Preventing a system from unauthorized access, modification, disruption, or destruction.
0
votes
0answers
50 views
Security of cloud server hosting [closed]
Is cloud hosting by nature more secure or less secure than VPS hosting? I'm having trouble understanding this matter because each hosting company presents cloud server hosting somewhat differently.
0
votes
1answer
40 views
Content Delivery Policy setup
I want to secure my website using a Content Security Policy. I'm came up with the following policy:
X-Content-Security-Policy: default-src https://www.example.com https://static.example.com; ...
0
votes
0answers
37 views
What should i use to start a digital ecommerce shop online [closed]
I have never made a proper site before and i need to know what services to use.
My Site will sell few products and all products are downloads to my programs, but i don't want my programs to be ...
2
votes
1answer
1k views
How can mixed content compromise an entire HTTPS session?
Google Chrome is probably one of the stricter browsers out there in terms of highlighting SSL errors.
Most browsers will point out when you are viewing an HTTPS page which loads insecure ...
2
votes
2answers
45 views
How transparent is a randomly named directory or file? [duplicate]
Possible Duplicate:
Are files in a hidden directory safe?
Let's pretend that I have a website and want to keep personal notes on it.
If I make a directory like mysite.com/84eW93e7 or ...
1
vote
2answers
141 views
How to setup SSL to protect secure information
At the moment I have a website running in quite an insecure way, I'll refer to it as example.com.
To add better security we're starting to store passwords using bcrypt but we are currently not using ...
1
vote
1answer
235 views
Should I make pages on my website accessible by the admin only? How do I do it?
In my website idea I have got a number of pages that should be accessible by the admin only.
Is this a good practice? (amateur alert)
Also how do I protect these pages? I know about
if ...
2
votes
3answers
252 views
What is necessary to implement HTTPS?
I'm an iPhone Developer and I've recently got into web development. At the moment I have two sites on the internet, and on one of them, I have a very simplistic CMS I've made.
Firstly, do I need to ...
2
votes
1answer
289 views
Configuring directory access on a server. .htaccess and alternatives?
I have written a small PHP package/site-template (should I say).
It contains a directory data/ that contains some important files that the users should not be able to see.
These file should however ...
2
votes
1answer
968 views
Force directory listing even if index.html is present
I have some files in my /www/ directory. Is it true that by simply putting an index.html into that directory, the rest of the files are now "protected from public"? Could an outside hacker still force ...
1
vote
0answers
79 views
Just bought a domain, setting up a couple server applications for the first time [closed]
I recently bought a domain, mainly for website experimentation, game servers and a ventrillo server. I'm running all this from my home computer, and I am using freedns.afraid.org as my dns nameserver. ...
0
votes
1answer
171 views
How to protect the contact us page from spammers? Even using captcha, validation etc I sitll receive spam letters
I have on my site, every field validation + captcha protection + math validation + server scripting validation, but still this a spammer keeps sending me spam mails. Is there any better smarter ...
2
votes
1answer
217 views
How to monitor outgoing server activity to detect malware?
I have a website that has previously been victim of malware. I restored the site from an old backup and have made every effort to lock down the server. I have no way to be absolutely certain that the ...
5
votes
1answer
85 views
Hiring security auditors…what should I know?
I want to hire someone to do a security audit of my website but I'm not sure how to go about it. Where are good places to look for an auditor? Besides a list of referrals, what should I be looking ...
0
votes
2answers
123 views
discountasp.net / shared hosting for an ecommerce website [closed]
Is there any disadvantage on using shared hosting in general (of discountasp.net) for an ecommerce website? security concerns or performance? The site is new and we dont expect many visitors right ...
1
vote
1answer
88 views
extra configuration needed after installing SSL certificate?
We recently developed two rather simple PHP applications for AXA (European bank). URL's are axa.tfo.be/incentives/cipres and axa.tfo.be/incentives/zrkk (access to both sites is restricted to visitors ...
6
votes
2answers
114 views
Does https site needs extra configuration after installation of SSL certificate?
I recently developed an incentive website for a European bank, and one of the requirements was SSL - the website displays some personal customer data (though no financial or really sensitive data).
...
0
votes
1answer
900 views
IIS7.5 + Wordpress + Restrict Access to wp-login.php by client IP address
I am moving from an Apache host to IIS. One of my sites in Wordpress (running Multi-site) which give me multiple blogs. I have moved all my rules from my .htaccess to the Microsoft URL ReWrite module. ...
6
votes
1answer
102 views
What secure domain registry services exist?
I'm using a domain registry service that only requires a username and password to log in. Are there any domain registry services that require a second factor in addition to a password?
7
votes
3answers
1k views
Prevent spam using Honey Pots
I am really curious about how to prevent comment spam in a forum using a honey pot trap for spam bots.
What if CSS and javascript is turned off in a browser?
Do you see any other disadvantages in ...
2
votes
1answer
82 views
HTTPS on all pages where user is logged on
I know this is considered best practise to prevent cookie hijacking. I would like to adopt this approach, but ran across a problem on our forum where the users post images which either aren't posted ...
1
vote
2answers
35 views
Blocking path scanning
I'm seeing in my access log a number of request very suspicious:
/i
/im
/imaa
/imag
/image
/images
/images/d
/images/di
/images/dis
They part from a known resource (in the above example ...
0
votes
0answers
1k views
How do you determine whether a website is a scam [closed]
What's the best way to determine if a website is a scam. For example, at first sight (no pun intended) the following website seems to be legitimate. But the price of the product is suspiciously low ...
0
votes
2answers
413 views
How can we secure our web application codes?
I have a web application written in the Struts2 framework. I want to host the application with another company. Is there any way to hide the code which is hosted on the server? What I want is to ...
1
vote
2answers
125 views
How to prevent copying of the image folder of your website
How to Prevent copying of the original image folder when the entire website is being copied. Also,what are the measures that should be taken to prevent guessing of the original images.
0
votes
2answers
105 views
Are there any programs that i can use to test my website against hacks? [duplicate]
Possible Duplicate:
Tools to check for common vulnerabilities?
Are there any applications out there that can run random queries against my website and try and find holes in it? My ...
1
vote
2answers
62 views
Serious Googlebot spike
One of the sites I maintain has seen googlebot use 23gb of bandwidth this month.
This seems utterly mental to me, what can I do about it?
I have reduced the crawl rate on webmaster tools, and ...
2
votes
5answers
471 views
Is it dangerous to keep Thumbs.db on a web server?
Windows Thumbs.db system files that are in most of folders were uploaded with all other files from the localhost to the server.
Is it dangerous, if you forget to delete them on the server?
I am on ...
13
votes
4answers
228 views
Prevent possible spammer from linking to my site
We own a website which, through google search results, we determined is either being linked to improperly or for spam purposes by another completely random source.
They recently registered a domain ...
2
votes
3answers
247 views
Intellectual Property theft from our webserver. What should we do?
So we caught some computers trying to download a ton of files from our webserver, and we stopped them before they got much (used iptables to drop their IPs). These were not web crawlers, but scripts ...
3
votes
3answers
324 views
How can I prevent users from creating multiple accounts?
I'm building a site that needs to guarantee user reputation scores are accurate by preventing users from creating more than one account, at the cost of decreased user signups. So far, the only ...
1
vote
1answer
205 views
Apache <Directory> blocks
I'm trying to make it so that the outside world can't access a specific section of my website. What I did was:
<Directory /Library/WebServer/.../secrets/>
Order deny,allow
Deny from ...
2
votes
1answer
8k views
Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request
I have a joomla website installed and working good. i installed Qlue404 component which redirects 404 page to a custom page., sometimes when i try the symbols ' and some others the 404 page appears ...
0
votes
1answer
107 views
What are the types of verification which can be used for a social networking website?
I'm developing a social networking website for a small network. I would like to keep more security on registration process. I would like to keep some verification methods like SMS, Visa and Paypal (if ...
0
votes
2answers
2k views
What kind of information can websites collect about a user/client?
This is a multi-part question:
1) What kind of information can websites collect about someone (someone's computer or device) when they visit your website?
I know we log IP's, and can determine your ...
0
votes
2answers
432 views
Resolving a security issue with my private virtual server
When I search for "thelab athome-training" on Google, and click on a link that point to my site (thelab.athome-training.com), I am redirected to http://grooogle.osa.pl
I googled and found that post:
...
0
votes
1answer
36 views
Storing Downloadable Content Securely
For a site where users can purchase videos for download.
What would be the best way to store the media? Any other helpful considerations are more than welcome.
Outside the root directory?
Seperate ...
1
vote
3answers
60 views
fake returning visitor
I have a Live Support app installed on my website and I see a visitor every day, all day long for the last 3 months. This visitor has 3 or more IP addresses, but doesn't change them too often. It ...
7
votes
5answers
375 views
Better Spam Protection than reCAPTCHA?
I hope this is a valid question to ask here... but knows anyone a better spam protection than reCAPTCHA? We've now using reCAPTCHA for some time but got now the situation that obviously more and more ...
2
votes
2answers
103 views
Should I store address in encrypted form?
What are the general rules relating to address fields and others. I only store password in encrypted form, the rest are not. Email is also used during login. Can someone give me a suggestion related ...
3
votes
2answers
128 views
Where should I redirect (removed) phishing pages
I was unfortunately the victim of a PHP exploit. Looking through my webserver logs, people are still attempting to reach the URL used in the phish. I want to redirect them to a site that will educate ...
1
vote
2answers
99 views
Opensource package for securly allowing users to log in and provide information
I have a site written in mostly php and html. I also have a sql database of personal information like names and addresses. I would like my users to be able to log in to my website with a login I can ...
2
votes
2answers
58 views
How to block certain pages/files of a web domain?
How do I make certain pages only viewable by me? For example, let's say I own mydomain.com, and I want to be the only one that can see mydomain.com/mypage.php.
I tried changing the permissions of ...
2
votes
3answers
434 views
What is deleteme.xxxxxxxx.php
I was going through page hit logs on awstats and I noticed the following two entries:
/deleteme.lcivykmt.php
/deleteme.nctqicjg.php
I was wondering if anyone recognised them and whether I should ...
4
votes
1answer
83 views
What makes a SSL certificate “signed”?
When you buy a SSL certificate from Comodo, it is signed by Comodo and therefore trusted. How is it signed though? Why can't anyone sign the certificate pretending to be Comodo?
4
votes
1answer
96 views
How to promote the quality/security of your a website to your its customers?
Our organization is building a Drupal web platform that we aim at reselling as a cloud service. In order to provide our customers with maximum confidence in our solution, we're looking at ways of ...
5
votes
3answers
181 views
PayPal Basic vs PayPal Pro and credit card security
This link provides a comparison between PayPal Basic and PayPal Pro plans. To me basic PayPal is ideal but I need to be able to transfer funds between two PayPal accounts and for that I have to ...
3
votes
1answer
106 views
SiteAdvisor advice?
At the time I submitted my site for testing with McAfee's Site Advisor as I noticed my site received a bad review as a spam/scam site. See here
.
From a development perspective, how important are ...
3
votes
4answers
209 views
Removing CAPTCHA is harmful for my forms?
I have some services on my site that developed by PHP , it seems having CAPTCHA in my registration form is decreasing registering users , I tend to remove CAPTCHA at least on my registering form , is ...
1
vote
2answers
402 views
How to block malicious requests before they reach Apache?
I have a RESTful web service that gets hit by a large number of requests coming from various IPs with dummy logins and random inputs. I have already denied these requests at the HTTP level (using the ...
