcs/stores/servlet/CategoryDisplay?catalogId=10001&storeId=10001&categoryId=12001&langId=-1&userType=G&type=1
These are some basic questions that will help you have a secure hosting environment. Keep in mind that not all questions may be answerable from the sales person's head, but they should be able to locate it quickly.
Patching and Security
We'll discuss patching soon; however, it is important to gain an understanding about patching of the O/S and the web server (in our example, Linux and Apache.) For instance, when a critical vulnerability is discovered in the Linux kernel, you should be able to know if it affects your shared or dedicated hosts. You should know when it will be patched by the host (shared, virtual, or private), and if they maintain the O/S for you on your dedicated equipment when it will be handled. Time matters when vulnerability becomes public. Knowing the patch methodology (identification, documentation, build of the patch, testing, and deployment) is just a part and parcel of your security experience. Remember, you are ultimately responsible for the uptime and security of your site. Turning a blind eye to the host won't make you secure. They may have the task and responsibility of patching, for instance, but at the end of the day, your customers will not care whose fault it is, if you are breached. They will want you to explain it.
Shared Hosting
In essence, shared hosting is renting space on a server. This, by far, is the most economical route to get your website published, and the author would venture to guess the most common route. This means they "carve out" a small portion of the server's bandwidth, CPU, memory, and disk and assign it to you. You may see something like the following screenshot when you FTP in:
As you can see, there are several shared server folders displayed, namely, the public_html and www folders. These may vary based on your host, but the point is "above" these folders are areas that their administrators can see, but we cannot. Next in the directory there would be another set of folders that host another website. We don't have the appropriate permissions to see them or interact with them. The memory, disk, CPU, network bandwidth, and other portions of the server are shared with everyone on this physical server. This shared model is economical because the cost to run it is spread across many websites. The hosting company is responsible for patching the systems and ensuring their uptime and maintenance. You are only responsible for your own.
One situation that can arise through the shared model is, if a "neighbor" website is compromised (meaning, broken into by a 'cracker'), your site may be attacked as well. The attackers, depending on how deeply they are able to penetrate, can often wreak havoc on a box, destroying everything in their path. If a host finds out that the attack originated through your website, it is likely to cancel your account or shut you down till you can prove that you have patched your stuff. For instance, let's say you were running an older version of Joomla!, one with a renowned and well-published exploit. Now, if a young punk in a cyber café finds your site to be open and cracks your site, defaces it, and then laughs and goes on leaving you holding the bag, the host is not going to try to block the entire country of the attack's origin. The host will simply lock down your site and account after they clean up. They get real grumpy over this. They feel it's your responsibility to keep up with patching your own site.
A good place to check for exploited software is the online searchable database: http://osvdb.org/search.php.
Patching is a way of life if you have a website, and it is something that we'll spend time on later. For now, keep in mind that if you have a site, you should take the appropriate time, review the forums, search the databases, and check the extension sites to make sure that you are not running anything that has exposed flaws.
Shared hosting almost always comes with a control panel much like the following screenshot, known as cPanel:
As you can see in the previous figure, we can tell many things about our site, such as the number of MySQL databases we can have, our shared hosting IP address, and more. Here is where we would control the setup of our databases, other applications, and things like backups, FTP, stats, and more. Each host may vary in what its control panel looks like. However, many hosts do use the cPanel hosting applet. Dedicated hosting often uses the same panel and features, but exceptions abound.
Dedicated Hosting
Often a dedicated host is what you will choose if you want the full power of the server. You might want this if you are expecting a ton of traffic to the site, in which you would not want to "share" the resources of the box.
In this case, you will have to either administer the system or pay the host to administer the box for you. You probably will have to do the patching of the operating system, in addition to the other components. You may not have to keep the hardware running, as you are renting an entire box.
Other forms of dedicated hosting are when you purchase the hardware yourself and place it into a co-location facility. Known as a co-lo, these businesses provide you "pipe, power, and ping". In other words, they will give you a secure place to house your machine, provide the power, provision the IP address, and provide security.
Both these options are very costly, with the last one being the most time and money consuming on your part.
How do you choose what to do? If you are starting out for the first time, a convenient and economical choice is to go with the shared hosting, month-to-month. This way, if you discover problems with the hosting, you can always move and not incur a great deal of expense.
Again, the author does not make any recommendations for hosting; however, a couple of great places to start your search are:
http://www.webhostingtalk.com/
http://whreviews.com/searchstrategy.htm
These two sites can provide you with a great deal of knowledge about different hosts, their costs, the level of support you can expect and so forth.
In this book, we are going to focus on the Linux, Apache, MySQL, PHP environment, and as such, you can review hosts that support this environment as well as the Joomla! environment.
If you have friends who have a website, ask them how the support is. Call into the tech support and see how open and friendly they are to help you as a prospective customer. If they won't help you as a prospect, you can rest assured you won't get help as a customer.
As you work towards making a decision, ask about your ability to change several of the key variables such as open_base_dir, safe_mode, register_globals and others that are important in supporting your site in a secure manner. Be sure to inquire how you will change those, if they have to be changed and so on. Sometimes you have access to the .htaccess for your shared host, and sometimes you don't (this doesn't apply in dedicated because you have complete control), and this is important to know.
As at the time of this writing, there is a definitive line drawn in the sand in the Joomla! world about allowing or not allowing encrypted extensions. No matter which side of debate your feelings are, if you decide to purchase and use an encrypted extension, make sure in advance of your purchase that your host supports Zend or IONcube (depending on the app), or whatever means that may be deployed. If they don't, you will have to attempt to get your money back, change hosts or discover a method to make them work. Translation, do your homework in advance.
Your border security begins with the host where your site is residing. If you choose a poorly run host, then expect trouble, successful attacks, and more. That is not to say that a well run host is free from attacks. It just lowers some of the obvious problems.
Take time to learn all you can about the prospective host, but don't base your purchase on price and flashy sales pitches by the host.
Architecting for a Successful Site
Believe it or not, planning for your site rather than diving in will help you have a much more secure site. How, you may ask. Through careful planning, you can establish a path and a direction to get there. You can research the pitfalls and find ways to avoid them. Thus, you will be operating in the parameters of wisdom, which will enable you to depend on others' experiences, and learn from the mistakes that they made.
What Is the Purpose of Your Site?
If I had $1.00 every time a client said, "I need a website" and I asked, "What is it going to do?" I would probably be sitting on a beach drinking something with an umbrella in it rather than writing! Though seriously, it's more common than not. The answer is often not well thought out, thus causing many uncomfortable questions to be asked.
Here's a real life scenario: Customer "X" says that he works in the financial world and needs a 'secure' website. He needs to "securely" make available his highly confidential financial documents to his clients via the Web. "Security is very important to us" they stated multiple times.
OK—what would you ask if this were you? What steps would you take? Let's walk through this together and follow the trail of knowledge.
Eleven Steps to Successful Site Architecture
Step one: Define the current business practices that do not interrupt the business process flow. In other words, you want your website to reflect the most reasonable and currently established business practices, as closely as possible.
Step two: What will be the purpose of this site for your customers? Is it e-commerce? Is it a membership site? Is it a secure document repository?
Step three: If this is highly secure (read: e-commerce), have you researched the cost of the security (SSL) certificate for your site? If you are doing any type of financial transactions such as taking money, you will more than likely need an SSL setup. This can influence the choice of the hosts.
Step four: Where will you host? Is this your favorite nephew's "really-smokin' hot box" in his basement? Not a good plan. Is this a "free" host?—might be good, but hey, if this is important, spend a few dollars and get a solid host. Check the reputation for the host. Surf around and read reviews. You'll figure out quickly who's good and who's not.
Step five: If you need SSL, does the host you selected in step 4 support the inclusion of certificates? Can you buy a certificate from them? Believe me you want to check this one.
Step six: Draw out the functionality of the site you want. What it will do, what content it will serve, how the users and visitors should interact. After balancing out the three factors of ease of use, speed, and security, you can decide.
Step seven: Taking step six a bit further, what extensions will you need? Will you have one written? Two problems exist right away for either of these.
