Security issues are among top business priorities, with 80% of the State of CMS Security report respondents confirming this. Cybercriminals cause a lot of stress to CMS users: more than half of respondents claim to experience security issues at least once a month, while 7% - daily. Given that, it’s hardly surprising that two third of respondents are concerned with their CMS security.
Can you entrust your data to your CMS? Depends on which one you choose. While almost 80% of CMS users believe their CMS providers address security issues seriously enough, it’s best to take a closer look at the level of security implemented before choosing your website’s backend.
In this article, Convergine, a Verified Craft CMS Partner, explains how Craft CMS protects your data and compares its security features with other CMS.
How Does Craft CMS Ensure Your Data Security?
Giants like Microsoft, Netflix, Apple, Adobe, Dell, and McDonald’s use Craft CMS for content management. Out of many other reasons like convenience and user-friendliness, they may choose this very CMS because of the following built-in security features.
Cyberattack protection measures:
- PDO for database queries to prevent SQL injection attacks
- CSRF token validation to prevent CSRF attacks
- HTML entities that escaped automatically to avoid XSS attacks
- The user agent string is stored in identity cookies to prevent session hijacking
- Time-safe methods are applied for sensitive comparisons (for example, to check if the password hashes are the same) to combat timing attacks
Files and cookie protection measures:
- Private key to validate sensitive cookie data
- HTML purifier and SVG sanitizer to clean untrusted HTML and SVG files
- Images are resaved to prevent malicious code embedded in them
- In the case of default folder structure, application files are stored above the web root, and a warning is sent out if the system fails to do so
User verification measures:
- New email addresses are verified before being accepted
- User accounts with too many unsuccessful login attempts are temporary suspended
- Permission-based access
Password security measures:
- Verification codes and password reset tokens are cryptographically secure
- The Native PHP password_hash() method (if available) is used to provide the Blowfish algorithm. If not available, PHP’s native crypt() method is used with a strong, cryptographically secure random salt
Is Craft CMS More Secure Than Other CMS?
In an array of CMS platforms to choose from, security should become one of the main deciding factors. Craft CMS is believed to be far more secure than its competitors. Let’s find out whether it’s true or not.
- Unlike other CMS, Craft CMS features exceptional security credentials. While other CMS like Drupal also offer permission-based access and private keys for enhanced data protection, Craft has addressed user verification and data protection with more than one initiative (mentioned above).
- Craft CMS doesn’t rely heavily on third-party content. While, unlike WordPress, it has a small developer community, a minimal amount of third-party content ensures higher security. WordPress that offers you a plugin for anything and everything undermines its data privacy this way. Although WordPress’s core is regularly maintained and updated, the plugins embedded into the platform may be poorly built, outdated, and even abandoned. This leaves an opportunity window for attackers to take over the website and use it for their malicious intent.
- Craft CMS handles all the sensitive data and code properly. WordPress, for example, allows you to access the code right from the CMS by default. To disable this, you need to edit a configuration file or install a security plugin.
- According to CVE, Craft CMS has experienced 21 vulnerabilities since 2017 to date, while Drupal – 90 and WordPress – 121. Interestingly, WordPress was far more vulnerable five years ago, with the number of incidents declining in the two recent years. The opposite is true for Drupal. All three CMS suffer the most from XSS attacks, making it a key security challenge to overcome.
Final Thoughts
To entrust your data to a CMS or not to entrust, that is the question… It’s important that you come up with an answer only after examining security measures undertaken by the provider.
After examining Craft CMS security, it’s clear that the developers spent a lot of time and effort ensuring that your website and data are protected. This CMS addresses all the major security loopholes, including the most common attack vectors, data and cookie protection, user verification, and many others. It may explain why Craft CMS has faced fewer vulnerabilities than its competitors over the past five years.
