Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

0
votes
0answers
9 views

Strange rapid grow in visitors [on hold]

I have a hosting that I use to host 5 websites. One of them is my personal website that consists of two static html pages. I haven't updated it for 6 month. It used to have about 100 visits per month ...
0
votes
3answers
42 views

WordPress Site Hacked? Phising scam?

We just got a note from CloudFlare that we got reported for phishing. The link they provided was (domain name removed): /wp-content/plugins/scure-bank/fea7b6cabec2fd724dd2d1b4ca7e898d/thankyou.php ...
0
votes
0answers
16 views

What kind of attack causes a JavaScript 'out of memory' on the attackers device?

We experienced a strange attack yesterday. Our error log picked up the same 'out of memory' JavaScript error from a single IP address every 10 seconds. The requests came from 6 client ports on the ...
0
votes
1answer
98 views

How to trace origin of script injected in my webpage

I was looking through a static site I created on my local server, in my web browser, and found a curious call to an external script <script ...
5
votes
3answers
91 views

How do i make it difficult for users to make multiple accounts

I'm creating a website for my business and I want to offer free first deliveries for the first week but I'm afraid people will take advantage of that. I don't take any money or credit card info ...
1
vote
1answer
14 views

Disable ftp://hostname for my website [closed]

I'm hosting a page and I'm having a problem. If I write ftp://myhostname, the browser asks for FTP username and password and I think this may be a security problem because it doesn't happen with other ...
0
votes
0answers
13 views

Possible to leave proc_open() enabled on a shared host?

We are working on a PHP component that requires proc_open() for it to work. Because of this, we have trouble running on common shared hosts because proc_open() together with other functions like ...
1
vote
0answers
23 views

Database of hacking attempt strings? [closed]

I have a strange URL request that's showing up in my logs, and I want to see if it's a hacking attempt. Is there a database or resource out there somewhere where I can see if this url is a common ...
1
vote
1answer
31 views

Looking for easy-to-maintain and secure directory structure for multipart site

I recently inherited an older custom PHP website that consists of three parts: a public section for all to see, a members section, and an administrator section. The directory section resembles the ...
0
votes
0answers
34 views

Security in MVC code-first entity framework

I am new to ASP.NET MVC and to Azure (in which our application will be hosted). And I am new to security in general. So I'm wondering how secure the use of code-first entity framework in asp's ...
1
vote
1answer
23 views

In httpd.conf why would you want AddType for phps?

We have an AddType as follows: AddType application/x-httpd-php-source .phps I was wondering what this was, and did some searching. It seems this is barely documented anywhere. Based on a hunch, I ...
1
vote
1answer
54 views

Suspicious script loads ONLY when navigating to site via search engines

I cannot find anywhere on our site where this code is referenced. More importantly it does not appear when navigating directly to our URL, it only appears when coming from a search engine (including ...
1
vote
1answer
85 views

Google's point of view to SSL - Do I need to force HTTPS protocol for all pages on website

Well now that google clearly declared that SSL would positively affect seo I want to know in which of the following conditions I fully benfit from ssl: 1.If I server https connection for all pages of ...
0
votes
0answers
32 views

SSL Certificate issue: “doesn't have public audit record”

After renewing ssl certificate in our website, there seen "doesn't have public audit record" What is mean by this dialogue? Is it make any problems in websites security and how can i overcome this ...
0
votes
0answers
28 views

How to setup an implicit FTPS encryption on cPanel server?

Currently my server is configured to use TLS encryption for FTP. It is explicit since it uses FTPES and on port 21. How can I switch to implicit FTPS that works on port 990? I'm using Pure_FTPd. I ...
1
vote
0answers
13 views

Secure Badges on Site? [duplicate]

I have a new client whose site I will be re-building. I noticed on his site he has a badge from McAfee saying the site is secure. Below is an example: I have seen similar type badges by other ...
1
vote
0answers
29 views

Security and Apache Methods

I occasionally get annoying POST requests but one lately caused a 500 error. Not a biggie really, but it got me thinking. My site does not have but one form. Outside of this, POST should not exist ...
0
votes
0answers
13 views

WordPress site hacked, recovered but Google still has hacked page description [duplicate]

My website got hacked recently and recovered it. It was populating casino ads on my website. There were virtually made URLs where casino pages were displayed. I suspected the code came through a ...
0
votes
1answer
77 views

Site speed when using ddos protection by cloudflare

I've recently noticed an increase of sites using ddos protection by cloudflare and wondering the effects on both user experience and SEO. I've notice these redirect messages last from anywhere from 2 ...
2
votes
1answer
74 views

Malicious copy of site

After seeing an increase of shady organic keyword results appearing in Google Analytics we identified the referring Hostname. After adding the exit page to hostname we discovered someone cloned our ...
0
votes
0answers
14 views

CGI/FastCGI does not prevent me from reading other users files

I installed mod_fcgid.so for Apache to run every script under its user account. I looked at PHPinfo to see if it is loaded, and it is OK. Now when I try to read file content that belongs to another ...
1
vote
0answers
15 views

White labelling with frames and IE

I have a SaaS application that offers some basic white-labelling functionality related to CSS, company logos etc. However, one client now wants to white-label the application with their own URL so ...
1
vote
1answer
36 views

What might happen if I use FTP client without TLS?

For some reason connecting to server using FTP client (eg. filezilla) is not working with TLS encryption enabled. I had to disable it to use FTP. So wondering why is TLS needed in the first place and ...
2
votes
0answers
30 views

mod_ident not to be trusted? [closed]

I'm looking at Apache's mod_ident: http://httpd.apache.org/docs/2.2/mod/mod_ident.html However, on this page it has the following disclaimer: The information should not be trusted in any way except ...
2
votes
1answer
63 views

How can I figure out how a search engine is finding hidden pages?

We have a system hosting many websites for our customers, and inside that system there is a method that non-live customers can view their sites before we turn them on. Say the link is something like ...
0
votes
0answers
46 views

Framekiller and google rankings

This is the javacript code that I use to prevent clickjacking in my current project. <style id="antiClickjack">body{display:none !important;}</style> <script ...
0
votes
0answers
16 views

External clients get a certificate mismatch - but internal clients do not [closed]

I have a scenario where external clients are receiving a certificate that is different than the one that is bound to the IIS site. This is Win2008R2 / IIS, in the following configuration: ...
2
votes
1answer
63 views

Unknown subdomains pointing to my domain name

About 6 months ago I purchased the domain name example.net. Today I was trying to go to my control panel at example.net/cpanel but accidentally went to cpanel.example.net. I found a completely ...
1
vote
1answer
13 views

Security issues around giving directory link

I have a directory under my public directory that I use for file transfer purposes. I put songs I'm working on here and then send the link to other band members, etc. It's the simplest way I've found ...
2
votes
1answer
39 views

How do I get Windows Server 2012 to prompt me for credentials when I go to a restricted subfolder of my site?

The "Users" group has read access to my entire website so the public can browse my site. Now, I have created an "admin" subfolder which I do not want the public to have access to. So in the ...
3
votes
1answer
44 views

How do I grant security to my site users to be able to upload files in Windows Server 2012

Using Windows Server 2012 and IIS 8, I want my site users to be able to upload pictures and generate eft files and export files etc. All of these tasks require my users to have write permission to ...
0
votes
1answer
42 views

SSL issue with firefox

My website is hosted on hostgator and i have purchased their ssl service. Now when i open my website in chrome then it works fine but when i open it in firefox it gives me error like The ...
0
votes
0answers
14 views

Checking security on a shared hosting server [closed]

I am in the process of testing different hosting shared servers and I am very concerned about the security of the server. Thats why I would like to ask for advice on how to do to determine whether a ...
0
votes
1answer
36 views

Securing Linux Servers [closed]

I recently started hosting business and have several cPanel VPS and Dedicated Servers. Recently one of my cPanel Server root password was hacked and got back control after lots of trouble. Can any ...
2
votes
2answers
81 views

Incorrect Referring URLs - What can be the cause?

I am running a website with affiliate links . When the visitors of mydomain.com/page.php click on such an affiliate link, they are being sent to a link on a domain owned by the affilate network ...
0
votes
3answers
85 views

Does uploading index.php protect the other files that would normally be visible in that directory?

PHP is a mystery for me. In the FTP main directory of my website, I uploaded 2 files: a.txt and b.txt. If I enter my website address in my browser I can view both a.txt and b.txt. However when I ...
1
vote
1answer
49 views

Is it safe to let anyone add my site in Google Webmaster Tools?

Google Webmaster Tools allows people to verify site ownership through an existence of a special file. What if I were to create a catch-all rule, and let anyone add my site in their Google Webmaster ...
3
votes
2answers
139 views

Website is being targeted by mail bots

have a small website. When I perform a netstat is shows a lot of traffic from .p.mail. I think this is some kind of mail bot, trying to harvest email addresses from my website. How can I prevent ...
3
votes
2answers
79 views

URL hijacked for spam [closed]

I'm the webmaster site/admin for a legitimate site http://cic.nyu.edu, built on drupal 7. I've updated drupal to the latest version. My issue is that it seems as if someone or somebot is using the url ...
0
votes
1answer
23 views

What changes are coming that would reduce the problems assosciated with HTTPS compared to HTTP? [closed]

I have a web site under development. It is used for surveys but there's an advertising component. As it is very new I have used almost all the latest technologies. AngularJS, ASP.NET WebAPI 2 etc. ...
4
votes
1answer
109 views

What's the point of cross-origin resource sharing if there's a bunch of CORS proxies running?

I never really liked the direction CORS (cross-origin resource sharing) is taking. I think there's a misconception how client-server communication should work. The general concept is: User: Hello ...
0
votes
2answers
48 views

Do I need any special permission to have a form that requests a credit card number? Just request, not storing in a database

I'm using PayPal REST API to make calls using credit card numbers. So I have a form that requests credit card number to the users of the site. I could sell or use those credit card numbers that people ...
1
vote
2answers
319 views

What are spiders trying to achieve on my site by fetching lots of non-existant urls such as various versions of phpMyAdmin?

I've recently set up a build server that compiles Java source on Github webhooks. I created a public page for downloading latest .jars with a top level domain and I'm logging requests to it. What are ...
1
vote
2answers
82 views

Private folders which are not indexable

I have a requirement where I need to distribute about 400 copies of a pdf document (about 6 MB) and .pub files, that are personalized for each user. Every user must have access to only his/her set of ...
0
votes
0answers
211 views

How to prevent TYNT from inserting Iframes into my site [closed]

I have a wordpress site and since two days ago an iframe is showing up above the </body> tag. The iframes are not always the same and they wont show up everytime, they show up like 90% of the ...
5
votes
1answer
307 views

How can I protect my PHP source code from a client when installed on a client's server?

I have done a PHP web application and my client request to host it at their server. How can I protect my PHP code so that it will not be viewed, study, or take it for any other usage by my client?
3
votes
1answer
189 views

Why do some Nginx configurations block download agents using Wget?

I noticed that some Nginx configurations block download agents using Wget like this: if ($http_user_agent ~* LWP::Simple|wget) { return 403; } Why block Wget? If I use the above code in my ...
2
votes
1answer
239 views

How can I prevent Facebook from considering Google drive links unsafe on my website?

On my small website I've recently began using Google Drive as content delivery network. This is to solve resource usage issues with my provider. This worked well, but I'm confused because Facebook ...
1
vote
2answers
51 views

Is there any risk to a network if it allows FTP access to third party websites? [closed]

I was not able to FTP access to my website on my college's network. (The college has a cyberoam-firewalled newtork). It would fail at point when directory listing would show up othewise. I later ...
3
votes
3answers
130 views

Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?

I'd like to submit my personal site into the Chrome HSTS preload list. The site there says: In order to be included on the HSTS preload list, your site must: Have a valid certificate. ...