Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

0
votes
1answer
263 views

Password protecting dynamic URLs in Apache

I am handling many logical files request using the Apache server. To make the path simple I have used mod_rewrite in the httpd.conf. Now I am planning to enforce authentication on these logical file ...
1
vote
1answer
119 views

How to set up a single IP blocklist for multiple sites hosted on the same account

When running multiple sites on the same hosting account, one might find that an attacker has attempted to breach one site. A webmaster may want to block the IP address from all sites hosted in the ...
0
votes
1answer
618 views

What does it mean to infect people with silent java drive?

I've got a weird contact message through my website, claiming they have found a security vulnerability and wonder if I have a bug bounty program. The details they shared: Only what I can say is ...
1
vote
2answers
567 views

Host header vulnerability reported by Acunetix Scanner

I am getting ready to launch a small web app and decided to scan the site with the Acunetix Web Vulnerability Scanner. I was quite pleased with the results for the most part, but the scanner reports a ...
0
votes
1answer
229 views

Creating a backdoor in (your own) PHP website [closed]

I've just built a website for a client and I'm a bit worried he won't pay me once it actually goes live. I've heard there are ways to create a back-door so I could access the website whenever I want. ...
1
vote
1answer
50 views

Is it possible to block access to a DB based on IP?

We're looking to beef up the security on a site, among other things we thought of trying to block access to the DB based on IP (in a similar way you can do a FTP lock dependent on IP), so that only ...
1
vote
2answers
48 views

Lots of suspicious but normal-looking web traffic at a single URL - should I be concerned?

We recently moved some pages around on our site without bothering to put any redirects in place, and we started to notice something interesting. One of the pages we moved was receiving a surprising ...
0
votes
1answer
54 views

What to do on a bogus/scammer site?

We just found out that one of our client's website has a bogus site. The domain name is somewhat similar to our client's name, only matter of word is the difference. What alarms us is this bogus site ...
4
votes
2answers
170 views

Website hack resulting in auto redirect - where to start looking?

My website is being redirected to a non-existent page (/showpage.php) for some users when they hit the homepage. For other users, the site works fine. I have looked in the index.php files and some ...
4
votes
6answers
1k views

Is it dangerous to keep Thumbs.db on a web server?

Windows Thumbs.db system files that are in most of folders were uploaded with all other files from the localhost to the server. Is it dangerous, if you forget to delete them on the server? I am on ...
1
vote
2answers
71 views

Posting public key

Should I put my public PGP key on my website so that people can securely contact me? I have seen personal sites where their public key is at the bottom of the page, such as this site by the computer ...
1
vote
1answer
67 views

Is email forwarder able to keep a copy of my emails?

I have a personal website and a linux host. I have defined an email like me@host.ir which forwards all my emails to my gmail account. I have a security concern about using this email. Because I am ...
2
votes
1answer
205 views

How can I make FTP connections secure in WHM?

For security reasons (since FTP transmits passwords and files in plain text), I want to force users of my shared hosting to use FTPS or SFTP instead of regular FTP. I am using WHM but have limited ...
2
votes
2answers
150 views

Safely backup and migrate a hacked and infected WordPress site

I have an old WordPress site that was on really bad shared hosting and has been hacked into smithereens. It's been compromised by multiple (different) people, as far as I can tell. It's pretty bad! ...
3
votes
2answers
160 views

Is giving a “trusted'” 3rd party FTP access to a subdomain dangerous for the whole domain?

I'm giving a "trusted" 3rd party (I say "trusted" because I've worked with them before, but in reality I don't know them...) access to a development version of my site x.mysite.com. The site is ...
5
votes
1answer
259 views

How to get rid of crawling errors due to the URL Encoded Slashes (%2F) problem in Apache

The Google web crawler has indexed a whole set of URLs with encoded slashes (%2F) for our site. I assume it has picked up the pages from our XML sitemap file. The problem is that the live pages will ...
1
vote
3answers
172 views

Is Plone really without security holes as Wiki article suggests?

According to this wiki article (chapter): http://en.wikipedia.org/wiki/Plone_(software)#Focus_on_Security From 2010 there has not been a single vulnerability. Is this true and Plone is the most ...
0
votes
1answer
493 views

What are the security implications of using Google Analytics?

I'd like to start using an analytics tool (namely Google Analytics) to collect information on how my web app is used, by whom, and what our user's technical capabilities are. As part of the ...
2
votes
2answers
106 views

How do I prevent spam domains from pointing to my site or IP?

I came across an issue where I saw a domain xyz.com that is pointing to mydomain.com. How do I prevent spam domains from pointing to my domain? I read some posts about setting my virtual hosts and ...
51
votes
10answers
4k views

Storing credit card details

I need to store credit card numbers for recurring billing through our 3rd party merchant. Are there any standards I need to adhere to regarding the storage of the details? We've been accepting credit ...
0
votes
2answers
365 views

A safe way to allow upload of all file types?

By default WordPress restricts the file types that can be uploaded to /uploads using the default Media Manager. I know it is possible to manually extend the allowed file types. I also know it is ...
1
vote
2answers
871 views

Is osTicket secure/private enough

I was going to use osTicket as my 'help desk' for my website, however I just got a little bit concerned when I realised that the clients' login details to see their support tickets are only their ...
1
vote
1answer
87 views

Is a security seal or EV SLL more important?

Does anybody know of a survey or study that compares site visitor attitudes/perceptions to security between an EV SSL cert and a security seal? The EV SSL cert will show up green in the URL (like a ...
2
votes
1answer
12k views

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request

I have a joomla website installed and working good. i installed Qlue404 component which redirects 404 page to a custom page., sometimes when i try the symbols ' and some others the 404 page appears ...
3
votes
2answers
220 views

How to remove adware pop up?

I get an ad pop up that should not be on the site. It has only appeared once. The HTML code for the pop up window that appeared: http://pastie.org/5674909 Here is the full HTML pastie: ...
1
vote
1answer
94 views

Should I use a 404 or a 403 error for secure content

I have a set of content in my web app that should only be visible if you are logged in. They have not public equivalent, should never be crawled, or otherwise known outside of logged in users of ...
1
vote
2answers
453 views

“only secured content is displayed”

I have a question, I just had a SSL certificate installed on my drupal site using shared hosting... and on the front page now it says "only secured content is displayed" in IE. How do I find which ...
0
votes
2answers
187 views

How to double protect admin access in PyroCMS

I have read how to protect admin folder with .htaccess and .htpasswd file but in PyroCMS admin login (ex: example.com/admin) just only routing system (no admin folder yet). So, how can I double ...
5
votes
2answers
106 views

Hiring security auditors…what should I know?

I want to hire someone to do a security audit of my website but I'm not sure how to go about it. Where are good places to look for an auditor? Besides a list of referrals, what should I be looking ...
5
votes
3answers
229 views

Any tools for measuring the security of a site?

I'm wondering is there any tool for measuring or testing the security of a website ? I've written some ASP.NET web-app , So i would like measure the security of my own application and if there is ...
1
vote
4answers
79 views

Website security

I have a website which uses membership/roles for security. However, I really want this site to be secure. My concern is one day something happens to server and the membership/roles is turned off. Is ...
6
votes
3answers
209 views

Is website security accreditation worth having?

My site handles sensitive data, is there any website security accreditation that is well respected and worth having?
1
vote
3answers
1k views

My website has been hacked/attacked, says “reported attack page”

Three days back my website ganapatihegde.com has been hacked/attacked by some hacker. Now, when anyone tries to see my website, it says "Reported Attack Page!". I am using server provided by Free ...
10
votes
2answers
561 views

Forum Spam Question. Why are Chinese hackers posting tiny images on my forum

My forum is getting attacked by spammers with Chinese IP's. Replies are created to discussion topics, always short responses and along with the response an image is inserted using forum code which is ...
0
votes
1answer
73 views

Website is alerted with firefox as damaging/infected. Remove site from 'blacklist'

My website is alerted as malicious/infected by firefox, so users can't have normal experience atm. All threats are removed and website is clean. How I can remove my website from this 'blacklist'? ...
2
votes
1answer
86 views

How to respond to attack on web site

I have wordpress site that is under some kind of bot attack. I checked apache logs and there's get request to a single post on my blog every second (sometimes there's more than one per second). When ...
0
votes
1answer
54 views

General question as a new webmaster [closed]

I am wanting to make my own social forum for friends and workers. I will have about 10,000-15,000 users. I have never made a forum on such a high scale and to this point have only been a developer ...
2
votes
0answers
59 views

Good security practice for writing a php/mysql web app [closed]

I'm about to create a web app that is php/mysql based. It should contain multiple users and two levels of admin accounts. It will most likely not be very likely to be attacked in any way. Still I am ...
1
vote
4answers
242 views

Website Systematically Blocking IP Addresses

I have a series of websites hosted at the same server. The issue I am having is that it keeps blocking me access from different means to the sites. Allow me to explain: From my IP, Blocked. From ...
11
votes
3answers
139 views

Is it sufficient to secure a order status page just by a random URL?

After a (corporate) customer bought some items in our online shop, we send an email with an overview what he has bought to him. We'd like to inform our customer about received payments, packet ...
1
vote
3answers
510 views

I own a domain name. Can people view my personal registered info?

Is my information protected? Or can someone tell where I live by my domain name? Why do hosting services offer a protected information service for extra money? How can I view that information?
3
votes
2answers
318 views

How to have google index a login protected url?

For example, my site: http://abcde.foobar.com is protected by a "single sign on" login page hosted at http://sso.foobar.com, so when a user visits "abcde", they get redirected to the "sso" login page ...
1
vote
2answers
114 views

1024 bit to 2048 bit certificate differences in how we access our portal

Why now that we have gone from 1024 to 2048 do we need to put the www in front of our portal site when we never used to.
1
vote
2answers
165 views

How to setup SSL to protect secure information

At the moment I have a website running in quite an insecure way, I'll refer to it as example.com. To add better security we're starting to store passwords using bcrypt but we are currently not using ...
0
votes
2answers
34 views

Using SSL Certification in Multiple Locations

I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access. The ...
0
votes
1answer
24 views

Web server with or without Panel [closed]

I start a Web server for my company for hosting about 15 website and I didn't install a Control Panel, I do everything by command and i'm pretty comfortable with it but do you think i'm losing time by ...
1
vote
1answer
519 views

Site got hacked while many / all security leaks have been removed [closed]

I've got a website with this code appended to my php document : <? #8f4d8e# ...
2
votes
1answer
64 views

Password protected website

I need to add a user authentication page before the actual homepage of the website. In Joomla! I just set the website offline and the offline page loads in place of the homepage but then it's ...
1
vote
1answer
11k views

.htaccess password protection generates 500 internal server error

I have created a .htpasswd file using htaccess tools of which I have uploaded to the root of my web hosting space (/public_html is my web root). I created a .htaccess file which referenced the ...
5
votes
3answers
1k views

How To Hide From BuiltWith?

Out of curiosity, does anyone know how builtwith.com works? How does it identify the platform or app a website is using? And most importantly does anyone know how to hide the details from it? Somehow ...