Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

1
vote
1answer
557 views

Is the php method md5() secure? Can it be used for passwords? [closed]

So executing a php script causes the form values to be sent to the server, and then they are processed. If you want to store a password in your db than you want it to be a cryptographic hash(so ...
1
vote
3answers
494 views

I own a domain name. Can people view my personal registered info?

Is my information protected? Or can someone tell where I live by my domain name? Why do hosting services offer a protected information service for extra money? How can I view that information?
1
vote
1answer
200 views

www.foobar.com works but foobar.com results in a 'Server not found' error

I have just setup a minimal (hopefully secure? - comments welcome) apache website using the following configuration file: <VirtualHost *:80> ServerName foobar.com ServerAlias ...
1
vote
2answers
381 views

How to fix some damages from site hack?

My site had been hacked. I found vulnerability,fixed it, and removed shell scripts. But hacker had uploaded thousands of web pages on my web server. after I removed those pages I got over 4 thousand ...
1
vote
3answers
971 views

How to prevent Google from finding my admin index page?

I am running a website but for some days i stopped it and put the under-construction page because the Index of admin page is visible to the outside world through the Google search. One of my friend ...
5
votes
1answer
2k views

Why has Apache begun running a single process as root, and another as root and the wwwdata user?

I am running Apache Worker-MPM, PHP 5.3.2, and FCGID. Apache runs better than before, but I noticed that there is an apache process running as root and a second process that runs as both root and ...
4
votes
2answers
363 views

How to use the private and public keys?

I am new to ssl certificates, i wanted to learn about ssl certificates, and I generated private and public keys myself while logged into cpanel, I wonder how to use those and generate a secured ...
10
votes
2answers
551 views

Forum Spam Question. Why are Chinese hackers posting tiny images on my forum

My forum is getting attacked by spammers with Chinese IP's. Replies are created to discussion topics, always short responses and along with the response an image is inserted using forum code which is ...
2
votes
3answers
2k views

How to restrict site access to all countries except mine with .htaccess?

I used this tool to download list in ".htaccess allow" format to allow traffic from my country and restrict all others but it's still accessible when visiting from bunch of foreign proxies. I'm ...
7
votes
3answers
118 views

Found Odd File on Site: Should I Be Concerned?

I found a php file that was uploaded to our web server that had sneaked past our form validation. I did some searching and there was very little information regarding this file, however the small ...
4
votes
2answers
401 views

How would I tell if a prospective client website is under DDoS attack?

I have a person asking me whether the DDoS Mitigation Service they're using is worth it. This is out of my expertise, but clearly at some point someone sold this service to the client. Assuming I ...
3
votes
1answer
102 views

Do I need an SSL Certificate?

I'm thinking about building an app that lets users upload images to sites like Flickr. They would need to enter their password to do this. I would send the data through PHP, do I need to get a SSL ...
0
votes
1answer
65 views

Can I host my PHP app in such a way that users can verify the source code being used by the server?

I have worked with one other person created a mobile-optimized web proxy to the League of Legends Tribunal (a peer review system). Riot Games, the creators of LoL, made a really nice web interface ...
4
votes
1answer
1k views

IIS Dynamic IP Restrictions Module and Googlebot

I consider using IIS Dynamic IP Restrictions Module in order to make it hard for DoS (Denial of Service) attacks. But I am not sure how that would work out for search engine bots like Googlebot. Any ...
2
votes
2answers
442 views

Should WHMCS hacking attemps that never succeed be important to me?

I have WHMCS and I use it with no problem for my hosting purposes. Almost every 2 or 3 days, I can see a spam with malicious content submitted as a new ticket that tries to hack. The last one was: ...
2
votes
2answers
67 views

Securing Access to Server [closed]

We have servers at an ISP and a firewall in place. At our main office, we have a VPN. For an added layer of security, I'm thinking a good model may be to have developers connect to the corporate VPN ...
3
votes
2answers
1k views

Is Someone Hijacking My Site?

I'm quite baffled by this issue and I have absolutely no idea what could be causing it. I have a Wordpress website that has been working fine, until for some reason, the admin panel started to screw ...
0
votes
2answers
544 views

Hacked .htaccess - Inconsistent Results

At present a large number of .htaccess files are being created in various website folders throughout the site. Current .htaccess files are also being modified to include the following (cleaned up) ...
1
vote
1answer
748 views

How to integrate Paypal Direct Payment (i.e. Paypal Pro) with custom shopping cart application?

I've written a basic shopping cart application that is fully functional except for the payment process. I have decided to use PayPal Direct Payment, or "PayPal Pro," but am unsure of how to integrate ...
0
votes
1answer
46 views

Content Delivery Policy setup

I want to secure my website using a Content Security Policy. I'm came up with the following policy: X-Content-Security-Policy: default-src https://www.example.com https://static.example.com; ...
2
votes
1answer
2k views

How can mixed content compromise an entire HTTPS session?

Google Chrome is probably one of the stricter browsers out there in terms of highlighting SSL errors. Most browsers will point out when you are viewing an HTTPS page which loads insecure ...
2
votes
2answers
50 views

How transparent is a randomly named directory or file? [duplicate]

Possible Duplicate: Are files in a hidden directory safe? Let's pretend that I have a website and want to keep personal notes on it. If I make a directory like mysite.com/84eW93e7 or ...
1
vote
2answers
164 views

How to setup SSL to protect secure information

At the moment I have a website running in quite an insecure way, I'll refer to it as example.com. To add better security we're starting to store passwords using bcrypt but we are currently not using ...
1
vote
1answer
376 views

Should I make pages on my website accessible by the admin only? How do I do it?

In my website idea I have got a number of pages that should be accessible by the admin only. Is this a good practice? (amateur alert) Also how do I protect these pages? I know about if ...
2
votes
3answers
377 views

What is necessary to implement HTTPS?

I'm an iPhone Developer and I've recently got into web development. At the moment I have two sites on the internet, and on one of them, I have a very simplistic CMS I've made. Firstly, do I need to ...
2
votes
1answer
357 views

Configuring directory access on a server. .htaccess and alternatives?

I have written a small PHP package/site-template (should I say). It contains a directory data/ that contains some important files that the users should not be able to see. These file should however ...
2
votes
1answer
2k views

Force directory listing even if index.html is present

I have some files in my /www/ directory. Is it true that by simply putting an index.html into that directory, the rest of the files are now "protected from public"? Could an outside hacker still force ...
1
vote
0answers
95 views

Just bought a domain, setting up a couple server applications for the first time [closed]

I recently bought a domain, mainly for website experimentation, game servers and a ventrillo server. I'm running all this from my home computer, and I am using freedns.afraid.org as my dns nameserver. ...
0
votes
1answer
205 views

How to protect the contact us page from spammers? Even using captcha, validation etc I sitll receive spam letters

I have on my site, every field validation + captcha protection + math validation + server scripting validation, but still this a spammer keeps sending me spam mails. Is there any better smarter ...
2
votes
1answer
289 views

How to monitor outgoing server activity to detect malware?

I have a website that has previously been victim of malware. I restored the site from an old backup and have made every effort to lock down the server. I have no way to be absolutely certain that the ...
5
votes
2answers
103 views

Hiring security auditors…what should I know?

I want to hire someone to do a security audit of my website but I'm not sure how to go about it. Where are good places to look for an auditor? Besides a list of referrals, what should I be looking ...
1
vote
1answer
122 views

Extra configuration needed after installing SSL certificate?

We recently developed two rather simple PHP applications for AXA (European bank). URL's are axa.tfo.be/incentives/cipres and axa.tfo.be/incentives/zrkk (access to both sites is restricted to visitors ...
6
votes
2answers
156 views

Does https site needs extra configuration after installation of SSL certificate?

I recently developed an incentive website for a European bank, and one of the requirements was SSL - the website displays some personal customer data (though no financial or really sensitive data). ...
0
votes
1answer
1k views

IIS7.5 + Wordpress + Restrict Access to wp-login.php by client IP address

I am moving from an Apache host to IIS. One of my sites in Wordpress (running Multi-site) which give me multiple blogs. I have moved all my rules from my .htaccess to the Microsoft URL ReWrite module. ...
6
votes
1answer
107 views

What secure domain registry services exist?

I'm using a domain registry service that only requires a username and password to log in. Are there any domain registry services that require a second factor in addition to a password?
8
votes
3answers
2k views

Prevent spam using Honey Pots

I am really curious about how to prevent comment spam in a forum using a honey pot trap for spam bots. What if CSS and javascript is turned off in a browser? Do you see any other disadvantages in ...
2
votes
1answer
87 views

HTTPS on all pages where user is logged on

I know this is considered best practise to prevent cookie hijacking. I would like to adopt this approach, but ran across a problem on our forum where the users post images which either aren't posted ...
1
vote
2answers
41 views

Blocking path scanning

I'm seeing in my access log a number of request very suspicious: /i /im /imaa /imag /image /images /images/d /images/di /images/dis They part from a known resource (in the above example ...
0
votes
2answers
513 views

How can we secure our web application codes?

I have a web application written in the Struts2 framework. I want to host the application with another company. Is there any way to hide the code which is hosted on the server? What I want is to ...
1
vote
2answers
150 views

How to prevent copying of the image folder of your website

How to Prevent copying of the original image folder when the entire website is being copied. Also,what are the measures that should be taken to prevent guessing of the original images.
0
votes
2answers
111 views

Are there any programs that i can use to test my website against hacks? [duplicate]

Possible Duplicate: Tools to check for common vulnerabilities? Are there any applications out there that can run random queries against my website and try and find holes in it? My ...
1
vote
2answers
98 views

Serious Googlebot crawl spike using up a ton of bandwidth

One of the sites I maintain has seen Googlebot use 23gb of bandwidth this month. This seems utterly mental to me, what can I do about it? I have reduced the crawl rate on webmaster tools, and ...
4
votes
6answers
911 views

Is it dangerous to keep Thumbs.db on a web server?

Windows Thumbs.db system files that are in most of folders were uploaded with all other files from the localhost to the server. Is it dangerous, if you forget to delete them on the server? I am on ...
13
votes
4answers
241 views

Prevent possible spammer from linking to my site

We own a website which, through google search results, we determined is either being linked to improperly or for spam purposes by another completely random source. They recently registered a domain ...
2
votes
3answers
251 views

Intellectual Property theft from our webserver. What should we do?

So we caught some computers trying to download a ton of files from our webserver, and we stopped them before they got much (used iptables to drop their IPs). These were not web crawlers, but scripts ...
4
votes
3answers
472 views

How can I prevent users from creating multiple accounts?

I'm building a site that needs to guarantee user reputation scores are accurate by preventing users from creating more than one account, at the cost of decreased user signups. So far, the only ...
1
vote
1answer
248 views

Apache <Directory> blocks

I'm trying to make it so that the outside world can't access a specific section of my website. What I did was: <Directory /Library/WebServer/.../secrets/> Order deny,allow Deny from ...
2
votes
1answer
11k views

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request

I have a joomla website installed and working good. i installed Qlue404 component which redirects 404 page to a custom page., sometimes when i try the symbols ' and some others the 404 page appears ...
0
votes
1answer
118 views

What are the types of verification which can be used for a social networking website?

I'm developing a social networking website for a small network. I would like to keep more security on registration process. I would like to keep some verification methods like SMS, Visa and Paypal (if ...
1
vote
2answers
4k views

What kind of information can websites collect about a user/client?

This is a multi-part question: 1) What kind of information can websites collect about someone (someone's computer or device) when they visit your website? I know we log IP's, and can determine your ...