Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

8
votes
3answers
2k views

Prevent spam using Honey Pots

I am really curious about how to prevent comment spam in a forum using a honey pot trap for spam bots. What if CSS and javascript is turned off in a browser? Do you see any other disadvantages in ...
2
votes
1answer
87 views

HTTPS on all pages where user is logged on

I know this is considered best practise to prevent cookie hijacking. I would like to adopt this approach, but ran across a problem on our forum where the users post images which either aren't posted ...
0
votes
2answers
486 views

How can we secure our web application codes?

I have a web application written in the Struts2 framework. I want to host the application with another company. Is there any way to hide the code which is hosted on the server? What I want is to ...
1
vote
2answers
147 views

How to prevent copying of the image folder of your website

How to Prevent copying of the original image folder when the entire website is being copied. Also,what are the measures that should be taken to prevent guessing of the original images.
2
votes
3answers
250 views

Intellectual Property theft from our webserver. What should we do?

So we caught some computers trying to download a ton of files from our webserver, and we stopped them before they got much (used iptables to drop their IPs). These were not web crawlers, but scripts ...
0
votes
2answers
110 views

Are there any programs that i can use to test my website against hacks? [duplicate]

Possible Duplicate: Tools to check for common vulnerabilities? Are there any applications out there that can run random queries against my website and try and find holes in it? My ...
13
votes
4answers
238 views

Prevent possible spammer from linking to my site

We own a website which, through google search results, we determined is either being linked to improperly or for spam purposes by another completely random source. They recently registered a domain ...
3
votes
3answers
439 views

How can I prevent users from creating multiple accounts?

I'm building a site that needs to guarantee user reputation scores are accurate by preventing users from creating more than one account, at the cost of decreased user signups. So far, the only ...
1
vote
1answer
243 views

Apache <Directory> blocks

I'm trying to make it so that the outside world can't access a specific section of my website. What I did was: <Directory /Library/WebServer/.../secrets/> Order deny,allow Deny from ...
0
votes
1answer
118 views

What are the types of verification which can be used for a social networking website?

I'm developing a social networking website for a small network. I would like to keep more security on registration process. I would like to keep some verification methods like SMS, Visa and Paypal (if ...
0
votes
2answers
441 views

Resolving a security issue with my private virtual server

When I search for "thelab athome-training" on Google, and click on a link that point to my site (thelab.athome-training.com), I am redirected to http://grooogle.osa.pl I googled and found that post: ...
0
votes
1answer
43 views

Storing Downloadable Content Securely

For a site where users can purchase videos for download. What would be the best way to store the media? Any other helpful considerations are more than welcome. Outside the root directory? Seperate ...
1
vote
3answers
65 views

fake returning visitor

I have a Live Support app installed on my website and I see a visitor every day, all day long for the last 3 months. This visitor has 3 or more IP addresses, but doesn't change them too often. It ...
4
votes
7answers
432 views

Hacked by our own hosting company!

OK, so our hosting company decided to clone our site and database onto a new serve. Without our knowledge or permission they then edited our code to point to the new database. The old server was left ...
2
votes
2answers
65 views

How to block certain pages/files of a web domain?

How do I make certain pages only viewable by me? For example, let's say I own mydomain.com, and I want to be the only one that can see mydomain.com/mypage.php. I tried changing the permissions of ...
4
votes
1answer
102 views

How to promote the quality/security of your a website to your its customers?

Our organization is building a Drupal web platform that we aim at reselling as a cloud service. In order to provide our customers with maximum confidence in our solution, we're looking at ways of ...
4
votes
1answer
92 views

What makes a SSL certificate “signed”?

When you buy a SSL certificate from Comodo, it is signed by Comodo and therefore trusted. How is it signed though? Why can't anyone sign the certificate pretending to be Comodo?
3
votes
4answers
244 views

Removing CAPTCHA is harmful for my forms?

I have some services on my site that developed by PHP , it seems having CAPTCHA in my registration form is decreasing registering users , I tend to remove CAPTCHA at least on my registering form , is ...
2
votes
1answer
204 views

Is SimplePHPBlog a secure blogging engine?

Has anyone used the blog engine SimplePHPBlog? It is a simple blog engine that uses only text files (no database). My problem with it is that the content directory where the texts files are stored ...
9
votes
1answer
391 views

Why chmod 777 is not secure?

chmod 777 file change the permissions of the file file to read, write, and execute for all. Ok, so the file can be manipulated in any way by any script on the server. But why is this not ...
1
vote
2answers
59 views

Account suspension on SMS [closed]

Hy Hello all, I have an idea to implement but I hate to copy if it is been used by any other website(s). My idea is about suspending an account using text SMS. The description follows. When a user ...
1
vote
1answer
54 views

How can a website survive an untrusted environment?

Let's say I have an internal website that holds pretty important data (well, contest strategies for stuff like FIRST), which I am bound to host on a Windows server with literally no security. I can't ...
2
votes
0answers
129 views

Fake Windows Security Alert [closed]

I have a website which is redirecting users to a fake windows security alert and I'm not to sure how to get rid of it. What's weird is that it's only happening in IE and that it seems to happen the ...
1
vote
1answer
84 views

Anonymous website [duplicate]

Possible Duplicate: How hard is to be the anonymous owner of a website? Is it possible to setup a website anonymously? I want to setup a domain and hosting but I don't want people to be ...
0
votes
3answers
171 views

File Access Permission

I need to upload a file to site with PHP code. How to set permission for upload folder if I want to users cant access to file by URL but PHP code read this file ?
3
votes
1answer
65 views

Cost effective way to provide static media content

I'd like to be able to deliver around 50MB of static content, either in about 30 individual files up to 10MB or grouped into 3 compressed files, around 5k to 20k times a day. Ideally I'd like to put ...
3
votes
2answers
452 views

PCI compliance when using third-party processing

My company is outsourcing the development of our new e-commerce site to a third party web development company. The way they set up our site to handle transactions is by having the user enter the ...
2
votes
2answers
128 views

Deny access to a folder on hosting server but serve the pages

My hosting server allows to host multiple websites. The directory structure is like this root |_ www.a.com |_ www.b.com |_ www.c.com |_ www.d.com I want to put some PHP files on the www.d.com ...
6
votes
1answer
92 views

Is it necessary for a web developer to know how to hack website?

I'm a web developer. I'm just wondering that is it necessary for a web developer to know how to hack website than developing a website?
4
votes
3answers
534 views

client website compromised, found a strange .php file. any ideas?

I do support work for a web development company and I found a suspicious file today on the website of one of our clients called "hope.php" which contained several ...
1
vote
1answer
94 views

Site overthrown by Turkish hackers

Go ahead, laugh. I forgot to remove the default admin/admin account on my blog. SOmebody got in and has replaced my homepage with some internet graffiti. I've used .htaccess to replace the page with a ...
6
votes
1answer
297 views

A bounce-rate attack to manipulate SEO?

This is a question to experienced people that might help us shed some light on the issue. We noticed a very strange behavior on our site, in Google Analytics. Some dude from Finland, namely, from ...
2
votes
1answer
79 views

Are there any risks involved in Hosting your website on free webhosts?

I am planning to host my collage project web site on any such free webhost, is it secure or are there any disadvantages or risks or security issues that i may experience if i go for free web-hosting? ...
0
votes
1answer
396 views

someone was able to upload php files without ftp access to my server

I have website in PHP/MYSQL developing using CakePHP framework. Recently it was hacked and someone was able to upload some PHP and JS files and the site was down. The website FTP, control panel etc ...
1
vote
1answer
99 views

Ultimate security checklist

I'm looking for a complete security checklist that will allow me to secure my websites. After some research here is what I got: -use SSL to protect authenticated content -tighten the server TCP/IP ...
5
votes
2answers
533 views

Online gift certificates: Systems to avoid fraud

What good methods are there out there for avoiding fraud with electronic gift certificates (ones which are created and the information distributed electronically via website)? I'm looking to ...
5
votes
3answers
298 views

SSL versus EV SSL

As I understand it, SSL certificates verify the connection between the host and the browser, preventing MITM attacks. Is it true that EV SSL verifies the host itself, thus preventing (in theory) ...
4
votes
2answers
110 views

How to prevent stat sites from getting/publishing my traffic and hosting information?

When I recently googled my website, stat sites came up that had more info on my website than I even knew off the top of my head! Daily traffic, Nameservers, analytics id, etc. I removed google ...
0
votes
1answer
126 views

Apache webserver user setup and security issues

I have a server running Centos 5.6/PHP/MySQL etc that will only host one website all the time. New question Is there any security implication on leaving a single website hosted in the default ...
3
votes
2answers
950 views

What does this code mean that was placed in my hacked Web site?

My website was hacked, with the following code added to the end of the page: <img heigth="1" width="1" border="0" src="http://imgddd.net/t.php?id=########"> (The id had an 8 digit ...
3
votes
2answers
113 views

What are recommended password reset mecanisms?

All, I'm developing a small, non-commercial web app. I'm trying to decide how to help a user who might have lost their password. I need a mechanism that is, in order of priority: 1) User friendly; ...
3
votes
2answers
201 views

I found a SQL injection bug on a public facing website, what should I do?

I found (ridiculously easy to discover) a SQL injection bug on a public facing website. I strongly suspect that in the same database are stored credit card numbers of their customers (although not ...
2
votes
1answer
327 views

How Do I Prevent Users from Accessing a Page More Then Once?

Hi I have a URL say for example http://www.xyz.com/form1.html. Now i need to hide this URL since I dont want people to keep coming back to this URL and using it. What I mean is I need this URL to be ...
1
vote
0answers
145 views

Is posting a document with a hand signature insecure? [closed]

Every once and a while, one of our departments would like to post a hand-signed document on the web site. Up until now I've scanned them in as a PDF and posted them without much thought, but recently ...
4
votes
3answers
97 views

How Do You Store Website Backups?

I'm not that great about backing up my site, which is something I want to improve on. Currently, I save backups of my site on my local computer and on an external thumb drive. I was thinking of ...
9
votes
1answer
294 views

Is an externally-hosted subdomain a security risk?

A company I've been developing a web site for wants to keep their current domain, which is something like company.parentcompany.com. Because we wanted to use a different CMS, the parent company ...
4
votes
2answers
149 views

what is website security verification?

I have an ecommerce website and I recently came accross a web page that talks about cyber crime and this has got me wondering what website security verification means. I saw this and I am a bit ...
8
votes
8answers
369 views

What are the reasons to have a two step login? (Username on one page, password on the second.)

So I've recently been encountering more two step login processes, where I'm required to enter my username on one page and my password on a second. I really don't like this pattern, as it requires an ...
7
votes
5answers
214 views

What do I need to do to enable my site to accept credit cards?

I want to store my customers' credit card information in my database so that they can quickly check out again without having to re-enter their info. What do I need to know about security/https/etc to ...
2
votes
1answer
1k views

How do I save user uploaded files outside of the web folder but use them on my page?

I have read that one of the best things to do for security with user uploaded files is to store them outside of the web folder, as there is very little you can do to ensure that that jpg image the ...