Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

1
vote
0answers
13 views

Secure Badges on Site? [duplicate]

I have a new client whose site I will be re-building. I noticed on his site he has a badge from McAfee saying the site is secure. Below is an example: I have seen similar type badges by other ...
1
vote
0answers
23 views

Security and Apache Methods

I occasionally get annoying POST requests but one lately caused a 500 error. Not a biggie really, but it got me thinking. My site does not have but one form. Outside of this, POST should not exist ...
0
votes
0answers
12 views

WordPress site hacked, recovered but Google still has hacked page description [duplicate]

My website got hacked recently and recovered it. It was populating casino ads on my website. There were virtually made URLs where casino pages were displayed. I suspected the code came through a ...
0
votes
1answer
48 views

Site speed when using ddos protection by cloudflare

I've recently noticed an increase of sites using ddos protection by cloudflare and wondering the effects on both user experience and SEO. I've notice these redirect messages last from anywhere from 2 ...
2
votes
1answer
58 views

Malicious copy of site

After seeing an increase of shady organic keyword results appearing in Google Analytics we identified the referring Hostname. After adding the exit page to hostname we discovered someone cloned our ...
0
votes
0answers
14 views

CGI/FastCGI does not prevent me from reading other users files

I installed mod_fcgid.so for Apache to run every script under its user account. I looked at PHPinfo to see if it is loaded, and it is OK. Now when I try to read file content that belongs to another ...
1
vote
0answers
14 views

White labelling with frames and IE

I have a SaaS application that offers some basic white-labelling functionality related to CSS, company logos etc. However, one client now wants to white-label the application with their own URL so ...
1
vote
1answer
26 views

What might happen if I use FTP client without TLS?

For some reason connecting to server using FTP client (eg. filezilla) is not working with TLS encryption enabled. I had to disable it to use FTP. So wondering why is TLS needed in the first place and ...
2
votes
0answers
23 views

mod_ident not to be trusted? [closed]

I'm looking at Apache's mod_ident: http://httpd.apache.org/docs/2.2/mod/mod_ident.html However, on this page it has the following disclaimer: The information should not be trusted in any way except ...
2
votes
1answer
52 views

How can I figure out how a search engine is finding hidden pages?

We have a system hosting many websites for our customers, and inside that system there is a method that non-live customers can view their sites before we turn them on. Say the link is something like ...
0
votes
0answers
27 views

Framekiller and google rankings

This is the javacript code that I use to prevent clickjacking in my current project. <style id="antiClickjack">body{display:none !important;}</style> <script ...
0
votes
0answers
16 views

External clients get a certificate mismatch - but internal clients do not [closed]

I have a scenario where external clients are receiving a certificate that is different than the one that is bound to the IIS site. This is Win2008R2 / IIS, in the following configuration: ...
2
votes
1answer
40 views

Unknown subdomains pointing to my domain name

About 6 months ago I purchased the domain name example.net. Today I was trying to go to my control panel at example.net/cpanel but accidentally went to cpanel.example.net. I found a completely ...
1
vote
1answer
13 views

Security issues around giving directory link

I have a directory under my public directory that I use for file transfer purposes. I put songs I'm working on here and then send the link to other band members, etc. It's the simplest way I've found ...
2
votes
1answer
34 views

How do I get Windows Server 2012 to prompt me for credentials when I go to a restricted subfolder of my site?

The "Users" group has read access to my entire website so the public can browse my site. Now, I have created an "admin" subfolder which I do not want the public to have access to. So in the ...
2
votes
1answer
35 views

How do I grant security to my site users to be able to upload files in Windows Server 2012

Using Windows Server 2012 and IIS 8, I want my site users to be able to upload pictures and generate eft files and export files etc. All of these tasks require my users to have write permission to ...
0
votes
1answer
39 views

SSL issue with firefox

My website is hosted on hostgator and i have purchased their ssl service. Now when i open my website in chrome then it works fine but when i open it in firefox it gives me error like The ...
0
votes
0answers
11 views

Checking security on a shared hosting server [closed]

I am in the process of testing different hosting shared servers and I am very concerned about the security of the server. Thats why I would like to ask for advice on how to do to determine whether a ...
0
votes
1answer
34 views

Securing Linux Servers [closed]

I recently started hosting business and have several cPanel VPS and Dedicated Servers. Recently one of my cPanel Server root password was hacked and got back control after lots of trouble. Can any ...
2
votes
2answers
69 views

Incorrect Referring URLs - What can be the cause?

I am running a website with affiliate links . When the visitors of mydomain.com/page.php click on such an affiliate link, they are being sent to a link on a domain owned by the affilate network ...
0
votes
3answers
68 views

Does uploading index.php protect the other files that would normally be visible in that directory?

PHP is a mystery for me. In the FTP main directory of my website, I uploaded 2 files: a.txt and b.txt. If I enter my website address in my browser I can view both a.txt and b.txt. However when I ...
1
vote
1answer
42 views

Is it safe to let anyone add my site in Google Webmaster Tools?

Google Webmaster Tools allows people to verify site ownership through an existence of a special file. What if I were to create a catch-all rule, and let anyone add my site in their Google Webmaster ...
3
votes
2answers
92 views

Website is being targeted by mail bots

have a small website. When I perform a netstat is shows a lot of traffic from .p.mail. I think this is some kind of mail bot, trying to harvest email addresses from my website. How can I prevent ...
3
votes
2answers
58 views

URL hijacked for spam [closed]

I'm the webmaster site/admin for a legitimate site http://cic.nyu.edu, built on drupal 7. I've updated drupal to the latest version. My issue is that it seems as if someone or somebot is using the url ...
0
votes
1answer
22 views

What changes are coming that would reduce the problems assosciated with HTTPS compared to HTTP? [closed]

I have a web site under development. It is used for surveys but there's an advertising component. As it is very new I have used almost all the latest technologies. AngularJS, ASP.NET WebAPI 2 etc. ...
4
votes
1answer
88 views

What's the point of cross-origin resource sharing if there's a bunch of CORS proxies running?

I never really liked the direction CORS (cross-origin resource sharing) is taking. I think there's a misconception how client-server communication should work. The general concept is: User: Hello ...
0
votes
2answers
45 views

Do I need any special permission to have a form that requests a credit card number? Just request, not storing in a database

I'm using PayPal REST API to make calls using credit card numbers. So I have a form that requests credit card number to the users of the site. I could sell or use those credit card numbers that people ...
1
vote
2answers
282 views

What are spiders trying to achieve on my site by fetching lots of non-existant urls such as various versions of phpMyAdmin?

I've recently set up a build server that compiles Java source on Github webhooks. I created a public page for downloading latest .jars with a top level domain and I'm logging requests to it. What are ...
1
vote
2answers
62 views

Private folders which are not indexable

I have a requirement where I need to distribute about 400 copies of a pdf document (about 6 MB) and .pub files, that are personalized for each user. Every user must have access to only his/her set of ...
0
votes
0answers
118 views

How to prevent TYNT from inserting Iframes into my site [closed]

I have a wordpress site and since two days ago an iframe is showing up above the </body> tag. The iframes are not always the same and they wont show up everytime, they show up like 90% of the ...
5
votes
1answer
226 views

How can I protect my PHP source code from a client when installed on a client's server?

I have done a PHP web application and my client request to host it at their server. How can I protect my PHP code so that it will not be viewed, study, or take it for any other usage by my client?
3
votes
1answer
162 views

Why do some Nginx configurations block download agents using Wget?

I noticed that some Nginx configurations block download agents using Wget like this: if ($http_user_agent ~* LWP::Simple|wget) { return 403; } Why block Wget? If I use the above code in my ...
2
votes
1answer
169 views

How can I prevent Facebook from considering Google drive links unsafe on my website?

On my small website I've recently began using Google Drive as content delivery network. This is to solve resource usage issues with my provider. This worked well, but I'm confused because Facebook ...
1
vote
2answers
39 views

Is there any risk to a network if it allows FTP access to third party websites? [closed]

I was not able to FTP access to my website on my college's network. (The college has a cyberoam-firewalled newtork). It would fail at point when directory listing would show up othewise. I later ...
3
votes
3answers
90 views

Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?

I'd like to submit my personal site into the Chrome HSTS preload list. The site there says: In order to be included on the HSTS preload list, your site must: Have a valid certificate. ...
2
votes
0answers
17 views

Monitor and alert when events have ended [closed]

So I work for a private school, and we have only three I.T. Techs that take care of the entire campus/buildings, as well as the security systems and website. After trying to search google, I haven't ...
1
vote
1answer
41 views

Apache block all requests but my IP using the config file

I'm looking to upload the website that I've developed locally to my remote web server. However, so that I can test that the upload has gone fine and that all the basic security is in place, I want to ...
1
vote
0answers
30 views

Restrict Plesk user for external developer access

We are commissioning an external developer to develop part of our site and he will also need access to a MySQL database attached to the domain but I can't figure out how to create a user that has the ...
1
vote
1answer
47 views

How to set permissions for DooPHP?

I have downloaded and installed DooPHP according the Installation instructions. However, there is no statement on how to set permissions. Also not in INSTALL.TXT which comes with the product. The ...
0
votes
1answer
78 views

Can anyone buy my registered domain?

Is it possible for anyone to buy a domain that I have already registered? I registered a domain through Moniker and it has not expired yet. But it is displaying available through who.is I can not ...
2
votes
1answer
57 views

How risky is putting sensitive files up on webroot?

I understand that having anything sensitive under webroot is not smart; someone may be able to access it via url. However, I do not have a choice with my web host (iPage) as they limit my server space ...
1
vote
3answers
548 views

WordPress XML-RPC attack

Yesterday I suffered a DDoS attack on a WordPress site. I had 21,443 hits with HTTP Status code 404 and a Bandwidth of 711.85 MB. Also, CPU usage went to 100%. Logs show a lot of this entries: ... ...
2
votes
0answers
46 views

I would like to share how I configured my Web server for educational reasons. What are the security risks? [closed]

I just finished setting up a server to run a python pyramid application, and while I did not find any guidance on the Internet that helped me, I feel like I could contribute one myself. I'm ...
1
vote
1answer
82 views

Server flooded with Wordpress login requests. Need advice [closed]

Recently I was looking at the nginx access logs and found on 2 ocassions a large ammount of requests pointed towards my WP login page. There were over 50.000 requests coming from 2 different IP ...
0
votes
1answer
29 views

Does referrer header checking offer any real world security improvement?

At work we use a central portal that provides basic SSO functionality to other applications. In addition to verifying the SSO data sent, all of our existing in-house applications (used by the public) ...
3
votes
3answers
48 views

Web user authentication methods

Is there any method besides using a DB with username and password for authenticating a user?
1
vote
1answer
765 views

Why do I see requests from BOT/0.1 (BOT for JCE) in my server access log and what should I do about them?

My server keeps getting requests with user agent identified as BOT/0.1 (BOT for JCE). The first one arrived 2013-09-14 22:13:17 CEST, the last one yet about three days ago, 2014-08-12 06:05:39 CEST. ...
0
votes
1answer
178 views

My shared hosting account is sending spam emails

My webhost has deactivated my shared hosting account, since it was sending spam emails through my domain. I have all unrouted mail such as mailto:aasdasd@domain.com set to be forwarded to a specific ...
8
votes
3answers
605 views

Are there any disadvantages to Cloudflare’s “Flexible SSL”?

Cloudflare let you serve your site over SSL without having to purchase and install a security certificate, a product they call “Flexible SSL”. (They act as a proxy and serve your site over SSL from ...
1
vote
1answer
45 views

How much text does the average person generate per day?

I'm figuring out how to do comment rate limiting, and have decided that I'll keep track of the number of bytes each user (defined as IP address + port) generates on my drive (so, each comment adds a ...