If you are utilising the apache web server HTTP for your website hosting and you maintain that server, then you must consider the following points,
Turn on LOGS and installing mod_log_config. You can check the list of modules by this command : apache2ctl -M
Implement Firewall MOD_SECURITY module
https://modsecurity.org/ is an open source, cross-platform web application firewall (WAF) module. Known as the "Swiss Army Knife" of WAFs, it enables web application defenders to gain visibility into HTTP(S) traffic and provides a power rules language and API to implement advanced protections.
https://github.com/Rev3rseSecurity/wordpress-modsecurity-ruleset
Implement mod_evasive module
Disable Extra module which are not utilized to improve performance
Whenever we have a project/product to develop using LAMP stack, the following are the major factors in Platform stack version selection
Availability of software(PHP, MYSQL, APACHE)
Configuration/Setup of developer machines
Hosting server restriction
Skill set of employees
Let’s say you start an application today with the latest stable release of stack , then it will be outdated in a year or more as technology is updating regularly.
Q: – So the question is, is it necessary to update the product/ project or to guide your client about the required updates for that ?
My answer will be Yes.
Now you can question that do you understand the aftermath for this,
Upgradation requires the efforts
Effort includes Development effort, Testing Effort, Skillset of Resources
Effort create cost
So, are you sure you we should do the upgrades and guide our client for this.
I will again say , Yes.
Q: – So tell me Why it so necessary to upgrades while we can save the cost?
I will start with an example,
Think that you are a Civil Engineer, and you build the bridges. Let’s say you build a bridge, and ask yourself, is this one time job to build that bridge or owner need to maintain that half-yearly/yearly/bi-early/ so that it stay for long and secure.”
Mainly, There are two types of upgrades
Major : It may require refactoring of application [Generally Call Upgrades]
Minor : In 90% of cases, minor updates does not break anything, that is an improvement or fixes of bugs of any software.[Generally called Updates]
So, Minor upgrades does not include a major cost, however, major upgrades may have major cost factor.
If you are concerned about the security or your application includes the payment, I will recommend that you must have your application stack up-to-date, However, My Practical experience will suggest you to do the upgrades once it is stable and you had the review/feedback from the market so that your have more visibility in advance before updating.
Q:- It may be that your application does not contain any payment information, so do you still need to update that?
Yes, it is advised to keep your application updated to keep it less vulnerable ( I am saying less as upgrades itself can’t prevent all the loopholes), To protect your user data and your valuables and it can save a lot money from ransomware or hackers.
So is this all about security ?
No this is more than security,
Up-gradation provides protection from existing loopholes, apart from that, It also helps you in optimisation the performance of your site.
You can see that how much the up-gradation help in optimisation and resource utilisation that is also a cost saving for long term. So your cost of up-gradation can be covered from here while you utilise all the benefits of up gradation.
This is also not about PHP only. You must upgrade all the stack from time-time where it is OS , Apache Web server or Mysql.
Every Software has their END OF LIFE and upgrades cycle and it is different for each software. How ever One must deploy all the security and BUG Fixes patch time-time that does not require major effort and before the END OF LIFE of that software one must upgrade the software.
Following articles shows how the cyber attacks cost the company
Cybercrime will remain a large-scale concern for years to come. From 2019–2023E, approximately $5.2 trillion in global value will be at risk from cyberattacks, creating an ongoing challenge for corporations and investors alike https://www.weforum.org/agenda/2019/11/cost-cybercrime-cybersecurity/
Make sure to check the support from Vendor for your software.
