Preventing a system from unauthorized access, modification, disruption, or destruction.
7
votes
3answers
1k views
Prevent spam using Honey Pots
I am really curious about how to prevent comment spam in a forum using a honey pot trap for spam bots.
What if CSS and javascript is turned off in a browser?
Do you see any other disadvantages in ...
2
votes
1answer
82 views
HTTPS on all pages where user is logged on
I know this is considered best practise to prevent cookie hijacking. I would like to adopt this approach, but ran across a problem on our forum where the users post images which either aren't posted ...
0
votes
0answers
1k views
How do you determine whether a website is a scam [closed]
What's the best way to determine if a website is a scam. For example, at first sight (no pun intended) the following website seems to be legitimate. But the price of the product is suspiciously low ...
0
votes
2answers
415 views
How can we secure our web application codes?
I have a web application written in the Struts2 framework. I want to host the application with another company. Is there any way to hide the code which is hosted on the server? What I want is to ...
1
vote
2answers
125 views
How to prevent copying of the image folder of your website
How to Prevent copying of the original image folder when the entire website is being copied. Also,what are the measures that should be taken to prevent guessing of the original images.
2
votes
3answers
247 views
Intellectual Property theft from our webserver. What should we do?
So we caught some computers trying to download a ton of files from our webserver, and we stopped them before they got much (used iptables to drop their IPs). These were not web crawlers, but scripts ...
0
votes
2answers
105 views
Are there any programs that i can use to test my website against hacks? [duplicate]
Possible Duplicate:
Tools to check for common vulnerabilities?
Are there any applications out there that can run random queries against my website and try and find holes in it? My ...
13
votes
4answers
228 views
Prevent possible spammer from linking to my site
We own a website which, through google search results, we determined is either being linked to improperly or for spam purposes by another completely random source.
They recently registered a domain ...
3
votes
3answers
324 views
How can I prevent users from creating multiple accounts?
I'm building a site that needs to guarantee user reputation scores are accurate by preventing users from creating more than one account, at the cost of decreased user signups. So far, the only ...
1
vote
1answer
205 views
Apache <Directory> blocks
I'm trying to make it so that the outside world can't access a specific section of my website. What I did was:
<Directory /Library/WebServer/.../secrets/>
Order deny,allow
Deny from ...
0
votes
1answer
107 views
What are the types of verification which can be used for a social networking website?
I'm developing a social networking website for a small network. I would like to keep more security on registration process. I would like to keep some verification methods like SMS, Visa and Paypal (if ...
0
votes
2answers
432 views
Resolving a security issue with my private virtual server
When I search for "thelab athome-training" on Google, and click on a link that point to my site (thelab.athome-training.com), I am redirected to http://grooogle.osa.pl
I googled and found that post:
...
0
votes
1answer
36 views
Storing Downloadable Content Securely
For a site where users can purchase videos for download.
What would be the best way to store the media? Any other helpful considerations are more than welcome.
Outside the root directory?
Seperate ...
1
vote
3answers
60 views
fake returning visitor
I have a Live Support app installed on my website and I see a visitor every day, all day long for the last 3 months. This visitor has 3 or more IP addresses, but doesn't change them too often. It ...
5
votes
7answers
409 views
Hacked by our own hosting company!
OK, so our hosting company decided to clone our site and database onto a new serve. Without our knowledge or permission they then edited our code to point to the new database. The old server was left ...
2
votes
2answers
58 views
How to block certain pages/files of a web domain?
How do I make certain pages only viewable by me? For example, let's say I own mydomain.com, and I want to be the only one that can see mydomain.com/mypage.php.
I tried changing the permissions of ...
2
votes
3answers
436 views
What is deleteme.xxxxxxxx.php
I was going through page hit logs on awstats and I noticed the following two entries:
/deleteme.lcivykmt.php
/deleteme.nctqicjg.php
I was wondering if anyone recognised them and whether I should ...
4
votes
1answer
96 views
How to promote the quality/security of your a website to your its customers?
Our organization is building a Drupal web platform that we aim at reselling as a cloud service. In order to provide our customers with maximum confidence in our solution, we're looking at ways of ...
4
votes
1answer
83 views
What makes a SSL certificate “signed”?
When you buy a SSL certificate from Comodo, it is signed by Comodo and therefore trusted. How is it signed though? Why can't anyone sign the certificate pretending to be Comodo?
5
votes
3answers
181 views
PayPal Basic vs PayPal Pro and credit card security
This link provides a comparison between PayPal Basic and PayPal Pro plans. To me basic PayPal is ideal but I need to be able to transfer funds between two PayPal accounts and for that I have to ...
3
votes
4answers
210 views
Removing CAPTCHA is harmful for my forms?
I have some services on my site that developed by PHP , it seems having CAPTCHA in my registration form is decreasing registering users , I tend to remove CAPTCHA at least on my registering form , is ...
2
votes
1answer
179 views
Is SimplePHPBlog a secure blogging engine?
Has anyone used the blog engine SimplePHPBlog? It is a simple blog engine that uses only text files (no database).
My problem with it is that the content directory where the texts files are stored ...
9
votes
1answer
294 views
Why chmod 777 is not secure?
chmod 777 file change the permissions of the file file to read, write,
and execute for all.
Ok, so the file can be manipulated in any way by any script on the server. But why is this not ...
1
vote
2answers
59 views
Account suspension on SMS [closed]
Hy Hello all, I have an idea to implement but I hate to copy if it is been used by any other website(s). My idea is about suspending an account using text SMS. The description follows.
When a user ...
1
vote
1answer
54 views
How can a website survive an untrusted environment?
Let's say I have an internal website that holds pretty important data (well, contest strategies for stuff like FIRST), which I am bound to host on a Windows server with literally no security. I can't ...
2
votes
0answers
125 views
Fake Windows Security Alert [closed]
I have a website which is redirecting users to a fake windows security alert and I'm not to sure how to get rid of it. What's weird is that it's only happening in IE and that it seems to happen the ...
1
vote
1answer
72 views
Anonymous website [duplicate]
Possible Duplicate:
How hard is to be the anonymous owner of a website?
Is it possible to setup a website anonymously?
I want to setup a domain and hosting but I don't want people to be ...
0
votes
3answers
163 views
File Access Permission
I need to upload a file to site with PHP code. How to set permission for upload folder if I want to users cant access to file by URL but PHP code read this file ?
3
votes
1answer
61 views
Cost effective way to provide static media content
I'd like to be able to deliver around 50MB of static content, either in about 30 individual files up to 10MB or grouped into 3 compressed files, around 5k to 20k times a day. Ideally I'd like to put ...
3
votes
2answers
295 views
PCI compliance when using third-party processing
My company is outsourcing the development of our new e-commerce site to a third party web development company. The way they set up our site to handle transactions is by having the user enter the ...
2
votes
2answers
110 views
Deny access to a folder on hosting server but serve the pages
My hosting server allows to host multiple websites.
The directory structure is like this
root
|_ www.a.com
|_ www.b.com
|_ www.c.com
|_ www.d.com
I want to put some PHP files on the www.d.com ...
5
votes
1answer
86 views
Is it necessary for a web developer to know how to hack website?
I'm a web developer. I'm just wondering that is it necessary for a web developer to know how to hack website than developing a website?
4
votes
3answers
298 views
client website compromised, found a strange .php file. any ideas?
I do support work for a web development company and I found a suspicious file today on the website of one of our clients called "hope.php" which contained several ...
2
votes
3answers
963 views
Do internal intranet websites need to be secure?
The question is in the title.
Does an internal site need to have https security?
For example we have an internal site that handles our client's license keys -- do we need for that to be secure since ...
1
vote
1answer
90 views
Site overthrown by Turkish hackers
Go ahead, laugh. I forgot to remove the default admin/admin account on my blog. SOmebody got in and has replaced my homepage with some internet graffiti. I've used .htaccess to replace the page with a ...
5
votes
1answer
238 views
A bounce-rate attack to manipulate SEO?
This is a question to experienced people that might help us shed some light on the issue.
We noticed a very strange behavior on our site, in Google Analytics.
Some dude from Finland, namely, from ...
2
votes
1answer
74 views
Are there any risks involved in Hosting your website on free webhosts?
I am planning to host my collage project web site on any such free webhost, is it secure or are there any disadvantages or risks or security issues that i may experience if i go for free web-hosting?
...
0
votes
1answer
250 views
someone was able to upload php files without ftp access to my server
I have website in PHP/MYSQL developing using CakePHP framework. Recently it was hacked and someone was able to upload some PHP and JS files and the site was down. The website FTP, control panel etc ...
1
vote
1answer
92 views
Ultimate security checklist
I'm looking for a complete security checklist that will allow me to secure my websites. After some research here is what I got:
-use SSL to protect authenticated content
-tighten the server TCP/IP ...
5
votes
2answers
318 views
Online gift certificates: Systems to avoid fraud
What good methods are there out there for avoiding fraud with electronic gift certificates (ones which are created and the information distributed electronically via website)?
I'm looking to ...
4
votes
3answers
264 views
SSL versus EV SSL
As I understand it, SSL certificates verify the connection between the host and the browser, preventing MITM attacks. Is it true that EV SSL verifies the host itself, thus preventing (in theory) ...
4
votes
2answers
102 views
How to prevent stat sites from getting/publishing my traffic and hosting information?
When I recently googled my website, stat sites came up that had more info on my website than I even knew off the top of my head! Daily traffic, Nameservers, analytics id, etc.
I removed google ...
0
votes
1answer
114 views
Apache webserver user setup and security issues
I have a server running Centos 5.6/PHP/MySQL etc that will only host one website all the time.
New question
Is there any security implication on leaving a single website hosted in the default ...
3
votes
2answers
926 views
What does this code mean that was placed in my hacked Web site?
My website was hacked, with the following code added to the end of the page:
<img heigth="1" width="1" border="0"
src="http://imgddd.net/t.php?id=########">
(The id had an 8 digit ...
3
votes
2answers
111 views
What are recommended password reset mecanisms?
All,
I'm developing a small, non-commercial web app. I'm trying to decide how to help a user who might have lost their password. I need a mechanism that is, in order of priority:
1) User friendly;
...
3
votes
2answers
185 views
I found a SQL injection bug on a public facing website, what should I do?
I found (ridiculously easy to discover) a SQL injection bug on a public facing website. I strongly suspect that in the same database are stored credit card numbers of their customers (although not ...
49
votes
10answers
2k views
Storing credit card details
I need to store credit card numbers for recurring billing through our 3rd party merchant.
Are there any standards I need to adhere to regarding the storage of the details? We've been accepting credit ...
2
votes
1answer
243 views
How Do I Prevent Users from Accessing a Page More Then Once?
Hi
I have a URL say for example http://www.xyz.com/form1.html. Now i need to hide this URL since I dont want people to keep coming back to this URL and using it. What I mean is I need this URL to be ...
1
vote
0answers
134 views
Is posting a document with a hand signature insecure? [closed]
Every once and a while, one of our departments would like to post a hand-signed document on the web site. Up until now I've scanned them in as a PDF and posted them without much thought, but recently ...
4
votes
3answers
91 views
How Do You Store Website Backups?
I'm not that great about backing up my site, which is something I want to improve on. Currently, I save backups of my site on my local computer and on an external thumb drive.
I was thinking of ...
