Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

0
votes
1answer
56 views

Filtering content from response body HTML (mod_security or other WAFs)

We have Apache on Linux with mod_security as the Web App Firewall (WAF) layer. To prevent content injections, we have some rules that basically disable a page containing some text patterns from ...
1
vote
1answer
58 views

Phishing alert but file never existed

I got an alert from Google Webmasters. They say the following file was present in my host: example.com/~jhostgop/identity.php I checked my files and it never existed at all. I've experience this ...
1
vote
2answers
27 views

How do I prevent access to SPAM URLs and remove them from Google's index?

When I started managing my friends' website, I had found a folder in it with a bunch of garbage HTML files with names such as: free-nasscamd-server-31day, gorilla-quentin-trollip-pdf, etc... Assuming ...
1
vote
2answers
78 views

Are there security considerations with choosing shared vs VPS vs dedicated hosting

Are there security disadvantages to using a shared hosting environment instead of a VPS or dedicated server? Could using a shared server or a VPS be considered negligence in the event of a security ...
0
votes
2answers
34 views

Using SSL Certificates with shared hosting/different domain provider

I need to add a HTTPS address to an existing domain. Unfortunately there two companies involved: One for shared web-hosting, and one for the domain. How do SSL Certificated domains work in such ...
3
votes
1answer
1k views

How to protect Google Ads from yontoo layers runtime?

Since sometime I have observed that Google Ads on any website including my blog (http://blogs.digitss.com) gets replaced with something similar to uploaded image below. I am sure it's happening with ...
0
votes
0answers
9 views

WordPress salts set in config and database [migrated]

I have come across the following code in a new clients existing website in wp-config.php define('AUTH_KEY', 'put your unique phrase here'); define('SECURE_AUTH_KEY', 'put your unique phrase ...
0
votes
0answers
4 views

AJAX and GOOGLEAPIS.COM [migrated]

I do know for a fact (because I use it myself) that plain AJAX calls successfully reach the host at ajax.googleapis.com This seems to violate the rule that such calls should only go to the originating ...
0
votes
1answer
32 views

Restricting access using IP address / Network Redirection?

I have a situation where we have a web server (lets call it A) that is hosting a set of HTTP based services. Due to some client restrictions, this web server is not open to the outside world but ...
2
votes
2answers
92 views

WordPress keeps redirecting my users to install.php, Is it caused by an injection hack?

I don't really know how to express my problem, so bear with me. This is a bit hard to explain. I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the ...
2
votes
2answers
120 views

Parallel website running a copy of my original website

We have been working on a gaming website. Recently while making note of the major traffic sources, I noticed a website that I found to be a carbon-copy of our website. It uses our logo, and everything ...
2
votes
1answer
88 views

Can forwarding https://example.com requests to https://www.example.com be a security risk?

I maintain a retail store's eCommerce website, provided by a 3rd party. The HTTPS links do not load ('ERR_CONNECTION_TIMED_OUT') unless you put in the WWW before the doman name. The HTTP links forward ...
1
vote
1answer
32 views

Privacy concern to track every user actions in your website?

We are building a system that track every user (logged in) actions, e.g. click, pageview, duration etc and store into a database. So all the user activities will be known and we are using them to ...
6
votes
2answers
591 views

Online gift certificates: Systems to avoid fraud

What good methods are there out there for avoiding fraud with electronic gift certificates (ones which are created and the information distributed electronically via website)? I'm looking to ...
1
vote
1answer
155 views

Permissions & File Structure w/ nginx & multiple sites

I am using nginx for the first time as a long time Apache user. I setup a Linode to test everything and to eventually port over my websites. Previously I had /home/user/www (wwwroot) I am looking ...
3
votes
3answers
191 views

How to deal with malicious domain redirections?

It is possible for anybody to buy a domain name containing negative terms and point it to someone's website in order to damage their reputation. For instance someone could buy the domain ...
4
votes
2answers
77 views

Making HTML5 videos stored on AWS S3 **difficult** to download (because I cant make it impossible)

I am building a website that hosts video's stored on AWS's S3 service. The videos are played thru a HTML5 player we have built. Ive just been asked to make sure "nobody can steal our video's". Now I ...
3
votes
1answer
46 views

Nginx and Google Appengine Reverse Proxy Security

The scenario is that I have a Google compute node running Nginx as a reverse proxy to the google appengine. The appengine is used to service REST calls from an single page application (SPA). HTTPS ...
3
votes
2answers
49 views

Can Joomla have a different URL for backend management?

My site will be maintained mostly by myself, and maybe 1 or 2 others. I want to know if it's possible if the back end can be managed from a different folder structure? ie. www.example.com <- user ...
0
votes
0answers
14 views

How to clean PmWiki from JS:Includer-AWG and protect my site from future infections?

I'm hosting a site for an NGO for several years now. The site seems to be based on a PmWiki backend. I don't know much details because I'm just hosting the site and I'm not the guy who set it up. I ...
2
votes
2answers
225 views

What are the Pros and Cons for password recovery change links in email?

Although a lot of sites still send your password in plain text through email, there has been a push to send a web page url instead. But how can that be any more secure than the password in clear ...
0
votes
0answers
46 views

Concrete5-based site hacked

It seems my Concrete5-based site has been hacked - found this in my default and homepage templates footers: <div style="position:absolute;left:-6397px;"> <a ...
0
votes
1answer
31 views

Is Google App Engine secure enough for financial applications?

I am wondering whether Google App Engine is secure enough for financial applications? This would involve storing sensitive information, access to users' funds, etc. Are there any applications like ...
0
votes
1answer
43 views

How to block entire IPs of a VPN server by IP

I have website that identifies users only by their IPs. That makes it very difficult to keep it secure against unwanted users/attackers. They can simply change their IP by using VPN services that ...
1
vote
0answers
19 views

Hacked Wordpress site - Mobile Users only [closed]

My site has been hacked for users of mobiles only. I searched for advice here and found some advice but I couldn't see that it applied to my site nor could I fully understand the concepts. Does anyone ...
1
vote
1answer
21 views

How to change cPanel URL? Example: mydomain.com/cpanel

I want to change my website's cPanel URL/path for security reasons. I have a VPS with shell root access, running centOS 6.5 64-bit. I want to change cPanel path for my website on the VPS to be ...
1
vote
2answers
2k views

prevent IIS from executing scripts in a specific directory

I have a php web application that allows file uploads to a specific directory. I would like to prevent the execution of any file that is uploaded into that directory whether it is ASP, PHP, or ...
1
vote
1answer
44 views

Preventing Unvalidated Redirects

I have a project I'm working on, and I recently decided to add a "login bounceback" to my site. The idea is simple, and very common: The user is browsing the site, and runs into something they need to ...
0
votes
2answers
47 views

Emails from joomla 2.5 being marked as “Phishing” mails for vendor and client

The Mails from Joomla to customer as well as vendor are being marked as "phishing" mails. As per solutions provided in the other posts, I checked the header and it is being marked as "Spf-Fail". What ...
1
vote
1answer
68 views

My Server is returning a 404 instead of 403 when access if forbidden - is it good or bad?

via .htaccess, I forbid access to folders that have no index page inside (domain.com/images for example), and also block my site completely for several user-agents (such as wget). When I test to see ...
1
vote
3answers
34 views

AVG says web site is not secure

Recently a co-worker viewed our site from a different location. He said that AVG came up and said the site was not secure and blocked the site. However, when I run the site through AVG it says the ...
3
votes
2answers
65 views

How to hide existence of a private blog?

I have a friend who would like to start a 'blog'. The problem is that she would like it to be private so that only people invited can read it. So I told her to use a private WordPress. But she said ...
13
votes
5answers
546 views

Force Using SSL on Site now?

I am starting to see a majority of websites starting to use SSL as a standard practice for viewing the website securely now thanks to the revelations of Edward Snowden about the NSA surveillance that ...
1
vote
1answer
62 views

Hide website data for Chrome and FF addons: IP Whois & Flags Chrome & Norton

I've got this addon and want to hide the information they publish for our website. They show Popularity, IP address info, nameservers, etc. Plus the traffic levels they report, 'popularity' reflects ...
1
vote
2answers
25 views

eCommerce checkout security

I'm developing an eCommerce site and using SagePay as a card processor. Customers will enter their delivery/invoice details into a form which is then submitted to a checkout page. This page encrypts ...
4
votes
2answers
476 views

Trigger IP ban based on request of given file?

I run a website where "x.php" was known to have vulnerabilities. The vulnerability has been fixed and I don't have "x.php" on my site anymore. As such with major public vulnerabilities, it seems ...
9
votes
3answers
539 views

Does SSL really matter for most websites?

I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL. I've read plenty of ...
2
votes
2answers
199 views

How to block user agent from accessing my WordPress site with htaccess?

I have noticed large amount of traffic coming to my site from different IP's with user agent. Mozilla/5.0 (compatible; SiteExplorer/1.0b; +http://siteexplorer.info/) I don't have much experience ...
2
votes
1answer
56 views

What was this hack-bot trying to achieve via directory traversal?

I was walking through my server logs and the following kinda stunned me: ACCESS ERROR 404 from IP 62.112.152.161: Path: /index.php?page=weblog&env=../../../../../../../../etc/passwd%00 ...
1
vote
2answers
36 views

Risk of Plaintext Email Addresses on Websites

What are the risks of putting a personal email address (Gmail, in case it matters) on a personal website? A glance around any forum will show many people using "address [at] domain.com" instead of ...
6
votes
3answers
156 views

Why don't we see websites hashing passwords before sending them? [closed]

(Note about the question title: by "we" I mean myself) Everytime I log on to any website, I have this thought that website asking me for my password and sending it back to the server is just basic ...
0
votes
0answers
21 views

Introduce security for web-service

This questions is with respect to including security in our architecture.Let me give a brief over-view. We have REST based web-service (Let's call it A) which is used by our web application and the ...
3
votes
1answer
81 views

Strange series of page visits to my web site

In my web log I see 5 hits (to the same web page) all about the same time but from different parts of the world: 180.247.114.192 /RelFinder?personId=17586 - From: null 2014-01-10 00:26:40.0 ...
3
votes
1answer
64 views

Our Website is being blocked in critical areas - how do I get to the bottom of this?

I'm working with a UK-based contractor in the counter-terrorism industry. I've noticed that when I'm in Virginia Beach (near Norfolk and Washington DC), I cannot get a connection to the website ...
0
votes
2answers
72 views

Keep a Servlet/JSP web site always on SSL?

How to I keep a site always on SSL with padlock symbol always exists. Is there any way to optimize the page for SSL in JSP and Servlets ? Just tell about jsp and servlet optimization so answer do not ...
2
votes
1answer
45 views

Securing webserver from spam/phishing/malware - beyond RBLs?

We offer a service that requires URLs from our domain to be linked to external URLs. About ten years ago, we discovered that this functionality can be abused by miscreants -- to link to malicious ...
13
votes
1answer
187 views

Could somebody hijack my Google Analytics for a site?

I track many websites in Google Analytics. Recently I accidentally added tracking code for site A to site B, which I noticed a couple of weeks later. By then, one website had two weeks of no visitors, ...
2
votes
2answers
40 views

Major spam issue… CAPTCHAs and email verification aren't working [duplicate]

We have a user who claims to have a vendetta against our community. We run a fairly large social networking website, and for the past four or five weeks, this particular person (or maybe people?) has ...
2
votes
3answers
89 views

How to safely collect bank account from website and without an external gateway payment system

I want to collect bank account information from my customers on my website. I would like to do this using a online form, then I will download it to a PC, print it and then delete it from the website. ...
1
vote
2answers
95 views

Serious Googlebot crawl spike using up a ton of bandwidth

One of the sites I maintain has seen Googlebot use 23gb of bandwidth this month. This seems utterly mental to me, what can I do about it? I have reduced the crawl rate on webmaster tools, and ...