Security – Clarkes.Team

World Backup Day: Why It Is Vital For You To Backup Everything

Fortune Aganbi — Mon, 31 Mar 2025 13:30:50 +0000

Some things can be replaced—like a phone, a computer, or furniture. But when it comes to your website’s files, a single mishap without a proper backup can mean losing everything!

Many people believe their digital data is somehow “safe,” only to learn the hard way how devastating it is to lose irreplaceable work. That’s precisely why World Backup Day exists: to remind us that safeguarding our digital assets is just as important as locking our front doors. Raising awareness about the importance of backups; according to a report published by World Backup Day, 21% of people never back up anything. That’s a scary statistic, given the constant risk of data loss. Another report shows accidents cause 29% of data loss cases! Life is unpredictable, and you cannot always tell whether something will go wrong. What we can do, however, is prepare for unexpected circumstances. So, what exactly is World Backup Day, and what does it represent?

What is World Backup Day?

A backup is a copy of your data saved outside your primary device, which you can restore anytime. Your data can include anything from work files to personal items like family pictures, eBooks, and messages. In simpler terms, a backup is a copy of your important data saved somewhere safe where you can always access it if and when needed.

Why Should I Backup Everything?

Accidents Happen

Accidents happen constantly and are often beyond our control. If an accident like a fire or entering a wrong command that wipes out your most crucial data, you may NEVER be able to recover them again. But with a backup, you can mourn the unfortunate incident and restore all the lost files from the backup location.
Malware Attacks Are Rampant

It would shock you to discover how many computers are infected by malware daily. A malware attack could lead to data theft and corrupted files. A backup is handy in this case, as you can recover all affected files.
Theft

People who steal usually target valuable items. You will lose your data if you lose your computer or phone to theft. But with a backup in place, you will not feel the brunt of this much.
Sense of Security

Backing up everything gives you a sense of security, knowing that no matter what happens, your data is stored somewhere safe and easily accessible. So, instead of spending valuable time worrying over the safety of your files, you can channel your energy towards more productive things.

Best Ways to Back Up All Your Files

External Drive:

Buy an external drive with enough capacity for current and future files. Multiple drives can help organize data. Keep the drive safe so you can recover files if your computer fails.
Cloud Backup: Upload files online to access them anywhere with an internet connection. This method is fast, convenient, and popular (e.g., Google Drive, AWS).

So now that you have backed up all your important data and are equipped with all the vital backup information, what next? You must also ensure your friends, family, and even strangers know backups. You can share this post with them so they understand what it means to backup. You can help those who need help understanding how to backup their files, such as your parents or kids. Lastly, you can learn the World Backup Day Pledge and recite it regularly.

What is the World Backup Day Pledge?

The WBD pledge goes as follows:

“I solemnly swear to back up my important documents and precious memories on March 31st.”

If you found this post helpful, share it with your loved ones.

Happy World Backup Day!

Do you need expert help maintaining a good backup integrity for your business websites?

Contact Us For A Consultation

Important Alert: Is Your Adobe Commerce or Magento Store at Risk?

Steven Clarke — Wed, 23 Oct 2024 20:12:14 +0000

If you’re using Adobe Commerce or Magento to run your e-commerce shop, you need to be aware of a new and severe security threat called the CosmicSting exploit. Security researchers say nearly 5% of all Adobe Commerce and Magento stores have already been compromised. 5% is a massive number of websites, considering Magento is used by over 670 million websites. This is affecting store owners worldwide, and the number of attacks continues to grow every day.

What is Magento?

Magento is a very popular, open-source e-commerce software platform used by many businesses to build and manage online stores. Think Shopify or Woocommerce—it’s competing software to power your e-commerce brand. Magento is part of Adobe Commerce, which helps businesses with everything from handling payments to managing customer accounts. Many online retailers prefer Magento because of its flexibility and wide range of features.

Unfortunately, just like any other system, Magento is also vulnerable to attacks if not properly updated and maintained. We stress routine maintenance here at Clarkes.Team to ensure you don’t have these issues.

What’s Happening?

A dangerous flaw (labeled CVE-2024-34102) was discovered in Adobe Commerce and Magento, which hackers are now exploiting. Malicious attackers can exploit this vulnerability to gain access to your store’s most sensitive information, including customer payment details. Once inside, they can use this information to steal data or even take over your entire store.

In fact, this flaw is so critical that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added it to their list of Known Exploited Vulnerabilities, urging all store owners to take immediate action.

What Can You Do to Protect Your Store?

If you run a Magento or Adobe Commerce store, simply updating your system isn’t enough to fix the issue. You also need to take extra steps to ensure your store is secure. Here’s a simple guide on what you should do:

Scan Your Store for Malware:

Use a server-side malware scanner to detect if your store has already been compromised. We have several scanners that we use if you need assistance with this step.
Upgrade Your Magento Version:

The latest version of this software, Magento 2.4.7-p3, includes the patch for this vulnerability. You should aim to always stay on the latest & greatest version.
Rotate Your Encryption Keys:

Even after upgrading, hackers may still have access to your store if you don’t change your encryption keys. This is essential for securing your site.
Disable Old Encryption Keys:

After rotating your keys, manually disable the old ones to prevent attackers from using them to access your store.

Need Help?

Securing your store can be time-consuming and overwhelming, especially if you’re not familiar with the technical side of things. That’s where we come in! At Clarkes.Team, we specialize in keeping your online store safe and running smoothly. If you’re concerned about this Magento vulnerability and need assistance making sure your store is fully protected, read more about the details here or reach out to us for professional help. We can handle all the technical work for you, ensuring your store stays secure.

Don’t wait until it’s too late—take action today to safeguard your business and protect your customers from potential data theft. Contact us today.

Contact Us For A Consultation

Understanding DMARC: Why Gmail & Yahoo Now Require It

Fortune Aganbi — Mon, 29 Jul 2024 16:24:52 +0000

Google and Yahoo have mandated that users who send bulk emails abide by email authentication policies to ensure optimal delivery. Their new policies prioritize DMARC, DKIM, and SPF authentication methods.

Here at Clarkes.Team, we ensure that our clients’ businesses run efficiently and securely. One of the ways we do this is by setting up email authentication methods for our clients to help boost their email deliverability. We want to help ensure your emails reach the INBOX of your recipients instead of getting lost in SPAM! One method we use is setting up a proper DMARC record. The rest of this post will focus on answering some of the questions many of our clients ask…

What is email authentication and why does my business need it?
What exactly is DMARC and how does it operate?
Why do email services like Gmail and Yahoo require it?

What is Email Authentication?

Email authentication is a process that email receivers use to ascertain the authenticity of an email sender or the source of an email. The reason for this is not far-fetched; the internet is teeming with phishers and spammers – 36% of all data breaches include some form of phishing! If you run a business that requires you to send bulk emails, email authentication protocols are even more critical. Email authentication ensures that the emails your customers receive from your business or domain name come from you, not a defrauder posing as you. The most common email scams that authentication shields you against are:

Phishing: Phishing is email scams sent from cybercriminals using the identity/address of renowned companies and individuals to entice unsuspecting customers to reveal their personal information or click on suspicious links. One would expect that the number of victims who fall for these scams every year would drop with the widespread awareness about email scams. Unfortunately, that is not the case – phishing scams are becoming more common. Phishers are getting more innovative with their methods, emphasizing the need for email authentication.
Spamming: If you have ever received numerous unsolicited messages from the same sources, you most likely have been spammed. Without the correct authentication practices, spammers can impersonate you or your business to send messages to your customers to divert traffic to their sites or adverts.
Email Spoofing: Spoofing occurs when someone creates a fake email address that imitates a legitimate one to send messages to people. The aim is to deceive the victims into taking harmful actions. Spoofing can involve both phishing and spamming practices.

Benefits of Email Authentication

There are many benefits to correctly authenticating your emails. Here are at least four benefits you will experience with the correct email protection policies:

Boosts Your Brand Reputation: In the business world, having a bad reputation is one of the fastest ways to go down. Negative news spreads rapidly, potentially eroding customer trust and loyalty. However, if your email authentication is effective, you can foster stronger connections with your audience and enhance their perception of your services.
Protects Your Customers: Email authentication is a powerful shield against scams, ensuring your customers receive only genuine communications from you. Anybody who attempts to send suspicious emails will have difficulty getting to your customers. Additionally, email authentication protects your customers’ sensitive information.
Compliance with Industry Standards: Many email service providers require email authentication methods to let users send emails securely to their recipients. This promotes compliance with regulatory bodies such as HIPAA (Health Insurance Portability and Accountability Act) and GDPR (General Data Protection Regulation).
Boosts Email Deliverability: You want to ensure that your recipients get the correct email and that your emails do not end up in their spam folders. With the right email authentication tools, you can boost email deliverability by a large percentage.

Ready to fortify your email security with DMARC? Connect with us now to set up DMARC protection and ensure your domain’s integrity.

Contact Us For A Consultation

Now that we understand what email authentication is, what it protects against, and what its benefits are, let us explore the types of authentication available below.

Email Authentication Methods

There are three common types of email authentication methods. Everyone who employs email marketing as part of their business strategies should at least have one of these methods in place:

SPF: SPF, which stands for Sender Policy Framework, is an email authentication method that verifies the IP address that an email is sent from against several registered mail servers from the sending domain to ensure it comes from an approved address. In other words, there is a list of IP addresses your business authorizes to email customers.

When you register any of these addresses with SPF, any email that comes through them from your domain will be successful. SPF reads the email address as authentic. However, if someone attempts to send your customers an email from a fake version of one of those addresses, SPF will detect it and stop it from reaching them.

For example, you run a business called Abc Skin Care. The domain name of this business is abcskincare.com, and the following addresses are intended for sending emails to customers using your domain:
- admin@abcskincare.com
- customerservice@abcskincare.com
- staff@abcskincare.com
Now, anyone can use the above addresses to email your customers by impersonating your business. However, once the proper SPF records are added to your DNS records, you ensure that only your legitimate senders make it to your recipient’s inbox. Any emails that do not pass this SPF verification will end up in your recipient’s SPAM box.

We recommend pairing SPF with DKIM and DMARC for maximum protection.
DKIM: Also known as DomainKeys Identified Mails, DKIM is an email authentication method that uses cryptographic keys generated for a domain to verify emails on the receiving end. The DNS records of your domain store these public and private digital keys. DNS records are records in a domain containing information that tells email receivers how to handle messages from that domain.

Email receivers like Gmail and Yahoo use the public keys configured in your DNS records to authenticate the email you send from your domain.

DKIM ensures that scammers do not intercept and manipulate your emails in transit to trick your customers.

In simpler terms, these keys are your domain’s unique signature for verifying emails. Not only does your DKIM signature (keys) tell the receiver that the email is from your domain, but you approve it as the domain owner. This transaction is often done between the domain and receiving servers within seconds. If the receiving end cannot verify the signature, it flags the email.

DKIM is an effective way to enhance email security. Setting up DKIM requires technical expertise and meticulousness. If you have zero specialized experience with email authentication methods, you can contact us. We are verified professionals who can help you before it’s too late.
DMARC: DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. As the name suggests, DMARC is a security protocol that ensures that emails received by recipients from your domain address are legitimate. DMARC records contain instructions on how email receivers like Gmail should act on an email.

In addition, it allows you to monitor emails you send from your domain to learn and adapt to your emails’ interactive patterns, which can help it perform better in eradicating high-risk ones.

When your recipients’ mail servers receive emails that are not properly authenticated using SPF & DKIM, the DMARC record can instruct it to take one of three actions: do nothing, quarantine the email, or outright reject it.

For example, if you run a business with the domain name abcskincare.com, you expect every customer on your mailing list to receive emails from that domain. However, unauthorized third parties, such as hackers, can sometimes hijack this domain name to send tricky emails to your clients. If they succeed, your clients will fall victim to spoofing and likely report your domain. Either way, this could negatively impact your business.

If DKIM is in place, depending on what you have instructed it to do, it will prevent the ‘bad’ emails from reaching your customers’ mailboxes.

The following section will explore how DMARC policies work and why Google and Yahoo now require them.

Why is DMARC Important?

At the beginning of February 2024, Yahoo and Gmail began to enforce their new email authentication requirements. For bulk users – those sending to more than 5000 accounts daily, senders to Gmail and Yahoo must have the following in place to ensure seamless email deliverability and security:

Provide a one-click unsubscribe button for their end-receivers.
Implement DKIM and SPF methods.
Messages must pass DMARC alignment.
Businesses must implement DMARC policies.

But what are these DMARC policies, and why are Google and Yahoo insisting on them?

DMARC Policies

Despite the increasing awareness of email scams and internet fraud, more and more businesses continue to fall victim. Therefore, to protect their customers and reduce the risk of email phishing, spamming, and spoofing, Google and Yahoo became more stringent with their authentication policies.

These new requirements emphasize DMARC policies and threaten non-compliant users with poor email deliverability. If you have yet to implement these policies, don’t panic. There is still time to do the right thing. Nevertheless, it is essential to learn more about these policies.

When you set up DMARC, you authorize it to act on suspicious emails on your behalf. There are three actions it takes: none, quarantine, and reject.

None: The none policy is also known as the monitor policy. Often used by newcomers to email marketing, the none policy ensures that DMARC screens every email your customers receive before it gets to them. However, it will allow every email to reach their inbox regardless of whether they are authentic or not.
Quarantine: When you select the quarantine policy, you instruct DMARC to stop suspicious emails before they reach your recipients. Instead of proceeding to their mailboxes, these emails end up in the spam folders, i.e., quarantined.
Reject: This option is more rigid, especially for established businesses. When you choose the reject policy, DMARC rejects any email that doesn’t pass authentication and prevents it from getting to your receiver’s inbox or the spam box. That is, they will never receive such an email.

Which DMARC Policy Should You Choose?

One of the advantages of setting up DMARC for your business is that regardless of your chosen policy, you will always receive informative reports on your email activities.

Each DMARC policy is applicable, and picking the right policy depends on factors such as the size of your business, your experience with email authentication and security, and your target recipients. Jumping on the reject policy could complicate things if you are just starting.

The reject policy has stricter rules and, if not configured properly, can hinder legitimate emails from getting to your customers’ inboxes. So, we usually recommend starting with the none policy and gradually moving to the next when needed. Numerous businesses are rushing to set up their DMARC policies before it is too late.

Get ahead of your competitors by setting up your DMARC policy now. Have no clue how to do that? Don’t worry; we can get it done for you. Just CLICK HERE to schedule a consultation to get started!

Consequences of Ignoring Gmail and Yahoo DMARC Requirements

There are consequences for non-compliance with Gmail and Yahoo’s requirements. These email services are serious about their new policies, and if you want your business to continue thriving, we recommend adherence. Your company may suffer these consequences if you don’t set up DMARC as soon as possible:

Poor Email Deliverability: The last thing you want is for your emails to arrive late to your recipients. You also don’t want your bulk emails to be marked as spam or not delivered because you don’t have the proper authentication methods.
Security Vulnerability: By not obliging with Gmail and Yahoo’s requirements, you invite scammers to feast on your business and customers. You risk losing your business to harmful third parties and exposing your customers’ personal information to threats.
Poor Reputation: Without DMARC policies, your customers will likely fall victim to phishing, spamming, and spoofing. This can undermine years of hard work you already put in. And, of course, soil your reputation.
Loss of Money: Failure to comply with Gmail and Yahoo’s DMARC policies could lead your customers to receive notifications about your non-conformance for every email they receive from you. The result is a lack of trust, resulting in loss of customers and money.

We have learned the importance of email authentication and why it is super important. Choosing the right DMARC policy is pivotal in fortifying your organization’s email security. By understanding the nuances of each policy, assessing risk tolerance, and adopting a phased approach, you can strike the right balance between security and deliverability.

Schedule a consultation with us to set up email authentication and DMARC for your business. We have extensive experience in email security and setting up DMARC records. We will advise you on which policies are best for your business and help you set them up.

Upgrading to Cloudflare’s New WAF

Steven Clarke — Thu, 04 May 2023 04:00:38 +0000

What You Need to Know and How We Can Help

TLDR: Cloudflare has released a new Web Application Firewall (WAF) and is phasing out the old managed rules on May 1, 2024. Migrate to the new WAF or contact us for help.

In today’s digital age, website security is more important than ever before. That’s why Cloudflare, a leading provider of internet security and performance services, has recently launched a new and improved Web Application Firewall (WAF) that offers better protection and enhanced functionality.

However, this update means the existing managed firewall rules will deprecate on May 1, 2024. As a website owner, it’s essential to migrate to the new WAF before the old rules become obsolete. In this blog post, we’ll cover what you need to know about the WAF upgrade and how our team can help you with the migration process.

In This Article

What You Need to Know and How We Can Help
What is Cloudflare’s Web Application Firewall (WAF)?
Why Upgrade to Cloudflare’s New WAF?
How to Upgrade to Cloudflare’s New WAF?
How Can We Help You?

What is Cloudflare’s Web Application Firewall (WAF)?

The Web Application Firewall (WAF) is a critical component of Cloudflare’s security services. It acts as a protective barrier between your website and potential threats, filtering out malicious traffic and preventing attacks like SQL injections, cross-site scripting, and more.

Cloudflare’s WAF is powered by a set of preconfigured rules called Managed Rules, designed to identify and block the most common types of attacks. Additionally, it allows you to customize rules specific to your website’s needs.

We are here to help you properly audit and configure your Cloudflare deployment to ensure you have best practice security and performance optimization in place. If you need assistance with your Cloudflare setup, do not hesitate to seek expert help. Clarkes.Team specializes in server & website management, security & performance optimization solutions.

Contact Us For A Consultation

Why Upgrade to Cloudflare’s New WAF?

Cloudflare’s new WAF includes a host of new and improved features, offering better detection and mitigation of known bad traffic, more flexible exception handling for Managed Rules, and full wirefilter syntax support for Rate Limiting. The upgrade provides better action customization with Custom Rules and a unified API for all these products.

Every Cloudflare customer has access to the new products at no additional cost. However, the old Managed Rules, Firewall Rules, and Rate Limiting Rules have entered a deprecation phase that will last one year. During this time period, these products are fully supported, but you are strongly advised to migrate to the newer version before May 1, 2024.

How to Upgrade to Cloudflare’s New WAF?

To migrate to Cloudflare’s new WAF, follow these steps:

Migrate WAF Managed Rules by visiting the dashboard at Security > WAF > Managed Rules and following the instructions. Note that Managed Rules are not available to Free zones.
Recreate your Rate Limiting rules in the new system and delete the old rules. You have access to both Rate Limiting products under Security > WAF > Rate Limiting.
Firewall Rules have already been migrated to Custom Rules (Security > WAF > Custom Rules) for all Free, Professional, and Business customers. No further action is required. In the next few weeks, all Enterprise customers will be automatically migrated as well.
If you are an API or Terraform user, you will need to update your automation to use rulesets.
If possible, we recommend that you recreate your Zone Lockdown and User Agent Blocking rules using Custom Rules.

How Can We Help You?

At Clarkes.Team, we understand that migrating to a new WAF can be challenging and time-consuming, especially for businesses that rely on their website’s security. That’s why we’re here to help you through the entire process, from start to finish.

For our proactively managed clients, we’re already working diligently to migrate your configuration to the new WAF. We’ll keep you informed throughout the process and answer any questions you may have.

If you’re not an active client and need help, don’t hesitate to contact us for a consultation; we’d love to help!

Your Domain is Vital

Fortune Aganbi — Thu, 13 Apr 2023 14:25:18 +0000

Your Domain is Vital – Do Not Lose It!

Imagine waking up one morning to discover your customers can no longer reach and interact with your website. No new leads and SEO is plummeting! To your dismay, you realize that your domain name has expired and been acquired by someone else. Now, all the hard-earned traffic that used to go to your site is going to the new owner of your domain!

We know it sounds scary. It happens all the time. This is why we aim to prevent you from becoming a victim. We have written this article to remind you how important your domain is to your brand image, growth, and reputation. If you lose it, you may never get it back or may have to pay more to get it back, in some cases, acquiring legal services.

Why Your Domain is Vital to Your Business

Domain names are much more helpful to your business than you think! When planning an online business, the domain usually makes up a considerable part of the process. Websites are the rave right now. You need a website to represent your business adequately on the internet. But having a website is not enough. To build a website, you need to buy a domain name. And the domain name you acquire should match your business name. This ensures more access to your business and, of course, more comprehensive visibility.

This is why after securing a unique domain, you must ensure that you never lose it. Except, of course, you decide to go out of business entirely. It is even more critical if your business targets a large audience and aims to be around for a long time. Getting a domain name is not difficult—register or contact a hosting provider to write one for you. There are two main reasons why your domain is essential to your brand:

A domain is your identity and address on the web. If you do not own one, people cannot find you.
A catchy domain name is good for business and traffic.

It is essential to understand that you cannot own domain names as your personal property. It is more like a name available on the internet that you borrow for use for a certain period. When you register it, it becomes available to only you; nobody else can use it without your authorization. This is why it is crucial not to let your domain expire. Because the moment it does, it becomes available again on the web, and anybody else can use it before you make moves to renew it. Let us look at some ways you can secure and protect your domain.

Struggling with domain issues? Reach out to the experts at Clarkes.Team for fast, reliable solutions!

Contact Us For A Consultation

How to Protect and Secure Your Domain

Your domain is like your business address in real life. People visit because they know you have what they need. So, it should always be protected and secured. Here are some known ways you can protect your domain names:

Pay close attention during the registration. Whether doing it through a hosting service or registering yourself, ensure you do proper research and pay attention to administrative details. You must ensure you are registered as the owner or registrar of the domain name you are acquiring. Your legal representation should be written as the acquirer of the domain name. This will protect you in case any disputes over your domain name arise.
Beware of spammers. Hackers are always active. Someone with bad intentions for your business could camouflage your domain name registrar and try to interact with you to get essential details used to hurt your business.
Be cautious of expiration dates. Often, after registering a domain name, we move on and forget that there is an expiration date that we must remember. It is essential to know when your domain will expire so that you will already have a payment plan to renew it when the time approaches. If possible, you can set a reminder for it on your calendar.
Communicate with your domain name registrar from time to time. This helps keep you up to date about your domain’s lifeline.
Ensure you have a strong password to protect your account. This helps to keep out intruders and hackers.
You can lock your domain from being transferred, modified, or deleted without your prior knowledge.

What Will Happen if My Domain Expires?

If you allow your domain to expire, you risk losing the online business you worked hard to build. But there is no need to fret just yet. If you forget to renew your domain name registration and it expires, there is usually a grace period between 14 to 30 days that you can use to restore it. You may lose your domain entirely if you fail to renew your registration within this grace period. Also, many hosting providers send out alerts to their customers when their domain subscription is nearing the expiration date. You should always keep a close eye on your email and take action immediately after you are alerted about your domain expiration date.

If you somehow miss this alert and the grace period after expiration, someone else will have access to your domain name! But prevention, they say, is a lot better than looking for a cure. So, rather than risk it, it’s best to ensure your domain never expires. We have put together some useful tips to help ensure that your domain does not pass in case you forget to renew it!

How to Prevent Your Domain from Expiring

Set up autorenewal for your account. You can do this with your domain name registrar. When you set up your account for autorenewal, the domain registration automatically renews when it expires. With this, you do not have to worry about remembering to renew your domain. Just ensure you have a viable payment method in place so that when the autorenewal happens, you will have no issues with payment.
Pre-pay for multiple years. With this option, you can decide to pre-pay for as many years as possible so that you do not feel disturbed about the expiration date for a very long time. However, you must ensure you do not forget the date your subscription will end.
Check if your email address associated with the domain account is active so that you can take appropriate action if you are sent an alert warning that your domain is about to expire.

If you found this article helpful, we are glad we’ve been able to save you the torture of losing your domain. However, if you are faced with any technical issues on your website, you should immediately consult our team of IT experts.