I have a question about the security of my website, especially the webshop part of it. This shop contains only 6 (medical) c.d.'s.
The webshop is built with VirtueMart 1.1.4 (I'll upgrade next week to 1.1.5). The only payment method is Paypal, but the creditors info is not stored at my site. When a cd is ordered and a customer comes on the Paypal site the extra security is visible (https protocol and the lock symbol), but not before when he/she is on my site in the shop. At his moment I don't use extra security facilities like SSL or SSH.
I don't know whether it's a must to use SSL or SSH. Of course I have a paid attention to a good php.ini, .htaccess and the folder permission settings. I also installed the component RSFirewall.
An SSL is necessary if you have customers entering in any information on your site that will then be sent to PayPal. If a customer has to enter in their name, email, address, etc., on your site and then click the link to PayPal for instance.
If all that resides on your site is a button to purchase and then they do all this on PayPal's site, you should be alright there, because all info entering is done under PayPal's SSL.