Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

-3
votes
0answers
16 views

How can I securely serve user documents in ASP.NET? [closed]

I am building a fairly small public website where users must upload various personal documents (all PDF) and have them approved by staff internally. In ASP.NET VB hosted on Win Server 2012, IIS8 + ...
1
vote
1answer
17 views

In httpd.conf why would you want AddType for phps?

We have an AddType as follows: AddType application/x-httpd-php-source .phps I was wondering what this was, and did some searching. It seems this is barely documented anywhere. Based on a hunch, I ...
1
vote
1answer
37 views

Suspicious script loads ONLY when navigating to site via search engines

I cannot find anywhere on our site where this code is referenced. More importantly it does not appear when navigating directly to our URL, it only appears when coming from a search engine (including ...
1
vote
1answer
56 views

Google's point of view to SSL - Do I need to force HTTPS protocol for all pages on website

Well now that google clearly declared that SSL would positively affect seo I want to know in which of the following conditions I fully benfit from ssl: 1.If I server https connection for all pages of ...
0
votes
0answers
6 views

Fail2ban not starting [WARNING 'findtime' not defined] [migrated]

It was working fine until i added a new jail [apache-postflood]. If i remove it then it works, so whats wrong with the "findtime" ? . Here's the output: sudo fail2ban-client start WARNING 'findtime' ...
0
votes
0answers
21 views

SSL Certificate issue: “doesn't have public audit record”

After renewing ssl certificate in our website, there seen "doesn't have public audit record" What is mean by this dialogue? Is it make any problems in websites security and how can i overcome this ...
0
votes
0answers
14 views

How to setup an implicit FTPS encryption on cPanel server?

Currently my server is configured to use TLS encryption for FTP. It is explicit since it uses FTPES and on port 21. How can I switch to implicit FTPS that works on port 990? I'm using Pure_FTPd. I ...
1
vote
0answers
13 views

Secure Badges on Site? [duplicate]

I have a new client whose site I will be re-building. I noticed on his site he has a badge from McAfee saying the site is secure. Below is an example: I have seen similar type badges by other ...
1
vote
0answers
27 views

Security and Apache Methods

I occasionally get annoying POST requests but one lately caused a 500 error. Not a biggie really, but it got me thinking. My site does not have but one form. Outside of this, POST should not exist ...
0
votes
0answers
13 views

WordPress site hacked, recovered but Google still has hacked page description [duplicate]

My website got hacked recently and recovered it. It was populating casino ads on my website. There were virtually made URLs where casino pages were displayed. I suspected the code came through a ...
0
votes
1answer
55 views

Site speed when using ddos protection by cloudflare

I've recently noticed an increase of sites using ddos protection by cloudflare and wondering the effects on both user experience and SEO. I've notice these redirect messages last from anywhere from 2 ...
2
votes
1answer
63 views

Malicious copy of site

After seeing an increase of shady organic keyword results appearing in Google Analytics we identified the referring Hostname. After adding the exit page to hostname we discovered someone cloned our ...
0
votes
0answers
14 views

CGI/FastCGI does not prevent me from reading other users files

I installed mod_fcgid.so for Apache to run every script under its user account. I looked at PHPinfo to see if it is loaded, and it is OK. Now when I try to read file content that belongs to another ...
1
vote
0answers
14 views

White labelling with frames and IE

I have a SaaS application that offers some basic white-labelling functionality related to CSS, company logos etc. However, one client now wants to white-label the application with their own URL so ...
1
vote
1answer
27 views

What might happen if I use FTP client without TLS?

For some reason connecting to server using FTP client (eg. filezilla) is not working with TLS encryption enabled. I had to disable it to use FTP. So wondering why is TLS needed in the first place and ...
2
votes
0answers
24 views

mod_ident not to be trusted? [closed]

I'm looking at Apache's mod_ident: http://httpd.apache.org/docs/2.2/mod/mod_ident.html However, on this page it has the following disclaimer: The information should not be trusted in any way except ...
2
votes
1answer
55 views

How can I figure out how a search engine is finding hidden pages?

We have a system hosting many websites for our customers, and inside that system there is a method that non-live customers can view their sites before we turn them on. Say the link is something like ...
0
votes
0answers
30 views

Framekiller and google rankings

This is the javacript code that I use to prevent clickjacking in my current project. <style id="antiClickjack">body{display:none !important;}</style> <script ...
0
votes
0answers
16 views

External clients get a certificate mismatch - but internal clients do not [closed]

I have a scenario where external clients are receiving a certificate that is different than the one that is bound to the IIS site. This is Win2008R2 / IIS, in the following configuration: ...
2
votes
1answer
46 views

Unknown subdomains pointing to my domain name

About 6 months ago I purchased the domain name example.net. Today I was trying to go to my control panel at example.net/cpanel but accidentally went to cpanel.example.net. I found a completely ...
1
vote
1answer
13 views

Security issues around giving directory link

I have a directory under my public directory that I use for file transfer purposes. I put songs I'm working on here and then send the link to other band members, etc. It's the simplest way I've found ...
2
votes
1answer
35 views

How do I get Windows Server 2012 to prompt me for credentials when I go to a restricted subfolder of my site?

The "Users" group has read access to my entire website so the public can browse my site. Now, I have created an "admin" subfolder which I do not want the public to have access to. So in the ...
3
votes
1answer
38 views

How do I grant security to my site users to be able to upload files in Windows Server 2012

Using Windows Server 2012 and IIS 8, I want my site users to be able to upload pictures and generate eft files and export files etc. All of these tasks require my users to have write permission to ...
0
votes
1answer
39 views

SSL issue with firefox

My website is hosted on hostgator and i have purchased their ssl service. Now when i open my website in chrome then it works fine but when i open it in firefox it gives me error like The ...
0
votes
0answers
12 views

Checking security on a shared hosting server [closed]

I am in the process of testing different hosting shared servers and I am very concerned about the security of the server. Thats why I would like to ask for advice on how to do to determine whether a ...
0
votes
1answer
35 views

Securing Linux Servers [closed]

I recently started hosting business and have several cPanel VPS and Dedicated Servers. Recently one of my cPanel Server root password was hacked and got back control after lots of trouble. Can any ...
2
votes
2answers
74 views

Incorrect Referring URLs - What can be the cause?

I am running a website with affiliate links . When the visitors of mydomain.com/page.php click on such an affiliate link, they are being sent to a link on a domain owned by the affilate network ...
0
votes
3answers
72 views

Does uploading index.php protect the other files that would normally be visible in that directory?

PHP is a mystery for me. In the FTP main directory of my website, I uploaded 2 files: a.txt and b.txt. If I enter my website address in my browser I can view both a.txt and b.txt. However when I ...
1
vote
1answer
42 views

Is it safe to let anyone add my site in Google Webmaster Tools?

Google Webmaster Tools allows people to verify site ownership through an existence of a special file. What if I were to create a catch-all rule, and let anyone add my site in their Google Webmaster ...
3
votes
2answers
103 views

Website is being targeted by mail bots

have a small website. When I perform a netstat is shows a lot of traffic from .p.mail. I think this is some kind of mail bot, trying to harvest email addresses from my website. How can I prevent ...
3
votes
2answers
63 views

URL hijacked for spam [closed]

I'm the webmaster site/admin for a legitimate site http://cic.nyu.edu, built on drupal 7. I've updated drupal to the latest version. My issue is that it seems as if someone or somebot is using the url ...
0
votes
1answer
22 views

What changes are coming that would reduce the problems assosciated with HTTPS compared to HTTP? [closed]

I have a web site under development. It is used for surveys but there's an advertising component. As it is very new I have used almost all the latest technologies. AngularJS, ASP.NET WebAPI 2 etc. ...
4
votes
1answer
96 views

What's the point of cross-origin resource sharing if there's a bunch of CORS proxies running?

I never really liked the direction CORS (cross-origin resource sharing) is taking. I think there's a misconception how client-server communication should work. The general concept is: User: Hello ...
0
votes
2answers
46 views

Do I need any special permission to have a form that requests a credit card number? Just request, not storing in a database

I'm using PayPal REST API to make calls using credit card numbers. So I have a form that requests credit card number to the users of the site. I could sell or use those credit card numbers that people ...
1
vote
2answers
294 views

What are spiders trying to achieve on my site by fetching lots of non-existant urls such as various versions of phpMyAdmin?

I've recently set up a build server that compiles Java source on Github webhooks. I created a public page for downloading latest .jars with a top level domain and I'm logging requests to it. What are ...
1
vote
2answers
73 views

Private folders which are not indexable

I have a requirement where I need to distribute about 400 copies of a pdf document (about 6 MB) and .pub files, that are personalized for each user. Every user must have access to only his/her set of ...
0
votes
0answers
163 views

How to prevent TYNT from inserting Iframes into my site [closed]

I have a wordpress site and since two days ago an iframe is showing up above the </body> tag. The iframes are not always the same and they wont show up everytime, they show up like 90% of the ...
5
votes
1answer
259 views

How can I protect my PHP source code from a client when installed on a client's server?

I have done a PHP web application and my client request to host it at their server. How can I protect my PHP code so that it will not be viewed, study, or take it for any other usage by my client?
3
votes
1answer
168 views

Why do some Nginx configurations block download agents using Wget?

I noticed that some Nginx configurations block download agents using Wget like this: if ($http_user_agent ~* LWP::Simple|wget) { return 403; } Why block Wget? If I use the above code in my ...
2
votes
1answer
196 views

How can I prevent Facebook from considering Google drive links unsafe on my website?

On my small website I've recently began using Google Drive as content delivery network. This is to solve resource usage issues with my provider. This worked well, but I'm confused because Facebook ...
1
vote
2answers
44 views

Is there any risk to a network if it allows FTP access to third party websites? [closed]

I was not able to FTP access to my website on my college's network. (The college has a cyberoam-firewalled newtork). It would fail at point when directory listing would show up othewise. I later ...
3
votes
3answers
102 views

Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?

I'd like to submit my personal site into the Chrome HSTS preload list. The site there says: In order to be included on the HSTS preload list, your site must: Have a valid certificate. ...
2
votes
0answers
18 views

Monitor and alert when events have ended [closed]

So I work for a private school, and we have only three I.T. Techs that take care of the entire campus/buildings, as well as the security systems and website. After trying to search google, I haven't ...
1
vote
1answer
43 views

Apache block all requests but my IP using the config file

I'm looking to upload the website that I've developed locally to my remote web server. However, so that I can test that the upload has gone fine and that all the basic security is in place, I want to ...
1
vote
0answers
39 views

Restrict Plesk user for external developer access

We are commissioning an external developer to develop part of our site and he will also need access to a MySQL database attached to the domain but I can't figure out how to create a user that has the ...
1
vote
1answer
52 views

How to set permissions for DooPHP?

I have downloaded and installed DooPHP according the Installation instructions. However, there is no statement on how to set permissions. Also not in INSTALL.TXT which comes with the product. The ...
0
votes
1answer
80 views

Can anyone buy my registered domain?

Is it possible for anyone to buy a domain that I have already registered? I registered a domain through Moniker and it has not expired yet. But it is displaying available through who.is I can not ...
2
votes
1answer
57 views

How risky is putting sensitive files up on webroot?

I understand that having anything sensitive under webroot is not smart; someone may be able to access it via url. However, I do not have a choice with my web host (iPage) as they limit my server space ...
1
vote
3answers
586 views

WordPress XML-RPC attack

Yesterday I suffered a DDoS attack on a WordPress site. I had 21,443 hits with HTTP Status code 404 and a Bandwidth of 711.85 MB. Also, CPU usage went to 100%. Logs show a lot of this entries: ... ...
2
votes
0answers
47 views

I would like to share how I configured my Web server for educational reasons. What are the security risks? [closed]

I just finished setting up a server to run a python pyramid application, and while I did not find any guidance on the Internet that helped me, I feel like I could contribute one myself. I'm ...