thx for your good advices. the steps are good but there is always a possibility to leave a security hole open. i found out, that the attacker was able to perform some sql injections but i am escaping all params in the queries. i am a developer not a sysadmin
maybe i will try to give the hosting to a guy which knows what he is doing.
btw sorry to not answer your email: of course i will integrate your API but for now i am having nightmares and doing everything possible to secure my private things
yes we are facing some problems with some hackers which are permanentely trying to hack our servers.
someone was able to inject some javascript code into the website. dont know how so i moved the whole website to a new and clean server which is hopefully more secured!
i am also confronted with blackmails to my private email. its very sad to get hacked by some guys. i dont have any funds on the servers and i dont have some big income from cryptcoincharts so i dont know why i am the target
securing the server and changing all passwords is very time consuming, thats why i dont have time right now for doing any development work or support. sorry for that. i am losing faith in the bitcoin community.. it looks like there are more scammers than good guys.
i am thinking about selling the whole website. if someone is interested please email me at office (at) cryptocoincharts.info
There are a few simple ways to mitigate hack attempts: try use a CDN service like cloudflare and hide your server's ip behind it after you moved to a new server, it becomes much harder to locate your actual server's ip address; chown your source files so your php process or web server cannot modify your code; change ssh port number, and disable password login and allow key authentication only, or even use port knocking (knockd) to hide your ssh service.
Don't give up
It's ok, one thing at a time, we're not in a hurry.
A good server setup is always the basis of security, otherwise you can't even be sure it's your code that caused the problem. Once that is done, with proper logging, code level security issues like sql injections should be traceable at least.
About securing personal accounts, I'm not sure exactly what problem you're facing, but there's a lot of information in your domain's whois information like names and email addresses, which could be a starting point for attacks, so maybe use a different set of passwords for those email addresses from your personal accounts, and add something like domain privacy guard with your domain registrar.
Hope everything works out for you eventually.