In light of the recent cyber attacks against other FPL 3rd party websites, we thought it prudent to review our website security. Below we’ve outlined the security measures already in place and any changes we’ve undertaken in the hope of reassuring our users.

• The website is a bespoke development project and not built on WordPress or any other web hosting platform. Therefore, it does not inherit any of their possible vulnerabilities.
• Site admin users only have the ability to post articles or delete users. They cannot view any user's details.
• We do not take payments and would never capture any payment details if we did.
• Access to the site's servers are by certificate only, no username/password login allowed. Anyone trying to access via username/password is immediately blocked.
• Remote access to the site’s database is only allowed from the site’s web servers.
• User's passwords are hashed using a salt and the PBKDF2 algorithm.
• We do capture the user’s FPL passwords. However, these are encrypted with a salt using AES encryption.
• We do not capture any user details from Facebook, Google or Twitter. We merely capture an ID token provided by them to link them to a user.
• We monitor our site for an increase in requests the login or registration pages and haven’t noticed an increase in requests to either.
  
• In order to prevent a possible brute force attack to obtain user login details we’ve added a capture mechanism to the login page. It should be a slight inconvenience to logging in but plugs a possible security hole.
• We’ve change the registration check slightly to prevent it being used to determine user’s email addresses. Although with capture in place an automated attached would have been pretty difficult.

We hope the information above will help to reassure everyone. However, we fully understand if you no longer want to be registered on the website. There’s been in place since the beginning of the season a Delete Account option for email and Google registered users. For Facebook and Twitter users, you can revoke access to the site via the Facebook or Twitter sites.