Preventing a system from unauthorized access, modification, disruption, or destruction.
8
votes
2answers
421 views
Forum Spam Question. Why are Chinese hackers posting tiny images on my forum
My forum is getting attacked by spammers with Chinese IP's.
Replies are created to discussion topics, always short responses and along with the response an image is inserted using forum code which is ...
0
votes
1answer
15 views
Website is alerted with firefox as damaging/infected. Remove site from 'blacklist'
My website is alerted as malicious/infected by firefox, so users can't have normal experience atm.
All threats are removed and website is clean. How I can remove my website from this 'blacklist'? ...
-1
votes
0answers
44 views
CMS software - why is it still so immature? [closed]
I have reviewed several popular CMS packages and eventually tried WordPress, but I found it to be immature and unsuitable for production server. I then reviewed other CMS software again specifically ...
2
votes
0answers
949 views
How to protect Google Ads from yontoo layers runtime?
Since sometime I have observed that Google Ads on any website including my blog (http://blogs.digitss.com) gets replaced with something similar to uploaded image below. I am sure it's happening with ...
0
votes
0answers
10 views
How to double protect admin access in PyroCMS
I have read how to protect admin folder with .htaccess and .htpasswd file but in PyroCMS admin login (ex: example.com/admin) just only routing system (no admin folder yet).
So, how can I double ...
1
vote
1answer
40 views
How to respond to attack on web site
I have wordpress site that is under some kind of bot attack.
I checked apache logs and there's get request to a single post on my blog every second (sometimes there's more than one per second).
When ...
0
votes
0answers
14 views
User entered Javascript security implications [migrated]
I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? ...
3
votes
1answer
114 views
How to remove adware pop up?
I get an ad pop up that should not be on the site. It has only appeared once.
The HTML code for the pop up window that appeared:
http://pastie.org/5674909
Here is the full HTML pastie:
...
0
votes
1answer
35 views
General question as a new webmaster [closed]
I am wanting to make my own social forum for friends and workers. I will have about 10,000-15,000 users. I have never made a forum on such a high scale and to this point have only been a developer ...
2
votes
1answer
576 views
How to properly deny Railo directory access through Apache
I've been battle tested on this and failed to achieve my goal which is to deny all access to all directories except the Public directory and only allow access to all all other directories with ...
1
vote
0answers
28 views
Is website security accreditation worth having?
My site handles sensitive data, is there any website security accreditation that is well respected and worth having?
2
votes
0answers
34 views
Good security practice for writing a php/mysql web app [closed]
I'm about to create a web app that is php/mysql based. It should contain multiple users and two levels of admin accounts.
It will most likely not be very likely to be attacked in any way. Still I am ...
1
vote
5answers
86 views
Website Systematically Blocking IP Addresses
I have a series of websites hosted at the same server. The issue I am having is that it keeps blocking me access from different means to the sites. Allow me to explain:
From my IP, Blocked.
From ...
11
votes
3answers
124 views
Is it sufficient to secure a order status page just by a random URL?
After a (corporate) customer bought some items in our online shop, we send an email with an overview what he has bought to him.
We'd like to inform our customer about received payments, packet ...
0
votes
1answer
42 views
how do I avoid spam domains to point to my site or IP hosting tomcat application
I can across a issue where I saw some xyz.com is pointing to mydomain.com.
I am not using Apache, nor IIS but Tomcat 7 directly.
How to I avoid such other spam domains to point to mydomain.com?
I ...
1
vote
3answers
306 views
I own a domain name. Can people view my personal registered info?
Is my information protected?
Or can someone tell where I live by my domain name?
Why do hosting services offer a protected information service for extra money?
How can I view that information?
2
votes
2answers
91 views
How to have google index a login protected url?
For example, my site:
http://abcde.foobar.com is protected by a "single sign on" login page hosted at http://sso.foobar.com, so when a user visits "abcde", they get redirected to the "sso" login page ...
3
votes
1answer
109 views
How to get rid of crawling errors due to the URL Encoded Slashes (%2F) problem in Apache
The Google web crawler has indexed a whole set of URLs with encoded slashes (%2F) for our site. I assume it has picked up the pages from our XML sitemap file. The problem is that the live pages will ...
1
vote
2answers
98 views
1024 bit to 2048 bit certificate differences in how we access our portal
Why now that we have gone from 1024 to 2048 do we need to put the www in front of our portal site when we never used to.
8
votes
2answers
799 views
How to find domain registrar and DNS hosting with good DNSSEC support?
Simplified problem
I want to buy a domain and make a website that is fully secured with DNSSEC.
I want to make sure that only the one right SSL certificate could be validated by the browsers and all ...
1
vote
2answers
141 views
How to setup SSL to protect secure information
At the moment I have a website running in quite an insecure way, I'll refer to it as example.com.
To add better security we're starting to store passwords using bcrypt but we are currently not using ...
0
votes
2answers
27 views
Using SSL Certification in Multiple Locations
I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access.
The ...
0
votes
1answer
17 views
Web server with or without Panel [closed]
I start a Web server for my company for hosting about 15 website and I didn't install a Control Panel, I do everything by command and i'm pretty comfortable with it but do you think i'm losing time by ...
1
vote
1answer
345 views
Site got hacked while many / all security leaks have been removed [closed]
I've got a website with this code appended to my php document :
<?
#8f4d8e#
...
2
votes
1answer
62 views
Password protected website
I need to add a user authentication page before the actual homepage of the website.
In Joomla! I just set the website offline and the offline page loads in place of the homepage but then it's ...
1
vote
1answer
6k views
.htaccess password protection generates 500 internal server error
I have created a .htpasswd file using htaccess tools of which I have uploaded to the root of my web hosting space (/public_html is my web root).
I created a .htaccess file which referenced the ...
1
vote
5answers
83 views
How do webmasters store and keep track of their passwords [closed]
I'm developing a site for the first time, and I'm trying to work out the best way to store and track all the accounts/passwords e.g. Server passwords, ftp passwords, API passwords (FB, Google, ...
2
votes
5answers
472 views
Is it dangerous to keep Thumbs.db on a web server?
Windows Thumbs.db system files that are in most of folders were uploaded with all other files from the localhost to the server.
Is it dangerous, if you forget to delete them on the server?
I am on ...
5
votes
3answers
280 views
How To Hide From BuiltWith?
Out of curiosity, does anyone know how builtwith.com works? How does it identify the platform or app a website is using? And most importantly does anyone know how to hide the details from it?
Somehow ...
6
votes
1answer
160 views
Security: Hide mysql connection details file
Ok, so I know this must be a very basic question, but my problem is the following: I have developed my first PHP mini-app (so I'm fairly new to this) and I am pretty sure that there are two files of ...
0
votes
0answers
38 views
How to setup IIS on Windows AIM on a Virtual Port [closed]
I want to host my web server on EC2 at Amazon Web Service. I will use a Windows AIM and IIS7.
I want to config a port (such as: 5555) for my web service and bind it to virtual port 80. so that the ...
3
votes
4answers
223 views
2
votes
2answers
121 views
Implications on automatically “open” third party domain aliasing to one of my subdomains
I have a domain, let's call it www.mydomain.com where I have a portal with an active community of users.
In this portal users cooperate in a wiki way to build some "kind of software".
These software ...
2
votes
2answers
84 views
Any suggestions for a change detection system?
As a webdesigner/webmaster I'm taking care of various websites. Recently one client's website got "hacked". It turned out that at their office one computer got infected by a trojan, that spied the ftp ...
2
votes
1answer
8k views
Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request
I have a joomla website installed and working good. i installed Qlue404 component which redirects 404 page to a custom page., sometimes when i try the symbols ' and some others the 404 page appears ...
4
votes
1answer
113 views
Website still blocked after hack
I manage a website that was hacked a few months ago (I wasn't the webmaster then), it was running on Joomla. I have manages to redo the website with custom codes (php/mysql), but it still some ...
1
vote
0answers
52 views
website address point to localhost
Today in firefox while surfing the internet, I opened a website it asked "This site may harm your computer" if you want to open this website add it in exception list. I added a website under exception ...
2
votes
1answer
81 views
How to log username in Apache logs?
I need some help regarding how to log the user-name into apache logs. I'm building a use-case for Security Information Event Management.
Is the method the same in case of IIS or just applicable to ...
0
votes
0answers
107 views
SIMPLEST way to set up password protection for a static site, with basic admin UI?
I have a static site.
I would like the simplest approach to password protecting a directory, with a basic admin UI for adding/removing users. I will have so few users that I don't care about ...
1
vote
1answer
214 views
SSL on multiple directories
I have a website that is http, but has a port set up for https for a specific directory that is for the shopping cart. Now I'd like to use our SSL on a different directory in the same site as well. ...
4
votes
2answers
83 views
What measures should I take after I find one of my scripts being vulnerable?
I maintain a few PHP-based websites for a small company on a LAMP server. The scripts include CMS such as Joomla or Wordpress, as well as SilverStripe and Drupal installations.
A week ago, I found ...
4
votes
1answer
819 views
Why has Apache begun running a single process as root, and another as root and the wwwdata user?
I am running Apache Worker-MPM, PHP 5.3.2, and FCGID.
Apache runs better than before, but I noticed that there is an apache process running as root and a second process that runs as both root and ...
1
vote
1answer
172 views
www.foobar.com works but foobar.com results in a 'Server not found' error
I have just setup a minimal (hopefully secure? - comments welcome) apache website using the following configuration file:
<VirtualHost *:80>
ServerName foobar.com
ServerAlias ...
4
votes
5answers
669 views
Site compromised .htaccess files everywhere
Some of the sites we're hosting are compromised by... I don't know what.
Every directory on the webserver contains a .htaccess file which redirects a user coming from a search engine to a page which ...
2
votes
1answer
259 views
Tell apache to point to a subfolder as default starting point for public
What would be the different methods of telling Apache to serve up httpdocs/public instead of httpdocs as the default starting point?
I want to be able to have my includes and logs directories behind ...
1
vote
2answers
403 views
How to block malicious requests before they reach Apache?
I have a RESTful web service that gets hit by a large number of requests coming from various IPs with dummy logins and random inputs. I have already denied these requests at the HTTP level (using the ...
2
votes
1answer
258 views
Pass IMG SRC via GET and echo it? Is that really secure?
I was wondering how I can make a really simple GET and echo request more secure
The code:
$src = $_GET['src'];
echo "<img src='$src' />";
Basically, I have a URL like ...
3
votes
2answers
60 views
How to safely saving users' data and NOT get responsibility of users' data?
I am programming a website which will save up users' inputs for their next visits. For example, I might save their phone numbers. The user will know that I save their phone numbers. However, do I need ...
0
votes
0answers
45 views
Insecure Php code allow other malicious code to run [closed]
Got an email from the web host that I used for a small website. Basically they disable the website and says the php code on it was used to scan for vulnerabilitity on their shared hosting platform, ...
1
vote
2answers
316 views
GWT “Big traffic change for top URL”
I recently received an email from GWT saying that one of my URL's traffic has suddenly dropped. As it turned out the traffic to the whole site has drastically dropped, from some 300+ unique visitors ...
