I'm amazed at how often hackers try to get into my sites.
What tools/websites do you use to keep them out?
Haha this is a big topic. Unfortunately, there's not really a "security" package that devs can just import to make their app secure. Security comes from doing a lot of different things right.
You might want to checkout the Web Application Hackers Handbook. It's written from the perspective of a "hacker" describing how to probe a site, find vulnerabilities, and exploit them. It gives a good sense for all sorts of different attack vectors an app might have. Some big ones are :
OWASP publishes a top-10 list of common web app security vulnerabilities you may want to checkout: https://owasp.org/www-project-top-ten/
Thanks for the excellent reply. Much appreciated.
thanks for the feed back.
TLDR answer - it depends;
There is a lot you can do to yourself and with a lot of free/open source tools. ie, google "Pen Testing"
If you are a developer and I guessing you are since you posted to the Developer forum, then you should be thinking about security with everything you are building.
Are you using a cloud provider (AWS, Azure, etc) - they provide a lot of guidance and definitely worth a read.
Security is much more about mitigating risk rather than 100% secure gate that no one will ever get through. Don't assume you won't be hacked but think about what is the worst that can happen when they do.
Is your data (including backups) encrypted? Are the encryption keys right next to the data so if someone has one they can easily get the other. Do you have open ports that shouldn't be? Do you have passwords just lying around or in config files or in source control?
If you don't feel confident doing it yourself - the price you pay for professional could save you a lot of time and money in the long run.
This of course depends a lot on what you are running. With the amount of information you gave us there's no way to help you.
The easiest way is to build things in a way that there's nothing to attack, use static pages where possible. Don't expose your database directly and maybe materialize your data into a static format and serve that (also makes it easier to cache).
Use pre-made tools instead of re-invent things yourself (Customer support platform, Payments, use a framework that takes care of small things (input validation, XSRF tokens, authentication). If you run a blog on Wordpress maybe use a hosting service that has a team of professionals making sure it's updated and hosted correctly.
There's a lot of ways to shrink your surface area with smaller changes. There's no thing as 100% secure so sometimes these just have to be "good enough".