Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I'm trying to think of ways to, as securely as possible, verify that a user owns a website that they claim to own.

Here are some ways I've seen:

  • Upload an obscurely-named HTML file to the root directory with given contents
  • Include a meta tag or other comment somewhere in the home page source
  • Send an email to an address @domainwearetryingtovalidate.tld with a verification link
  • Check a CNAME or TXT record
  • Check WHOIS records
  • Physically validate by calling or emailing the support line, manually updating records

And here are the problems with those methods, in order:

  • Some website configurations may not allow for simply uploading a file to the root
  • Poor site design might allow a user of that site to add this meta tag themselves
  • Websites which provide email services make this useless; take gmail.com for example
  • That's too complex for most small website owners to figure out how to do
  • Those are public; anyone can claim to be whoever. Not to mention most often inaccurate.
  • Huuuuge waste of time

Are there any other ways to verify that a user on your site owns a particular website? Of the methods I listed, which of these are best and worst? I ordered them from best to worst in my own opinion, but I'd like to see what others think as well.

I plan on implementing one or more of these in PHP.

share|improve this question

migrated from stackoverflow.com Aug 12 '11 at 1:40

This question came from our site for professional and enthusiast programmers.

3  
This is most certainly a programming question. If it were meant to be on webmasters, I'd put it there. –  Cyclone Aug 11 '11 at 18:00
    
For an automated solution, you're stuck to what you listed. Other major companies (i.e. Google) use one of the first four options. I'd find it incredibly irregular for a user not to be able to do one of the first four. –  Jonny Keogh Aug 11 '11 at 18:01
1  
@rlb.usa It would be a question for webmasters if I asked how to add a CNAME record to my domain to verify that I own it for a particular service –  Cyclone Aug 11 '11 at 18:06
2  
I think that the first problem you have to solve is to decide: what does "owning" a website mean? Being an administrator? Having access to the filesystem? Having a legal ownership right? Having a maintenance duty by way of written or spoken agreement? Paying the hosting bills? Paying the domain bills? Paying the designers? –  Lightness Races in Orbit Aug 11 '11 at 18:12
1  
@Cyclone: I am working for you for free, by virtue of the fact that I'm completely wasting my time contributing to this question. –  Lightness Races in Orbit Aug 11 '11 at 18:12

5 Answers 5

up vote 8 down vote accepted

I definitely think

  • Upload an obscurely named html file to the root directory with given contents

is the best way to go. I've actually had to do this once. And I don't think many website configurations prevent you from doing this.

If you're really concerned about this, why not allow all (safe) options?


Regarding your comment:

Yes but with MVC systems (such as codeigniter), it can be a hassle to figure out how to access a physical file which isn't a part of the main system

In these rare cases, let those admins go with the CNAME / TXT records or call them :-)

share|improve this answer
2  
+1 This is what Google Analytics does –  Chris Laplante Aug 11 '11 at 18:02
1  
Right.. that's actually where I had to do it ;-) –  aioobe Aug 11 '11 at 18:02
2  
The first two I listed were from google webmaster tools –  Cyclone Aug 11 '11 at 18:03
    
@Cyclone, I agree with you that the former one seems more secure than the second one. –  aioobe Aug 11 '11 at 18:03

Uploading an obscurely named file is the way to go.

You wrote the drawback is that they may not be allowed to upload a file to the root. Well in that case it means they don't own the website, which is what you're trying to find out.

share|improve this answer
    
Exactly. You don't need "root" access to the server, i.e. outside of the html or www folder. –  Chris Laplante Aug 11 '11 at 18:04
    
I mean not allowed to in that rewrite rules may make it difficult or complex to upload the file –  Cyclone Aug 11 '11 at 18:04
    
@Cyclone, true but I guess it's quite rare to disallow access to a physical HTML file. –  Laurent Aug 11 '11 at 18:06
    
Yes but with MVC systems (such as codeigniter), it can be a hassle to figure out how to access a physical file which isn't a part of the main system –  Cyclone Aug 11 '11 at 18:07
    
I think CI still allows access to physical HTML files. But just in case, you could also allow the metatag method, so that your users are not stuck in case there's a problem with their .htaccess file or MVC framework. –  Laurent Aug 11 '11 at 18:09

I would recommend using meta tag...

  • Include a meta tag
share|improve this answer

Personally I would go with the automated email option.

Ask the user to input their URL and email address, checking that the domain is the same in both cases. The use the same system as password reset systems use:

  • Generate a random hash, partly made up of the current microtime and domain
  • Store the hash in a database
  • Send the user an email with a verification link, where the 'id' parameter is the hash
  • Now the user is verified (delete the row from the database)

For added security, store the time that the hash was generated, and then have it time out after an hour or two.

share|improve this answer

The microformats site is down now as I write this, but the Google cache is available. This is a solution for you:

http://microformats.org/wiki/RelMeAuth

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.