Most people on the internet are good, honest people. However, there are some people browsing the internet who derive fun from poking around websites and finding security holes. A few simple tips can help you secure your website in the basic ways. Now, obviously, the subject of data security is a complicated one and way beyond the scope of this column. However, I will address the very basics one should do which will alleviate many potential problems that might allow people to see things they shouldn't.
Password Protecting Directories
If you have a directory on your server which should remain private, do not depend on people to not guess the name of the directory. It is better to password protect the folder at the server level. So let's look at how easy it is using Abyss Web Server to password protect a directory.
Firstly if you haven't already, you need to set yourself up as a User/Group. "Group" meaning, if you wish to give access to an outside party, the term name given "Group" is just a name for you to refer to...so...
Open your Abyss Web Server Console, Select which Host/Domain you want to configure and Select "Users and Groups". Select Add to either Users or Groups section.
Enter a User or Group name
Enter a Password
Confirm the Password
Open your Abyss Web Server Console, Select which Host/Domain you want to configure and Select "Access Control" option.
The path access edition dialog contains the following fields:
Virtual Path: The virtual path which contents' access is to be restricted. Use the Browse function to find the disered Folder. (many abyss users use this function to password protect their phpmyadmin directory)
Realm: A short description of the path's contents. It is prompted to users by the browser when it asks them for credentials. Example "My Database".
Order: The order that the server follows to check if access is granted to a user. If it is set to Allow/Deny, access is denied by default and is allowed only if the user is in the Allow for list and is not in the Deny for list. If it is set to Deny/Allow, access is allowed by default and is denied only if the user is in the Deny for list and is not in the Allow for list.
Allow for: The list of users and groups for whom access is allowed.
Deny for: The list of users and groups for whom access is denied.
Note:: If Deny for list is empty and the order is Deny/Allow, access is granted to all declared users and groups.
Turn Off Directory Listings
By default, any directory on your website which does not have a recognized homepage file (index.htm, index.php, default.htm, etc.) is going to instead display a listing of all the files in that folder. You might not want people to see everything you have on there. The simplest way to protect against this is to simply create a blank file, name it index.htm and then upload it to that folder. Your second option is to disable directory listing. In this case, the Abyss Web Server generates error 403 instead of a listing.

Remove Install Files
If you install software and scripts to your website, many times they come with installation and/or upgrade scripts. Leaving these on your server opens up a huge security problem because if somebody else is familiar with that software, they can find and run your install/upgrade scripts and thus reset your entire database, config files, etc. A well written software package will warn you to remove these items before allowing you to use the software. However, make sure this has been done. Just delete the files from your server.
Keep Up with Security Updates
Those who run software packages on their website need to keep in touch with updates and security alerts relating to that software. Not doing so can leave you wide open to hackers. In fact, many times a glaring security hole is discovered and reported and there is a lag before the creator of the software can release a patch for it. Anybody so inclined can find your site running the software and exploit the vulnerability if you do not upgrade. I myself have been burned by this a few times, having whole forums get destroyed and having to restore from backup. It happens.
Reduce Your Error Reporting Level
Speaking mainly for PHP here because that's what I work in, errors and warnings generated by PHP are, by default, printed with full information to your browser. The problem is that these errors usually contain full directory paths to the scripts in question. It gives away too much information. To alleviate this, reduce the error reporting level of PHP. You can do this in two ways. One is to adjust your php.ini file. This is the main configuration for PHP on your server. Look for the error_reporting and display_errors directives. However, you can also reduce the error reporting level using the error_reporting() function of PHP. Include this in a global file of your scripts that way it will work across the board.
Secure Your Forms
Forms open up a wide hole to your server for hackers if you do not properly code them. Since these forms are usually submitted to some script on your server, sometimes with access to your database, a form which does not provide some protection can offer a hacker direct access to all kinds of things. Keep in mind...just because you have an address field and it says "Address" in front of it does not mean you can trust people to enter their address in that field. Imagine your form is not properly coded and the script it submits to is not either. What's to stop a hacker from entering an SQL query or scripting code into that address field? With that in mind, here are a few things to do and look for:
Use MaxLength. Input fields in form can use the maxlength attribute in the HTML to limit the length of input on forms. Use this to keep people from entering WAY too much data. This will stop most people. A hacker can bypass it, so you must protect against information overrun at the script level as well.
Hide Emails If using a form-to-mail script, do not include the email address into the form itself. It defeats the point and spam spiders can still find your email address.
Use Form Validation. I won't get into a lesson on programming here, but any script which a form submits to should validate the input received. Ensure that the fields received are the fields expected. Check that the incoming data is of reasonable and expected length and of the proper format (in the case of emails, phones, zips, etc.).
Avoid SQL Injection. A full lesson on SQL injection can be reserved for another article, however the basics is that form input is allowed to be inserted directly into an SQL query without validation and, thus, giving a hacker the ability to execute SQL queries via your web form. To avoid this, always check the data type of incoming data (numbers, strings, etc.), run adequate form validation per above, and write queries in such a way that a hacker cannot insert anything into the form which would make the query do something other than you intend.
Conclusion
Website security is a rather involved subject and it gets a LOT more technical than this. However, I have given you a basic primer on some of the easier things you can do on your website to alleviate the majority of threats to your website.
Regards
Marty