Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

3
votes
2answers
210 views

Parallel website running a copy of my original website

We have been working on a gaming website. Recently while making note of the major traffic sources, I noticed a website that I found to be a carbon-copy of our website. It uses our logo, and everything ...
1
vote
1answer
41 views

Privacy concern to track every user actions in your website?

We are building a system that track every user (logged in) actions, e.g. click, pageview, duration etc and store into a database. So all the user activities will be known and we are using them to ...
6
votes
2answers
1k views

Online gift certificates: Systems to avoid fraud

What good methods are there out there for avoiding fraud with electronic gift certificates (ones which are created and the information distributed electronically via website)? I'm looking to audit/...
3
votes
3answers
260 views

How to deal with malicious domain redirections?

It is possible for anybody to buy a domain name containing negative terms and point it to someone's website in order to damage their reputation. For instance someone could buy the domain child-...
4
votes
2answers
501 views

Making HTML5 videos stored on AWS S3 **difficult** to download (because I cant make it impossible)

I am building a website that hosts video's stored on AWS's S3 service. The videos are played thru a HTML5 player we have built. Ive just been asked to make sure "nobody can steal our video's". Now I ...
4
votes
1answer
201 views

Nginx and Google Appengine Reverse Proxy Security

The scenario is that I have a Google compute node running Nginx as a reverse proxy to the google appengine. The appengine is used to service REST calls from an single page application (SPA). HTTPS ...
3
votes
2answers
69 views

Can Joomla have a different URL for backend management?

My site will be maintained mostly by myself, and maybe 1 or 2 others. I want to know if it's possible if the back end can be managed from a different folder structure? ie. www.example.com <- user ...
1
vote
0answers
54 views

How to clean PmWiki from JS:Includer-AWG and protect my site from future infections?

I'm hosting a site for an NGO for several years now. The site seems to be based on a PmWiki backend. I don't know much details because I'm just hosting the site and I'm not the guy who set it up. I ...
2
votes
2answers
359 views

What are the Pros and Cons for password recovery change links in email?

Although a lot of sites still send your password in plain text through email, there has been a push to send a web page url instead. But how can that be any more secure than the password in clear text?...
0
votes
1answer
57 views

Is Google App Engine secure enough for financial applications?

I am wondering whether Google App Engine is secure enough for financial applications? This would involve storing sensitive information, access to users' funds, etc. Are there any applications like ...
1
vote
1answer
474 views

How to change cPanel URL? Example: mydomain.com/cpanel

I want to change my website's cPanel URL/path for security reasons. I have a VPS with shell root access, running centOS 6.5 64-bit. I want to change cPanel path for my website on the VPS to be ...
1
vote
1answer
163 views

Preventing Unvalidated Redirects

I have a project I'm working on, and I recently decided to add a "login bounceback" to my site. The idea is simple, and very common: The user is browsing the site, and runs into something they need to ...
1
vote
2answers
81 views

Emails from joomla 2.5 being marked as “Phishing” mails for vendor and client

The Mails from Joomla to customer as well as vendor are being marked as "phishing" mails. As per solutions provided in the other posts, I checked the header and it is being marked as "Spf-Fail". What ...
1
vote
1answer
267 views

My Server is returning a 404 instead of 403 when access if forbidden - is it good or bad?

via .htaccess, I forbid access to folders that have no index page inside (domain.com/images for example), and also block my site completely for several user-agents (such as wget). When I test to see ...
2
votes
3answers
46 views

AVG says web site is not secure

Recently a co-worker viewed our site from a different location. He said that AVG came up and said the site was not secure and blocked the site. However, when I run the site through AVG it says the ...
3
votes
2answers
72 views

How to hide existence of a private blog?

I have a friend who would like to start a 'blog'. The problem is that she would like it to be private so that only people invited can read it. So I told her to use a private WordPress. But she said ...
20
votes
5answers
790 views

Force Using SSL on Site now?

I am starting to see a majority of websites starting to use SSL as a standard practice for viewing the website securely now thanks to the revelations of Edward Snowden about the NSA surveillance that ...
1
vote
1answer
78 views

Hide website data for Chrome and FF addons: IP Whois & Flags Chrome & Norton

I've got this addon and want to hide the information they publish for our website. They show Popularity, IP address info, nameservers, etc. Plus the traffic levels they report, 'popularity' reflects ...
1
vote
2answers
32 views

eCommerce checkout security

I'm developing an eCommerce site and using SagePay as a card processor. Customers will enter their delivery/invoice details into a form which is then submitted to a checkout page. This page encrypts ...
2
votes
2answers
1k views

How to block user agent from accessing my WordPress site with htaccess?

I have noticed large amount of traffic coming to my site from different IP's with user agent. Mozilla/5.0 (compatible; SiteExplorer/1.0b; +http://siteexplorer.info/) I don't have much experience ...
2
votes
1answer
237 views

What was this hack-bot trying to achieve via directory traversal?

I was walking through my server logs and the following kinda stunned me: ACCESS ERROR 404 from IP 62.112.152.161: Path: /index.php?page=weblog&env=../../../../../../../../etc/passwd%00 ...
1
vote
2answers
59 views

Risk of Plaintext Email Addresses on Websites

What are the risks of putting a personal email address (Gmail, in case it matters) on a personal website? A glance around any forum will show many people using "address [at] domain.com" instead of ...
6
votes
3answers
164 views

Why don't we see websites hashing passwords before sending them? [closed]

(Note about the question title: by "we" I mean myself) Everytime I log on to any website, I have this thought that website asking me for my password and sending it back to the server is just basic ...
3
votes
1answer
92 views

Strange series of page visits to my web site

In my web log I see 5 hits (to the same web page) all about the same time but from different parts of the world: 180.247.114.192 /RelFinder?personId=17586 - From: null 2014-01-10 00:26:40.0 ...
3
votes
1answer
67 views

Our Website is being blocked in critical areas - how do I get to the bottom of this?

I'm working with a UK-based contractor in the counter-terrorism industry. I've noticed that when I'm in Virginia Beach (near Norfolk and Washington DC), I cannot get a connection to the website ...
0
votes
2answers
76 views

Keep a Servlet/JSP web site always on SSL?

How to I keep a site always on SSL with padlock symbol always exists. Is there any way to optimize the page for SSL in JSP and Servlets ? Just tell about jsp and servlet optimization so answer do not ...
2
votes
1answer
84 views

Securing webserver from spam/phishing/malware - beyond RBLs?

We offer a service that requires URLs from our domain to be linked to external URLs. About ten years ago, we discovered that this functionality can be abused by miscreants -- to link to malicious ...
2
votes
2answers
54 views

Major spam issue… CAPTCHAs and email verification aren't working [duplicate]

We have a user who claims to have a vendetta against our community. We run a fairly large social networking website, and for the past four or five weeks, this particular person (or maybe people?) has ...
3
votes
3answers
108 views

How to safely collect bank account from website and without an external gateway payment system

I want to collect bank account information from my customers on my website. I would like to do this using a online form, then I will download it to a PC, print it and then delete it from the website. ...
1
vote
2answers
202 views

Serious Googlebot crawl spike using up a ton of bandwidth

One of the sites I maintain has seen Googlebot use 23gb of bandwidth this month. This seems utterly mental to me, what can I do about it? I have reduced the crawl rate on webmaster tools, and ...
3
votes
3answers
69 views

Keeping your text entry fields secure

I've noticed over the past few days someone has been entering text like the following into my comment fields : <a href="http://www.distritofederal.df.gov.br/003/00301009.asp?ttCD_CHAVE=101732&...
6
votes
2answers
470 views

HTTP for one part of the site, HTTPS for other

We have a site which is HTTP, but it has an admin part. How can we secure the admin part with HTTPS? For example, WordPress (which I know) is located at http://foo.com, but we want to have https://...
1
vote
2answers
44 views

Read-only cross origin domain request

Is it possible to allow read-only access in a CORS header? I want JS from two websites to be capable of verifying each other, but not altering each other.
6
votes
3answers
239 views

PayPal Basic vs PayPal Pro and credit card security

This link provides a comparison between PayPal Basic and PayPal Pro plans. To me basic PayPal is ideal but I need to be able to transfer funds between two PayPal accounts and for that I have to ...
0
votes
0answers
19 views

Should I use HTTPS for my WordPress blog? [duplicate]

In general I am aware of what SSL does and how, but I'm not exactly sure as to what's the accepted custom, i.e. whether I actually am supposed to use it for my blog. There will be no other users than ...
1
vote
2answers
508 views

How can I allow robots access to my sitemap, but prevent casual users from accessing it?

I am storing my sitemaps in my web folder. I want web crawlers (Googlebot etc) to be able to access the file, but I don't necessarily want all and sundry to have access to it. For example, this site (...
3
votes
3answers
3k views

Do internal intranet websites need to be secure?

The question is in the title. Does an internal site need to have https security? For example we have an internal site that handles our client's license keys -- do we need for that to be secure since ...
1
vote
1answer
55 views

Securing cPanel and WHM

Is there a way I can trace users who log in in my cPanel and WHM? I know about cPHulk but it just records users who attack the server. I just want to record every user their IP address that log into ...
1
vote
1answer
149 views

Extra configuration needed after installing SSL certificate?

We recently developed two rather simple PHP applications for AXA (European bank). URL's are axa.tfo.be/incentives/cipres and axa.tfo.be/incentives/zrkk (access to both sites is restricted to visitors ...
2
votes
5answers
209 views

How do webmasters store and keep track of their passwords [closed]

I'm developing a site for the first time, and I'm trying to work out the best way to store and track all the accounts/passwords e.g. Server passwords, ftp passwords, API passwords (FB, Google, Twitter)...
0
votes
1answer
99 views

How to know if my web site is blocked in China (Great Firewall of China) [duplicate]

I have a new site (with new domain), when I access it from China, it is being blocked. As the domain is a new domain, I am wondering if it is due to the site domain or in fact the IP we used is being ...
2
votes
1answer
929 views

How to properly deny Railo directory access through Apache

I've been battle tested on this and failed to achieve my goal which is to deny all access to all directories except the Public directory and only allow access to all all other directories with ...
1
vote
0answers
307 views

IIS Not Accepting Active Directory Login Credentials

I have an ASP.NET web form using Microsoft's boilerplate Active Directory login page, set up exactly as suggested. Windows Authentication is activated on the "Default Website" and "MyWebsite" levels, ...
2
votes
1answer
2k views

Fail2Ban & Port-Scanning

Is there any filter built into Fail2Ban to temporarily ban any IP addresses which attempt port scanning activities (provided that iptables logs these activities)?
2
votes
1answer
2k views

How to improve WOT score of a site?

I don't understand why my site Trustworthiness and Vendor Reliability are considered bad by WOT. I do not have ADS, I never spammed my site around, I do not have links that point to untrusted sites. ...
3
votes
3answers
4k views

What is deleteme.xxxxxxxx.php

I was going through page hit logs on awstats and I noticed the following two entries: /deleteme.lcivykmt.php /deleteme.nctqicjg.php I was wondering if anyone recognised them and whether I should ...
0
votes
2answers
43 views

Is it safe to leave the Joomla setting “Preview Module Positions” enabled?

Using at least Joomla 2.5 and 3.1. Under the template manager options the setting "Preview Module Positions" must be set to "enabled" for previews to work. My question is, why isn't this feature ...
1
vote
1answer
81 views

Are there considerations for expiring SSL certs for inactive domains?

I have a few domains that have effectively been "retired" though our company plans to keep them registered in perpetuity. However, soon a few of the SSL certs for the inactive domains are set to ...
0
votes
1answer
497 views

Password protecting dynamic URLs in Apache

I am handling many logical files request using the Apache server. To make the path simple I have used mod_rewrite in the httpd.conf. Now I am planning to enforce authentication on these logical file (...
1
vote
1answer
181 views

How to set up a single IP blocklist for multiple sites hosted on the same account

When running multiple sites on the same hosting account, one might find that an attacker has attempted to breach one site. A webmaster may want to block the IP address from all sites hosted in the ...