Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

0
votes
0answers
14 views

Checking security on a shared hosting server [closed]

I am in the process of testing different hosting shared servers and I am very concerned about the security of the server. Thats why I would like to ask for advice on how to do to determine whether a ...
1
vote
0answers
95 views

Atlassian Confluence batch.css blocked by CheckPoint R75 firewall

Our internal firewall is blocking Confluence's batch.css. The error message is: security scanner detected I know that batch.css is made from all other CSS files. I found that icons.css and ...
0
votes
3answers
89 views

Does uploading index.php protect the other files that would normally be visible in that directory?

PHP is a mystery for me. In the FTP main directory of my website, I uploaded 2 files: a.txt and b.txt. If I enter my website address in my browser I can view both a.txt and b.txt. However when I ...
0
votes
1answer
36 views

Securing Linux Servers [closed]

I recently started hosting business and have several cPanel VPS and Dedicated Servers. Recently one of my cPanel Server root password was hacked and got back control after lots of trouble. Can any ...
7
votes
3answers
825 views

Are there any disadvantages to Cloudflare’s “Flexible SSL”?

Cloudflare let you serve your site over SSL without having to purchase and install a security certificate, a product they call “Flexible SSL”. (They act as a proxy and serve your site over SSL from ...
2
votes
2answers
90 views

Incorrect Referring URLs - What can be the cause?

I am running a website with affiliate links . When the visitors of mydomain.com/page.php click on such an affiliate link, they are being sent to a link on a domain owned by the affilate network ...
1
vote
1answer
49 views

Is it safe to let anyone add my site in Google Webmaster Tools?

Google Webmaster Tools allows people to verify site ownership through an existence of a special file. What if I were to create a catch-all rule, and let anyone add my site in their Google Webmaster ...
4
votes
1answer
118 views

What's the point of cross-origin resource sharing if there's a bunch of CORS proxies running?

I never really liked the direction CORS (cross-origin resource sharing) is taking. I think there's a misconception how client-server communication should work. The general concept is: User: Hello ...
3
votes
2answers
84 views

URL hijacked for spam [closed]

I'm the webmaster site/admin for a legitimate site http://cic.nyu.edu, built on drupal 7. I've updated drupal to the latest version. My issue is that it seems as if someone or somebot is using the url ...
0
votes
1answer
24 views

What changes are coming that would reduce the problems assosciated with HTTPS compared to HTTP? [closed]

I have a web site under development. It is used for surveys but there's an advertising component. As it is very new I have used almost all the latest technologies. AngularJS, ASP.NET WebAPI 2 etc. ...
2
votes
1answer
265 views

How can I prevent Facebook from considering Google drive links unsafe on my website?

On my small website I've recently began using Google Drive as content delivery network. This is to solve resource usage issues with my provider. This worked well, but I'm confused because Facebook ...
0
votes
2answers
49 views

Do I need any special permission to have a form that requests a credit card number? Just request, not storing in a database

I'm using PayPal REST API to make calls using credit card numbers. So I have a form that requests credit card number to the users of the site. I could sell or use those credit card numbers that people ...
1
vote
1answer
123 views

Filtering content from response body HTML (mod_security or other WAFs)

We have Apache on Linux with mod_security as the Web App Firewall (WAF) layer. To prevent content injections, we have some rules that basically disable a page containing some text patterns from ...
3
votes
2answers
92 views

Phishing alert but file never existed

I got an alert from Google Webmasters. They say the following file was present in my host: example.com/~jhostgop/identity.php I checked my files and it never existed at all. I've experience this ...
0
votes
0answers
228 views

How to prevent TYNT from inserting Iframes into my site [closed]

I have a wordpress site and since two days ago an iframe is showing up above the </body> tag. The iframes are not always the same and they wont show up everytime, they show up like 90% of the ...
2
votes
0answers
47 views

I would like to share how I configured my Web server for educational reasons. What are the security risks? [closed]

I just finished setting up a server to run a python pyramid application, and while I did not find any guidance on the Internet that helped me, I feel like I could contribute one myself. I'm ...
5
votes
1answer
331 views

How can I protect my PHP source code from a client when installed on a client's server?

I have done a PHP web application and my client request to host it at their server. How can I protect my PHP code so that it will not be viewed, study, or take it for any other usage by my client?
3
votes
1answer
195 views

Why do some Nginx configurations block download agents using Wget?

I noticed that some Nginx configurations block download agents using Wget like this: if ($http_user_agent ~* LWP::Simple|wget) { return 403; } Why block Wget? If I use the above code in my ...
2
votes
1answer
219 views

Can forwarding https://example.com requests to https://www.example.com be a security risk?

I maintain a retail store's eCommerce website, provided by a 3rd party. The HTTPS links do not load ('ERR_CONNECTION_TIMED_OUT') unless you put in the WWW before the doman name. The HTTP links forward ...
1
vote
2answers
56 views

Is there any risk to a network if it allows FTP access to third party websites? [closed]

I was not able to FTP access to my website on my college's network. (The college has a cyberoam-firewalled newtork). It would fail at point when directory listing would show up othewise. I later ...
2
votes
0answers
21 views

Monitor and alert when events have ended [closed]

So I work for a private school, and we have only three I.T. Techs that take care of the entire campus/buildings, as well as the security systems and website. After trying to search google, I haven't ...
1
vote
1answer
53 views

Apache block all requests but my IP using the config file

I'm looking to upload the website that I've developed locally to my remote web server. However, so that I can test that the upload has gone fine and that all the basic security is in place, I want to ...
1
vote
0answers
58 views

Restrict Plesk user for external developer access

We are commissioning an external developer to develop part of our site and he will also need access to a MySQL database attached to the domain but I can't figure out how to create a user that has the ...
0
votes
1answer
84 views

Can anyone buy my registered domain?

Is it possible for anyone to buy a domain that I have already registered? I registered a domain through Moniker and it has not expired yet. But it is displaying available through who.is I can not ...
2
votes
1answer
58 views

How risky is putting sensitive files up on webroot?

I understand that having anything sensitive under webroot is not smart; someone may be able to access it via url. However, I do not have a choice with my web host (iPage) as they limit my server space ...
1
vote
3answers
754 views

WordPress XML-RPC attack

Yesterday I suffered a DDoS attack on a WordPress site. I had 21,443 hits with HTTP Status code 404 and a Bandwidth of 711.85 MB. Also, CPU usage went to 100%. Logs show a lot of this entries: ... ...
0
votes
2answers
95 views

How to block entire IPs of a VPN server by IP

I have website that identifies users only by their IPs. That makes it very difficult to keep it secure against unwanted users/attackers. They can simply change their IP by using VPN services that ...
10
votes
4answers
634 views

Does SSL really matter for most websites?

I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL. I've read plenty of ...
1
vote
1answer
107 views

Server flooded with Wordpress login requests. Need advice [closed]

Recently I was looking at the nginx access logs and found on 2 ocassions a large ammount of requests pointed towards my WP login page. There were over 50.000 requests coming from 2 different IP ...
0
votes
1answer
34 views

Does referrer header checking offer any real world security improvement?

At work we use a central portal that provides basic SSO functionality to other applications. In addition to verifying the SSO data sent, all of our existing in-house applications (used by the public) ...
6
votes
6answers
6k views

Identify “non-secure” content IE warns about [closed]

As many know, if you serve a page over https and the content loads resources (images, stylesheets, js, SWF objects, etc) over http, older versions of Internet Explorer will show the user a warning ...
3
votes
3answers
48 views

Web user authentication methods

Is there any method besides using a DB with username and password for authenticating a user?
1
vote
1answer
1k views

Why do I see requests from BOT/0.1 (BOT for JCE) in my server access log and what should I do about them?

My server keeps getting requests with user agent identified as BOT/0.1 (BOT for JCE). The first one arrived 2013-09-14 22:13:17 CEST, the last one yet about three days ago, 2014-08-12 06:05:39 CEST. ...
0
votes
1answer
226 views

My shared hosting account is sending spam emails

My webhost has deactivated my shared hosting account, since it was sending spam emails through my domain. I have all unrouted mail such as mailto:aasdasd@domain.com set to be forwarded to a specific ...
1
vote
1answer
55 views

How much text does the average person generate per day?

I'm figuring out how to do comment rate limiting, and have decided that I'll keep track of the number of bytes each user (defined as IP address + port) generates on my drive (so, each comment adds a ...
1
vote
2answers
110 views

How do I prevent access to SPAM URLs and remove them from Google's index?

When I started managing my friends' website, I had found a folder in it with a bunch of garbage HTML files with names such as: free-nasscamd-server-31day, gorilla-quentin-trollip-pdf, etc... Assuming ...
1
vote
2answers
144 views

Are there security considerations with choosing shared vs VPS vs dedicated hosting

Are there security disadvantages to using a shared hosting environment instead of a VPS or dedicated server? Could using a shared server or a VPS be considered negligence in the event of a security ...
0
votes
2answers
46 views

Using SSL Certificates with shared hosting/different domain provider

I need to add a HTTPS address to an existing domain. Unfortunately there two companies involved: One for shared web-hosting, and one for the domain. How do SSL Certificated domains work in such ...
3
votes
1answer
1k views

How to protect Google Ads from yontoo layers runtime?

Since sometime I have observed that Google Ads on any website including my blog (http://blogs.digitss.com) gets replaced with something similar to uploaded image below. I am sure it's happening with ...
0
votes
1answer
36 views

Restricting access using IP address / Network Redirection?

I have a situation where we have a web server (lets call it A) that is hosting a set of HTTP based services. Due to some client restrictions, this web server is not open to the outside world but ...
2
votes
2answers
158 views

Parallel website running a copy of my original website

We have been working on a gaming website. Recently while making note of the major traffic sources, I noticed a website that I found to be a carbon-copy of our website. It uses our logo, and everything ...
1
vote
1answer
34 views

Privacy concern to track every user actions in your website?

We are building a system that track every user (logged in) actions, e.g. click, pageview, duration etc and store into a database. So all the user activities will be known and we are using them to ...
6
votes
2answers
841 views

Online gift certificates: Systems to avoid fraud

What good methods are there out there for avoiding fraud with electronic gift certificates (ones which are created and the information distributed electronically via website)? I'm looking to ...
3
votes
3answers
224 views

How to deal with malicious domain redirections?

It is possible for anybody to buy a domain name containing negative terms and point it to someone's website in order to damage their reputation. For instance someone could buy the domain ...
4
votes
2answers
321 views

Making HTML5 videos stored on AWS S3 **difficult** to download (because I cant make it impossible)

I am building a website that hosts video's stored on AWS's S3 service. The videos are played thru a HTML5 player we have built. Ive just been asked to make sure "nobody can steal our video's". Now I ...
3
votes
1answer
135 views

Nginx and Google Appengine Reverse Proxy Security

The scenario is that I have a Google compute node running Nginx as a reverse proxy to the google appengine. The appengine is used to service REST calls from an single page application (SPA). HTTPS ...
3
votes
2answers
63 views

Can Joomla have a different URL for backend management?

My site will be maintained mostly by myself, and maybe 1 or 2 others. I want to know if it's possible if the back end can be managed from a different folder structure? ie. www.example.com <- user ...
1
vote
0answers
41 views

How to clean PmWiki from JS:Includer-AWG and protect my site from future infections?

I'm hosting a site for an NGO for several years now. The site seems to be based on a PmWiki backend. I don't know much details because I'm just hosting the site and I'm not the guy who set it up. I ...
2
votes
2answers
266 views

What are the Pros and Cons for password recovery change links in email?

Although a lot of sites still send your password in plain text through email, there has been a push to send a web page url instead. But how can that be any more secure than the password in clear ...
0
votes
1answer
49 views

Is Google App Engine secure enough for financial applications?

I am wondering whether Google App Engine is secure enough for financial applications? This would involve storing sensitive information, access to users' funds, etc. Are there any applications like ...