Move website updates to a current, supported computer before Windows 7 support ends on January 14, delete saved passwords from old FTP programs and browsers, then change every hosting and site password from the new machine.

The computer in the back office

In many small businesses, the website is updated from one particular computer: a desktop in the back office, bought around 2012, that has always worked.

It runs Windows 7. Internet Explorer 11 stays on it for one supplier's ordering portal. An older copy of Firefox holds the website's login, saved years ago.

There is also an FTP program, the kind used to upload files to a web server, with the hosting password saved inside it by whoever built the site.

Nobody thinks of this machine as part of the website. In practice it is the website's front door.

What January changes

Windows 7 reaches the end of Microsoft's support on January 14. After that date, most computers running it get no more security fixes, however serious the problem found.

Internet Explorer on those machines stops being fixed with it. Other software makers will stop supporting Windows 7 over time, so the programs on it age too.

The computer will still work on January 15, which is the trap. Nothing looks different, and every weakness discovered from then on stays open.

What sits on that machine

The first is what turns a problem on one computer into a problem on the website. A saved password is only as safe as the computer it is saved on.

How a desktop problem reaches the website

Some malicious software is built specifically to collect saved passwords. It searches the places common FTP programs and browsers keep them, and sends what it finds elsewhere.

With those details, an attacker does not need to break into the website. They log in as the business and upload whatever they like: spam pages, a redirect, code that infects visitors.

To the host it looks like a normal login with the right password. Nothing is blocked, because nothing looks wrong.

An unpatched computer that opens email attachments and visits the odd bad site is exactly where that kind of software tends to land.

Plain FTP and its saved passwords

Plain FTP is older than most of the businesses using it. It sends the username and password across the network unencrypted, readable by anything listening along the way.

SFTP does the same job over an encrypted connection, and most hosts support it. Switching is usually a setting in the same program.

Many sites no longer need FTP for routine work at all. Pages, images and updates can be handled through the site's own dashboard and the hosting control panel, both over HTTPS.

Then look at the FTP accounts in the control panel. Old ones, made for a previous developer or a one-off job, should be deleted.

The browser that stays logged in

WordPress and most other systems offer to keep you logged in. On a shared office computer, that makes anyone at the desk the website's administrator.

A browser that saves passwords without a master password protecting them makes the same offer to anything that gets onto the machine.

On any shared machine, log out of the dashboard after each session, and give each person their own login so changes can be traced.

Internet Explorer 11 is the riskiest of the lot after January. If one supplier's portal truly requires it, use it for that portal and nothing else, never for the website or email.

A worked example

A family-run building supply yard updated its website from the yard office computer: Windows 7, rarely restarted, used by four people under one account.

In the spring, the host suspended the account for sending spam. Its logs showed a mailing script and a folder of spam pages uploaded by FTP, with the correct password, from a connection overseas.

Nobody at the yard had shared the password. It had sat in the FTP program since 2014, and the office computer turned out to be carrying password-stealing software that its out-of-date antivirus had missed.

The site was restored from a clean backup. The yard replaced the computer, wiped the old one, and changed every password from the new machine: hosting, FTP, the website, email and the domain registrar.

Plain FTP was switched off, SFTP is used only by the web company, and staff now update the site through its dashboard, each with their own login.

Replacing the machine

The simplest answer for most offices is a new computer running Windows 10, set up with separate user accounts and a current browser that updates itself.

Move the documents across, but not the old programs' saved logins. Treat those passwords as known to someone else, and change them rather than carrying them forward.

Then deal with the old machine properly. Before it is sold, donated or recycled, its drive should be wiped, or it leaves the building with every password the business ever saved on it.

The counter-case

Some computers cannot be replaced by January. A machine running old accounting software, or controlling equipment in the shop, may need to stay on Windows 7 for a while.

That can be managed, as long as it is never used for the website, email or banking, and ideally stays off the internet. Microsoft is also offering businesses paid security updates for a limited period, as a bridge.

A business whose site is updated only by its web company, from the company's own machines, is less exposed. The office computer still holds the email that resets every other password, though.

For everyone else: move website work to a supported computer, and change every password the old one knew.

Before January 14

  1. List every computer that logs into the site.
  2. Replace or upgrade any still on Windows 7.
  3. Delete saved logins from old programs.
  4. Change every password from the new machine.
  5. Switch plain FTP to SFTP or the dashboard.
  6. Delete FTP accounts nobody uses.
  7. Wipe old computers before they leave.

Step four matters most, because the old passwords may already be known. Changing them from a clean computer closes that door; changing them on the old one may simply hand over the new ones.

Why that same office computer is a poor guide to what customers see is covered in the browsers your customers use this year.

Frequently asked questions

When does Windows 7 support end?

On January 14, 2020. After that, most computers running it receive no more security fixes, and Internet Explorer on those machines stops being fixed with it.

Why is the office computer a risk to the website?

It often holds the hosting and website passwords, saved in an FTP program or browser. Malicious software on that computer can collect them and log in as the business.

What is wrong with plain FTP?

It sends the username and password across the network unencrypted. SFTP does the same job over an encrypted connection, and most hosts support it.

Do I still need FTP at all?

Often not for routine work. Pages, images and updates can usually be handled through the site's dashboard and the hosting control panel, both over HTTPS.

Why change passwords after replacing the computer?

Because the old machine may already have leaked them. Change them from the new, clean computer, so the new passwords are never typed on the old one.

What should happen to the old computer?

Wipe its drive before it is sold, donated or recycled. Otherwise it leaves the building carrying every password the business ever saved on it.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Website updated from a Windows 7 machine?

Tell us which computer your site's logins live on. We will help move them and change every password before January.

Start a Conversation