Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

2
votes
0answers
12 views

Why are passwords exportable as plain text in WordPress? [migrated]

On my WordPress 3.9.2 installation can I extract the users plain text passwords by going to Users, select all users, and choosing Bulk Actions Export. When I look in the mySQL database with ...
3
votes
3answers
34 views

Web user authentication methods

Is there any method besides using a DB with username and password for authenticating a user?
1
vote
1answer
13 views

Why do I see requests from BOT/0.1 (BOT for JCE) in my server access log and what should I do about them?

My server keeps getting requests with user agent identified as BOT/0.1 (BOT for JCE). The first one arrived 2013-09-14 22:13:17 CEST, the last one yet about three days ago, 2014-08-12 06:05:39 CEST. ...
-1
votes
0answers
17 views

pop up alert box even if browser is closed [java script code] [closed]

I need a java script code to pop up a alert box every 45 min even when the browser is closed.
0
votes
0answers
18 views

Block server's internet access and allow only LAN connections [closed]

I was wondering what the best way to block a server's internet access is while allowing LAN connections. Essentially, I want a server to be only accessible by LAN. What ips, ports, etc should I block? ...
0
votes
1answer
31 views

My shared hosting account is sending spam emails

My webhost has deactivated my shared hosting account, since it was sending spam emails through my domain. I have all unrouted mail such as mailto:aasdasd@domain.com set to be forwarded to a specific ...
8
votes
2answers
132 views

Are there any disadvantages to Cloudflare’s “Flexible SSL”?

Cloudflare let you serve your site over SSL without having to purchase and install a security certificate, a product they call “Flexible SSL”. (They act as a proxy and serve your site over SSL from ...
1
vote
1answer
34 views

How much text does the average person generate per day?

I'm figuring out how to do comment rate limiting, and have decided that I'll keep track of the number of bytes each user (defined as IP address + port) generates on my drive (so, each comment adds a ...
1
vote
2answers
37 views

How do I prevent access to SPAM URLs and remove them from Google's index?

When I started managing my friends' website, I had found a folder in it with a bunch of garbage HTML files with names such as: free-nasscamd-server-31day, gorilla-quentin-trollip-pdf, etc... Assuming ...
0
votes
2answers
36 views

Using SSL Certificates with shared hosting/different domain provider

I need to add a HTTPS address to an existing domain. Unfortunately there two companies involved: One for shared web-hosting, and one for the domain. How do SSL Certificated domains work in such ...
0
votes
1answer
34 views

Restricting access using IP address / Network Redirection?

I have a situation where we have a web server (lets call it A) that is hosting a set of HTTP based services. Due to some client restrictions, this web server is not open to the outside world but ...
2
votes
2answers
123 views

Parallel website running a copy of my original website

We have been working on a gaming website. Recently while making note of the major traffic sources, I noticed a website that I found to be a carbon-copy of our website. It uses our logo, and everything ...
2
votes
1answer
92 views

Can forwarding https://example.com requests to https://www.example.com be a security risk?

I maintain a retail store's eCommerce website, provided by a 3rd party. The HTTPS links do not load ('ERR_CONNECTION_TIMED_OUT') unless you put in the WWW before the doman name. The HTTP links forward ...
3
votes
1answer
47 views

Nginx and Google Appengine Reverse Proxy Security

The scenario is that I have a Google compute node running Nginx as a reverse proxy to the google appengine. The appengine is used to service REST calls from an single page application (SPA). HTTPS ...
0
votes
0answers
15 views

How to clean PmWiki from JS:Includer-AWG and protect my site from future infections?

I'm hosting a site for an NGO for several years now. The site seems to be based on a PmWiki backend. I don't know much details because I'm just hosting the site and I'm not the guy who set it up. I ...
2
votes
2answers
228 views

What are the Pros and Cons for password recovery change links in email?

Although a lot of sites still send your password in plain text through email, there has been a push to send a web page url instead. But how can that be any more secure than the password in clear ...
0
votes
0answers
50 views

Concrete5-based site hacked

It seems my Concrete5-based site has been hacked - found this in my default and homepage templates footers: <div style="position:absolute;left:-6397px;"> <a ...
3
votes
2answers
50 views

Can Joomla have a different URL for backend management?

My site will be maintained mostly by myself, and maybe 1 or 2 others. I want to know if it's possible if the back end can be managed from a different folder structure? ie. www.example.com <- user ...
0
votes
1answer
33 views

Is Google App Engine secure enough for financial applications?

I am wondering whether Google App Engine is secure enough for financial applications? This would involve storing sensitive information, access to users' funds, etc. Are there any applications like ...
1
vote
0answers
19 views

Hacked Wordpress site - Mobile Users only [closed]

My site has been hacked for users of mobiles only. I searched for advice here and found some advice but I couldn't see that it applied to my site nor could I fully understand the concepts. Does anyone ...
0
votes
1answer
44 views

How to block entire IPs of a VPN server by IP

I have website that identifies users only by their IPs. That makes it very difficult to keep it secure against unwanted users/attackers. They can simply change their IP by using VPN services that ...
1
vote
1answer
23 views

How to change cPanel URL? Example: mydomain.com/cpanel

I want to change my website's cPanel URL/path for security reasons. I have a VPS with shell root access, running centOS 6.5 64-bit. I want to change cPanel path for my website on the VPS to be ...
1
vote
1answer
49 views

Preventing Unvalidated Redirects

I have a project I'm working on, and I recently decided to add a "login bounceback" to my site. The idea is simple, and very common: The user is browsing the site, and runs into something they need to ...
1
vote
1answer
32 views

Privacy concern to track every user actions in your website?

We are building a system that track every user (logged in) actions, e.g. click, pageview, duration etc and store into a database. So all the user activities will be known and we are using them to ...
1
vote
1answer
72 views

My Server is returning a 404 instead of 403 when access if forbidden - is it good or bad?

via .htaccess, I forbid access to folders that have no index page inside (domain.com/images for example), and also block my site completely for several user-agents (such as wget). When I test to see ...
1
vote
3answers
34 views

AVG says web site is not secure

Recently a co-worker viewed our site from a different location. He said that AVG came up and said the site was not secure and blocked the site. However, when I run the site through AVG it says the ...
3
votes
2answers
65 views

How to hide existence of a private blog?

I have a friend who would like to start a 'blog'. The problem is that she would like it to be private so that only people invited can read it. So I told her to use a private WordPress. But she said ...
1
vote
2answers
25 views

eCommerce checkout security

I'm developing an eCommerce site and using SagePay as a card processor. Customers will enter their delivery/invoice details into a form which is then submitted to a checkout page. This page encrypts ...
2
votes
2answers
93 views

WordPress keeps redirecting my users to install.php, Is it caused by an injection hack?

I don't really know how to express my problem, so bear with me. This is a bit hard to explain. I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the ...
14
votes
5answers
549 views

Force Using SSL on Site now?

I am starting to see a majority of websites starting to use SSL as a standard practice for viewing the website securely now thanks to the revelations of Edward Snowden about the NSA surveillance that ...
2
votes
2answers
226 views

How to block user agent from accessing my WordPress site with htaccess?

I have noticed large amount of traffic coming to my site from different IP's with user agent. Mozilla/5.0 (compatible; SiteExplorer/1.0b; +http://siteexplorer.info/) I don't have much experience ...
1
vote
2answers
82 views

Are there security considerations with choosing shared vs VPS vs dedicated hosting

Are there security disadvantages to using a shared hosting environment instead of a VPS or dedicated server? Could using a shared server or a VPS be considered negligence in the event of a security ...
2
votes
1answer
58 views

What was this hack-bot trying to achieve via directory traversal?

I was walking through my server logs and the following kinda stunned me: ACCESS ERROR 404 from IP 62.112.152.161: Path: /index.php?page=weblog&env=../../../../../../../../etc/passwd%00 ...
4
votes
2answers
83 views

Making HTML5 videos stored on AWS S3 **difficult** to download (because I cant make it impossible)

I am building a website that hosts video's stored on AWS's S3 service. The videos are played thru a HTML5 player we have built. Ive just been asked to make sure "nobody can steal our video's". Now I ...
0
votes
1answer
65 views

Filtering content from response body HTML (mod_security or other WAFs)

We have Apache on Linux with mod_security as the Web App Firewall (WAF) layer. To prevent content injections, we have some rules that basically disable a page containing some text patterns from ...
1
vote
2answers
38 views

Risk of Plaintext Email Addresses on Websites

What are the risks of putting a personal email address (Gmail, in case it matters) on a personal website? A glance around any forum will show many people using "address [at] domain.com" instead of ...
0
votes
2answers
51 views

Emails from joomla 2.5 being marked as “Phishing” mails for vendor and client

The Mails from Joomla to customer as well as vendor are being marked as "phishing" mails. As per solutions provided in the other posts, I checked the header and it is being marked as "Spf-Fail". What ...
0
votes
0answers
21 views

Introduce security for web-service

This questions is with respect to including security in our architecture.Let me give a brief over-view. We have REST based web-service (Let's call it A) which is used by our web application and the ...
6
votes
3answers
157 views

Why don't we see websites hashing passwords before sending them? [closed]

(Note about the question title: by "we" I mean myself) Everytime I log on to any website, I have this thought that website asking me for my password and sending it back to the server is just basic ...
1
vote
1answer
62 views

Hide website data for Chrome and FF addons: IP Whois & Flags Chrome & Norton

I've got this addon and want to hide the information they publish for our website. They show Popularity, IP address info, nameservers, etc. Plus the traffic levels they report, 'popularity' reflects ...
3
votes
1answer
64 views

Our Website is being blocked in critical areas - how do I get to the bottom of this?

I'm working with a UK-based contractor in the counter-terrorism industry. I've noticed that when I'm in Virginia Beach (near Norfolk and Washington DC), I cannot get a connection to the website ...
3
votes
1answer
81 views

Strange series of page visits to my web site

In my web log I see 5 hits (to the same web page) all about the same time but from different parts of the world: 180.247.114.192 /RelFinder?personId=17586 - From: null 2014-01-10 00:26:40.0 ...
2
votes
1answer
47 views

Securing webserver from spam/phishing/malware - beyond RBLs?

We offer a service that requires URLs from our domain to be linked to external URLs. About ten years ago, we discovered that this functionality can be abused by miscreants -- to link to malicious ...
13
votes
1answer
191 views

Could somebody hijack my Google Analytics for a site?

I track many websites in Google Analytics. Recently I accidentally added tracking code for site A to site B, which I noticed a couple of weeks later. By then, one website had two weeks of no visitors, ...
2
votes
2answers
40 views

Major spam issue… CAPTCHAs and email verification aren't working [duplicate]

We have a user who claims to have a vendetta against our community. We run a fairly large social networking website, and for the past four or five weeks, this particular person (or maybe people?) has ...
0
votes
0answers
18 views

Should I use HTTPS for my WordPress blog? [duplicate]

In general I am aware of what SSL does and how, but I'm not exactly sure as to what's the accepted custom, i.e. whether I actually am supposed to use it for my blog. There will be no other users than ...
1
vote
2answers
165 views

How to set restrictions on my website?

Currently my website is under maintenance. I want to be the only person who's able to access/view the website online until I finish maintenance. How to set restrictions to others ? I hate stalkers.
1
vote
1answer
43 views

Securing cPanel and WHM

Is there a way I can trace users who log in in my cPanel and WHM? I know about cPHulk but it just records users who attack the server. I just want to record every user their IP address that log into ...
0
votes
1answer
46 views

How to know if my web site is blocked in China (Great Firewall of China) [duplicate]

I have a new site (with new domain), when I access it from China, it is being blocked. As the domain is a new domain, I am wondering if it is due to the site domain or in fact the IP we used is being ...
2
votes
2answers
124 views

Will using HTTPS hurt my site's SEO or other statistics?

I've set up a WordPress blog. Since I have to log into it from many different locations/machines, I've also got an SSL certificate, and set up Apache to redirect HTTP to HTTPS. It all works, but I'm ...