Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

0
votes
1answer
484 views

What does it mean to infect people with silent java drive?

I've got a weird contact message through my website, claiming they have found a security vulnerability and wonder if I have a bug bounty program. The details they shared: Only what I can say is ...
1
vote
2answers
428 views

Host header vulnerability reported by Acunetix Scanner

I am getting ready to launch a small web app and decided to scan the site with the Acunetix Web Vulnerability Scanner. I was quite pleased with the results for the most part, but the scanner reports a ...
0
votes
1answer
195 views

Creating a backdoor in (your own) PHP website [closed]

I've just built a website for a client and I'm a bit worried he won't pay me once it actually goes live. I've heard there are ways to create a back-door so I could access the website whenever I want. ...
1
vote
2answers
39 views

Read-only cross origin domain request

Is it possible to allow read-only access in a CORS header? I want JS from two websites to be capable of verifying each other, but not altering each other.
1
vote
1answer
50 views

Is it possible to block access to a DB based on IP?

We're looking to beef up the security on a site, among other things we thought of trying to block access to the DB based on IP (in a similar way you can do a FTP lock dependent on IP), so that only ...
1
vote
2answers
48 views

Lots of suspicious but normal-looking web traffic at a single URL - should I be concerned?

We recently moved some pages around on our site without bothering to put any redirects in place, and we started to notice something interesting. One of the pages we moved was receiving a surprising ...
0
votes
2answers
72 views

Keep a Servlet/JSP web site always on SSL?

How to I keep a site always on SSL with padlock symbol always exists. Is there any way to optimize the page for SSL in JSP and Servlets ? Just tell about jsp and servlet optimization so answer do not ...
0
votes
0answers
223 views

How to make a web service (.asmx) available to the public through IIS w/ SSL?

Situation: I have written a .asmx web service that I have gotten to work on GoDaddy, hosted in IIS. I now need to get this web service to be available to the public in IIS, but from our local web ...
4
votes
2answers
163 views

Website hack resulting in auto redirect - where to start looking?

My website is being redirected to a non-existent page (/showpage.php) for some users when they hit the homepage. For other users, the site works fine. I have looked in the index.php files and some ...
1
vote
2answers
69 views

Posting public key

Should I put my public PGP key on my website so that people can securely contact me? I have seen personal sites where their public key is at the bottom of the page, such as this site by the computer ...
1
vote
1answer
65 views

Is email forwarder able to keep a copy of my emails?

I have a personal website and a linux host. I have defined an email like me@host.ir which forwards all my emails to my gmail account. I have a security concern about using this email. Because I am ...
2
votes
2answers
125 views

Safely backup and migrate a hacked and infected WordPress site

I have an old WordPress site that was on really bad shared hosting and has been hacked into smithereens. It's been compromised by multiple (different) people, as far as I can tell. It's pretty bad! ...
2
votes
1answer
116 views

How can I make FTP connections secure in WHM?

For security reasons (since FTP transmits passwords and files in plain text), I want to force users of my shared hosting to use FTPS or SFTP instead of regular FTP. I am using WHM but have limited ...
3
votes
2answers
135 views

Is giving a “trusted'” 3rd party FTP access to a subdomain dangerous for the whole domain?

I'm giving a "trusted" 3rd party (I say "trusted" because I've worked with them before, but in reality I don't know them...) access to a development version of my site x.mysite.com. The site is ...
0
votes
1answer
424 views

What are the security implications of using Google Analytics?

I'd like to start using an analytics tool (namely Google Analytics) to collect information on how my web app is used, by whom, and what our user's technical capabilities are. As part of the ...
1
vote
3answers
153 views

Is Plone really without security holes as Wiki article suggests?

According to this wiki article (chapter): http://en.wikipedia.org/wiki/Plone_(software)#Focus_on_Security From 2010 there has not been a single vulnerability. Is this true and Plone is the most ...
0
votes
1answer
54 views

What to do on a bogus/scammer site?

We just found out that one of our client's website has a bogus site. The domain name is somewhat similar to our client's name, only matter of word is the difference. What alarms us is this bogus site ...
1
vote
2answers
716 views

Is osTicket secure/private enough

I was going to use osTicket as my 'help desk' for my website, however I just got a little bit concerned when I realised that the clients' login details to see their support tickets are only their ...
0
votes
2answers
286 views

A safe way to allow upload of all file types?

By default WordPress restricts the file types that can be uploaded to /uploads using the default Media Manager. I know it is possible to manually extend the allowed file types. I also know it is ...
1
vote
1answer
84 views

Is a security seal or EV SLL more important?

Does anybody know of a survey or study that compares site visitor attitudes/perceptions to security between an EV SSL cert and a security seal? The EV SSL cert will show up green in the URL (like a ...
1
vote
1answer
84 views

Should I use a 404 or a 403 error for secure content

I have a set of content in my web app that should only be visible if you are logged in. They have not public equivalent, should never be crawled, or otherwise known outside of logged in users of ...
0
votes
1answer
69 views

Website is alerted with firefox as damaging/infected. Remove site from 'blacklist'

My website is alerted as malicious/infected by firefox, so users can't have normal experience atm. All threats are removed and website is clean. How I can remove my website from this 'blacklist'? ...
0
votes
2answers
159 views

How to double protect admin access in PyroCMS

I have read how to protect admin folder with .htaccess and .htpasswd file but in PyroCMS admin login (ex: example.com/admin) just only routing system (no admin folder yet). So, how can I double ...
1
vote
1answer
80 views

How to respond to attack on web site

I have wordpress site that is under some kind of bot attack. I checked apache logs and there's get request to a single post on my blog every second (sometimes there's more than one per second). When ...
0
votes
1answer
53 views

General question as a new webmaster [closed]

I am wanting to make my own social forum for friends and workers. I will have about 10,000-15,000 users. I have never made a forum on such a high scale and to this point have only been a developer ...
6
votes
3answers
205 views

Is website security accreditation worth having?

My site handles sensitive data, is there any website security accreditation that is well respected and worth having?
2
votes
0answers
59 views

Good security practice for writing a php/mysql web app [closed]

I'm about to create a web app that is php/mysql based. It should contain multiple users and two levels of admin accounts. It will most likely not be very likely to be attacked in any way. Still I am ...
11
votes
3answers
137 views

Is it sufficient to secure a order status page just by a random URL?

After a (corporate) customer bought some items in our online shop, we send an email with an overview what he has bought to him. We'd like to inform our customer about received payments, packet ...
1
vote
4answers
190 views

Website Systematically Blocking IP Addresses

I have a series of websites hosted at the same server. The issue I am having is that it keeps blocking me access from different means to the sites. Allow me to explain: From my IP, Blocked. From ...
0
votes
2answers
32 views

Using SSL Certification in Multiple Locations

I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access. The ...
2
votes
2answers
99 views

How do I prevent spam domains from pointing to my site or IP?

I came across an issue where I saw a domain xyz.com that is pointing to mydomain.com. How do I prevent spam domains from pointing to my domain? I read some posts about setting my virtual hosts and ...
0
votes
1answer
23 views

Web server with or without Panel [closed]

I start a Web server for my company for hosting about 15 website and I didn't install a Control Panel, I do everything by command and i'm pretty comfortable with it but do you think i'm losing time by ...
1
vote
1answer
513 views

Site got hacked while many / all security leaks have been removed [closed]

I've got a website with this code appended to my php document : <? #8f4d8e# ...
1
vote
5answers
138 views

How do webmasters store and keep track of their passwords [closed]

I'm developing a site for the first time, and I'm trying to work out the best way to store and track all the accounts/passwords e.g. Server passwords, ftp passwords, API passwords (FB, Google, ...
6
votes
1answer
495 views

Security: Hide mysql connection details file

Ok, so I know this must be a very basic question, but my problem is the following: I have developed my first PHP mini-app (so I'm fairly new to this) and I am pretty sure that there are two files of ...
2
votes
2answers
195 views

Any suggestions for a change detection system?

As a webdesigner/webmaster I'm taking care of various websites. Recently one client's website got "hacked". It turned out that at their office one computer got infected by a trojan, that spied the ftp ...
2
votes
1answer
765 views

How to log username in Apache logs?

I need some help regarding how to log the user-name into apache logs. I'm building a use-case for Security Information Event Management. Is the method the same in case of IIS or just applicable to ...
2
votes
1answer
460 views

Pass IMG SRC via GET and echo it? Is that really secure?

I was wondering how I can make a really simple GET and echo request more secure The code: $src = $_GET['src']; echo "<img src='$src' />"; Basically, I have a URL like ...
3
votes
2answers
94 views

How to safely saving users' data and NOT get responsibility of users' data?

I am programming a website which will save up users' inputs for their next visits. For example, I might save their phone numbers. The user will know that I save their phone numbers. However, do I need ...
1
vote
1answer
28 views

Compromised private RSA key

What sorts of problems can be caused by a compromised private RSA key? Is this even that big of a deal? I'm getting very little specific info on Google. :(
2
votes
2answers
245 views

How to have google index a login protected url?

For example, my site: http://abcde.foobar.com is protected by a "single sign on" login page hosted at http://sso.foobar.com, so when a user visits "abcde", they get redirected to the "sso" login page ...
4
votes
2answers
96 views

What measures should I take after I find one of my scripts being vulnerable?

I maintain a few PHP-based websites for a small company on a LAMP server. The scripts include CMS such as Joomla or Wordpress, as well as SilverStripe and Drupal installations. A week ago, I found ...
3
votes
2answers
196 views

How to remove adware pop up?

I get an ad pop up that should not be on the site. It has only appeared once. The HTML code for the pop up window that appeared: http://pastie.org/5674909 Here is the full HTML pastie: ...
1
vote
1answer
66 views

How to set a 1-order-per-PC limit on my website?

On my website people can order free coupons for my local service. I would like to set a limit of 1 coupon order per PC. Can someone suggest a way to implement this, even if the visitor would delete ...
1
vote
2answers
655 views

GWT “Big traffic change for top URL”

I recently received an email from GWT saying that one of my URL's traffic has suddenly dropped. As it turned out the traffic to the whole site has drastically dropped, from some 300+ unique visitors ...
1
vote
1answer
58 views

Phishing alert but file never existed

I got an alert from Google Webmasters. They say the following file was present in my host: example.com/~jhostgop/identity.php I checked my files and it never existed at all. I've experience this ...
7
votes
4answers
207 views

Webhosting company able to unhash passwords?

Tonight I was using the cPanel of a web-site I host and when I went to change the password I received a warning that I couldn't change the password to my desired password because it was too similar to ...
4
votes
3answers
288 views

Why do websites require retyping the password upon user error in a registration form?

Many times, when you fill out a registration form and miss a required field, the form reloads with all the fields filled out except for the password which you have to retype. I'm wondering if I ...
1
vote
0answers
73 views

What is the most secure environment for multiple CMS sites? [closed]

I wish to run about 50 Joomla or WordPress low-traffic websites on 1 server, or part of a server. Each website will be managed by its own, naive owner who will have be able to access the Joomla or ...
1
vote
1answer
55 views

Multiple SSL certificates under one organization?

Now that I have my LLC formed, I intend to purchase several EV SSL certificates for a few of my popular online stores. My question is if it is possible to purchase and set up several EV SSL ...