Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

2
votes
1answer
62 views

Securing webserver from spam/phishing/malware - beyond RBLs?

We offer a service that requires URLs from our domain to be linked to external URLs. About ten years ago, we discovered that this functionality can be abused by miscreants -- to link to malicious ...
2
votes
2answers
43 views

Major spam issue… CAPTCHAs and email verification aren't working [duplicate]

We have a user who claims to have a vendetta against our community. We run a fairly large social networking website, and for the past four or five weeks, this particular person (or maybe people?) has ...
2
votes
3answers
92 views

How to safely collect bank account from website and without an external gateway payment system

I want to collect bank account information from my customers on my website. I would like to do this using a online form, then I will download it to a PC, print it and then delete it from the website. ...
1
vote
2answers
120 views

Serious Googlebot crawl spike using up a ton of bandwidth

One of the sites I maintain has seen Googlebot use 23gb of bandwidth this month. This seems utterly mental to me, what can I do about it? I have reduced the crawl rate on webmaster tools, and ...
3
votes
3answers
69 views

Keeping your text entry fields secure

I've noticed over the past few days someone has been entering text like the following into my comment fields : <a ...
5
votes
2answers
429 views

HTTP for one part of the site, HTTPS for other

We have a site which is HTTP, but it has an admin part. How can we secure the admin part with HTTPS? For example, WordPress (which I know) is located at http://foo.com, but we want to have ...
1
vote
2answers
41 views

Read-only cross origin domain request

Is it possible to allow read-only access in a CORS header? I want JS from two websites to be capable of verifying each other, but not altering each other.
6
votes
3answers
219 views

PayPal Basic vs PayPal Pro and credit card security

This link provides a comparison between PayPal Basic and PayPal Pro plans. To me basic PayPal is ideal but I need to be able to transfer funds between two PayPal accounts and for that I have to ...
0
votes
0answers
18 views

Should I use HTTPS for my WordPress blog? [duplicate]

In general I am aware of what SSL does and how, but I'm not exactly sure as to what's the accepted custom, i.e. whether I actually am supposed to use it for my blog. There will be no other users than ...
1
vote
2answers
338 views

How can I allow robots access to my sitemap, but prevent casual users from accessing it?

I am storing my sitemaps in my web folder. I want web crawlers (Googlebot etc) to be able to access the file, but I don't necessarily want all and sundry to have access to it. For example, this site ...
3
votes
3answers
2k views

Do internal intranet websites need to be secure?

The question is in the title. Does an internal site need to have https security? For example we have an internal site that handles our client's license keys -- do we need for that to be secure since ...
2
votes
2answers
234 views

How to set restrictions on my website?

Currently my website is under maintenance. I want to be the only person who's able to access/view the website online until I finish maintenance. How to set restrictions to others ? I hate stalkers.
1
vote
1answer
47 views

Securing cPanel and WHM

Is there a way I can trace users who log in in my cPanel and WHM? I know about cPHulk but it just records users who attack the server. I just want to record every user their IP address that log into ...
1
vote
1answer
130 views

Extra configuration needed after installing SSL certificate?

We recently developed two rather simple PHP applications for AXA (European bank). URL's are axa.tfo.be/incentives/cipres and axa.tfo.be/incentives/zrkk (access to both sites is restricted to visitors ...
1
vote
5answers
155 views

How do webmasters store and keep track of their passwords [closed]

I'm developing a site for the first time, and I'm trying to work out the best way to store and track all the accounts/passwords e.g. Server passwords, ftp passwords, API passwords (FB, Google, ...
0
votes
1answer
71 views

How to know if my web site is blocked in China (Great Firewall of China) [duplicate]

I have a new site (with new domain), when I access it from China, it is being blocked. As the domain is a new domain, I am wondering if it is due to the site domain or in fact the IP we used is being ...
2
votes
1answer
822 views

How to properly deny Railo directory access through Apache

I've been battle tested on this and failed to achieve my goal which is to deny all access to all directories except the Public directory and only allow access to all all other directories with ...
1
vote
0answers
192 views

IIS Not Accepting Active Directory Login Credentials

I have an ASP.NET web form using Microsoft's boilerplate Active Directory login page, set up exactly as suggested. Windows Authentication is activated on the "Default Website" and "MyWebsite" levels, ...
2
votes
2answers
154 views

Will using HTTPS hurt my site's SEO or other statistics?

I've set up a WordPress blog. Since I have to log into it from many different locations/machines, I've also got an SSL certificate, and set up Apache to redirect HTTP to HTTPS. It all works, but I'm ...
2
votes
1answer
1k views

Fail2Ban & Port-Scanning

Is there any filter built into Fail2Ban to temporarily ban any IP addresses which attempt port scanning activities (provided that iptables logs these activities)?
2
votes
1answer
1k views

How to improve WOT score of a site?

I don't understand why my site Trustworthiness and Vendor Reliability are considered bad by WOT. I do not have ADS, I never spammed my site around, I do not have links that point to untrusted sites. ...
1
vote
0answers
77 views

What is the best methods that I should configure WAMP on Windows Server 2008 to be secure and optimized [closed]

I have installed WAMP on Windows server 2008 and put it online and it is working normally but I don't know much about it please help me with regards to blow issues: 1-how to optimize WAMP and Windows ...
3
votes
3answers
2k views

What is deleteme.xxxxxxxx.php

I was going through page hit logs on awstats and I noticed the following two entries: /deleteme.lcivykmt.php /deleteme.nctqicjg.php I was wondering if anyone recognised them and whether I should ...
0
votes
2answers
37 views

Is it safe to leave the Joomla setting “Preview Module Positions” enabled?

Using at least Joomla 2.5 and 3.1. Under the template manager options the setting "Preview Module Positions" must be set to "enabled" for previews to work. My question is, why isn't this feature ...
1
vote
1answer
52 views

Are there considerations for expiring SSL certs for inactive domains?

I have a few domains that have effectively been "retired" though our company plans to keep them registered in perpetuity. However, soon a few of the SSL certs for the inactive domains are set to ...
0
votes
1answer
300 views

Password protecting dynamic URLs in Apache

I am handling many logical files request using the Apache server. To make the path simple I have used mod_rewrite in the httpd.conf. Now I am planning to enforce authentication on these logical file ...
1
vote
1answer
132 views

How to set up a single IP blocklist for multiple sites hosted on the same account

When running multiple sites on the same hosting account, one might find that an attacker has attempted to breach one site. A webmaster may want to block the IP address from all sites hosted in the ...
0
votes
1answer
769 views

What does it mean to infect people with silent java drive?

I've got a weird contact message through my website, claiming they have found a security vulnerability and wonder if I have a bug bounty program. The details they shared: Only what I can say is ...
1
vote
2answers
720 views

Host header vulnerability reported by Acunetix Scanner

I am getting ready to launch a small web app and decided to scan the site with the Acunetix Web Vulnerability Scanner. I was quite pleased with the results for the most part, but the scanner reports a ...
0
votes
1answer
267 views

Creating a backdoor in (your own) PHP website [closed]

I've just built a website for a client and I'm a bit worried he won't pay me once it actually goes live. I've heard there are ways to create a back-door so I could access the website whenever I want. ...
1
vote
1answer
50 views

Is it possible to block access to a DB based on IP?

We're looking to beef up the security on a site, among other things we thought of trying to block access to the DB based on IP (in a similar way you can do a FTP lock dependent on IP), so that only ...
1
vote
2answers
48 views

Lots of suspicious but normal-looking web traffic at a single URL - should I be concerned?

We recently moved some pages around on our site without bothering to put any redirects in place, and we started to notice something interesting. One of the pages we moved was receiving a surprising ...
0
votes
1answer
55 views

What to do on a bogus/scammer site?

We just found out that one of our client's website has a bogus site. The domain name is somewhat similar to our client's name, only matter of word is the difference. What alarms us is this bogus site ...
4
votes
2answers
178 views

Website hack resulting in auto redirect - where to start looking?

My website is being redirected to a non-existent page (/showpage.php) for some users when they hit the homepage. For other users, the site works fine. I have looked in the index.php files and some ...
4
votes
6answers
1k views

Is it dangerous to keep Thumbs.db on a web server?

Windows Thumbs.db system files that are in most of folders were uploaded with all other files from the localhost to the server. Is it dangerous, if you forget to delete them on the server? I am on ...
1
vote
2answers
71 views

Posting public key

Should I put my public PGP key on my website so that people can securely contact me? I have seen personal sites where their public key is at the bottom of the page, such as this site by the computer ...
1
vote
1answer
69 views

Is email forwarder able to keep a copy of my emails?

I have a personal website and a linux host. I have defined an email like me@host.ir which forwards all my emails to my gmail account. I have a security concern about using this email. Because I am ...
2
votes
1answer
397 views

How can I make FTP connections secure in WHM?

For security reasons (since FTP transmits passwords and files in plain text), I want to force users of my shared hosting to use FTPS or SFTP instead of regular FTP. I am using WHM but have limited ...
2
votes
2answers
175 views

Safely backup and migrate a hacked and infected WordPress site

I have an old WordPress site that was on really bad shared hosting and has been hacked into smithereens. It's been compromised by multiple (different) people, as far as I can tell. It's pretty bad! ...
3
votes
2answers
193 views

Is giving a “trusted'” 3rd party FTP access to a subdomain dangerous for the whole domain?

I'm giving a "trusted" 3rd party (I say "trusted" because I've worked with them before, but in reality I don't know them...) access to a development version of my site x.mysite.com. The site is ...
5
votes
1answer
278 views

How to get rid of crawling errors due to the URL Encoded Slashes (%2F) problem in Apache

The Google web crawler has indexed a whole set of URLs with encoded slashes (%2F) for our site. I assume it has picked up the pages from our XML sitemap file. The problem is that the live pages will ...
1
vote
3answers
187 views

Is Plone really without security holes as Wiki article suggests?

According to this wiki article (chapter): http://en.wikipedia.org/wiki/Plone_(software)#Focus_on_Security From 2010 there has not been a single vulnerability. Is this true and Plone is the most ...
0
votes
1answer
536 views

What are the security implications of using Google Analytics?

I'd like to start using an analytics tool (namely Google Analytics) to collect information on how my web app is used, by whom, and what our user's technical capabilities are. As part of the ...
3
votes
2answers
115 views

How do I prevent spam domains from pointing to my site or IP?

I came across an issue where I saw a domain xyz.com that is pointing to mydomain.com. How do I prevent spam domains from pointing to my domain? I read some posts about setting my virtual hosts and ...
53
votes
10answers
4k views

Storing credit card details

I need to store credit card numbers for recurring billing through our 3rd party merchant. Are there any standards I need to adhere to regarding the storage of the details? We've been accepting credit ...
0
votes
2answers
463 views

A safe way to allow upload of all file types?

By default WordPress restricts the file types that can be uploaded to /uploads using the default Media Manager. I know it is possible to manually extend the allowed file types. I also know it is ...
1
vote
2answers
1k views

Is osTicket secure/private enough

I was going to use osTicket as my 'help desk' for my website, however I just got a little bit concerned when I realised that the clients' login details to see their support tickets are only their ...
1
vote
1answer
90 views

Is a security seal or EV SLL more important?

Does anybody know of a survey or study that compares site visitor attitudes/perceptions to security between an EV SSL cert and a security seal? The EV SSL cert will show up green in the URL (like a ...
2
votes
1answer
12k views

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request

I have a joomla website installed and working good. i installed Qlue404 component which redirects 404 page to a custom page., sometimes when i try the symbols ' and some others the 404 page appears ...
1
vote
1answer
102 views

Should I use a 404 or a 403 error for secure content

I have a set of content in my web app that should only be visible if you are logged in. They have not public equivalent, should never be crawled, or otherwise known outside of logged in users of ...