Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

5
votes
2answers
178 views

Managing accounts on a private website for a real-life community

I'm looking at setting-up a walled-in (i.e. mostly private, with a small public-facing login page) website for a real-life community of people, and I was wondering if anyone has any experience with ...
2
votes
1answer
288 views

How to monitor outgoing server activity to detect malware?

I have a website that has previously been victim of malware. I restored the site from an old backup and have made every effort to lock down the server. I have no way to be absolutely certain that the ...
5
votes
2answers
2k views

How can I secure an installation of MediaWiki?

I want to run an installation of MediaWiki as a Internet-accessible personal wiki, running on wiki.mysite.com. However, I want to ensure that I am the only one who can read and write to this wiki. In ...
2
votes
3answers
2k views

How to restrict site access to all countries except mine with .htaccess?

I used this tool to download list in ".htaccess allow" format to allow traffic from my country and restrict all others but it's still accessible when visiting from bunch of foreign proxies. I'm ...
7
votes
3answers
118 views

Found Odd File on Site: Should I Be Concerned?

I found a php file that was uploaded to our web server that had sneaked past our form validation. I did some searching and there was very little information regarding this file, however the small ...
3
votes
1answer
102 views

Do I need an SSL Certificate?

I'm thinking about building an app that lets users upload images to sites like Flickr. They would need to enter their password to do this. I would send the data through PHP, do I need to get a SSL ...
0
votes
1answer
65 views

Can I host my PHP app in such a way that users can verify the source code being used by the server?

I have worked with one other person created a mobile-optimized web proxy to the League of Legends Tribunal (a peer review system). Riot Games, the creators of LoL, made a really nice web interface ...
2
votes
2answers
66 views

Securing Access to Server [closed]

We have servers at an ISP and a firewall in place. At our main office, we have a VPN. For an added layer of security, I'm thinking a good model may be to have developers connect to the corporate VPN ...
2
votes
2answers
438 views

Should WHMCS hacking attemps that never succeed be important to me?

I have WHMCS and I use it with no problem for my hosting purposes. Almost every 2 or 3 days, I can see a spam with malicious content submitted as a new ticket that tries to hack. The last one was: ...
4
votes
3answers
214 views

Are files in a hidden directory safe?

I have a directory on my ISP's web server, I don't want users to see files inside that directory, so I have a index.html file in it to redirect user to my main page, I wonder someone could still write ...
0
votes
2answers
544 views

Hacked .htaccess - Inconsistent Results

At present a large number of .htaccess files are being created in various website folders throughout the site. Current .htaccess files are also being modified to include the following (cleaned up) ...
1
vote
1answer
747 views

How to integrate Paypal Direct Payment (i.e. Paypal Pro) with custom shopping cart application?

I've written a basic shopping cart application that is fully functional except for the payment process. I have decided to use PayPal Direct Payment, or "PayPal Pro," but am unsure of how to integrate ...
0
votes
1answer
46 views

Content Delivery Policy setup

I want to secure my website using a Content Security Policy. I'm came up with the following policy: X-Content-Security-Policy: default-src https://www.example.com https://static.example.com; ...
2
votes
2answers
105 views

Should I store address in encrypted form?

What are the general rules relating to address fields and others. I only store password in encrypted form, the rest are not. Email is also used during login. Can someone give me a suggestion related ...
2
votes
1answer
2k views

How can mixed content compromise an entire HTTPS session?

Google Chrome is probably one of the stricter browsers out there in terms of highlighting SSL errors. Most browsers will point out when you are viewing an HTTPS page which loads insecure ...
2
votes
2answers
50 views

How transparent is a randomly named directory or file? [duplicate]

Possible Duplicate: Are files in a hidden directory safe? Let's pretend that I have a website and want to keep personal notes on it. If I make a directory like mysite.com/84eW93e7 or ...
2
votes
3answers
375 views

What is necessary to implement HTTPS?

I'm an iPhone Developer and I've recently got into web development. At the moment I have two sites on the internet, and on one of them, I have a very simplistic CMS I've made. Firstly, do I need to ...
1
vote
1answer
375 views

Should I make pages on my website accessible by the admin only? How do I do it?

In my website idea I have got a number of pages that should be accessible by the admin only. Is this a good practice? (amateur alert) Also how do I protect these pages? I know about if ...
2
votes
2answers
114 views

Hacking resources

I'm currently developing a web application which has a lot of javascript working behind it. Before I deploy it (which will take a couple of months), I want to make sure that it is atleast a bit ...
2
votes
1answer
357 views

Configuring directory access on a server. .htaccess and alternatives?

I have written a small PHP package/site-template (should I say). It contains a directory data/ that contains some important files that the users should not be able to see. These file should however ...
35
votes
9answers
2k views

Tools to check for common vulnerabilities?

Are there any good tools (desktop or online) which allow you to check whether your website has common vulnerabilities (e.g. SQL Injection, XSS)?
2
votes
1answer
2k views

Force directory listing even if index.html is present

I have some files in my /www/ directory. Is it true that by simply putting an index.html into that directory, the rest of the files are now "protected from public"? Could an outside hacker still force ...
1
vote
0answers
95 views

Just bought a domain, setting up a couple server applications for the first time [closed]

I recently bought a domain, mainly for website experimentation, game servers and a ventrillo server. I'm running all this from my home computer, and I am using freedns.afraid.org as my dns nameserver. ...
0
votes
1answer
205 views

How to protect the contact us page from spammers? Even using captcha, validation etc I sitll receive spam letters

I have on my site, every field validation + captcha protection + math validation + server scripting validation, but still this a spammer keeps sending me spam mails. Is there any better smarter ...
1
vote
2answers
115 views

Opensource package for securly allowing users to log in and provide information

I have a site written in mostly php and html. I also have a sql database of personal information like names and addresses. I would like my users to be able to log in to my website with a login I can ...
8
votes
3answers
2k views

Prevent spam using Honey Pots

I am really curious about how to prevent comment spam in a forum using a honey pot trap for spam bots. What if CSS and javascript is turned off in a browser? Do you see any other disadvantages in ...
2
votes
1answer
87 views

HTTPS on all pages where user is logged on

I know this is considered best practise to prevent cookie hijacking. I would like to adopt this approach, but ran across a problem on our forum where the users post images which either aren't posted ...
0
votes
2answers
510 views

How can we secure our web application codes?

I have a web application written in the Struts2 framework. I want to host the application with another company. Is there any way to hide the code which is hosted on the server? What I want is to ...
1
vote
2answers
150 views

How to prevent copying of the image folder of your website

How to Prevent copying of the original image folder when the entire website is being copied. Also,what are the measures that should be taken to prevent guessing of the original images.
2
votes
3answers
251 views

Intellectual Property theft from our webserver. What should we do?

So we caught some computers trying to download a ton of files from our webserver, and we stopped them before they got much (used iptables to drop their IPs). These were not web crawlers, but scripts ...
0
votes
2answers
111 views

Are there any programs that i can use to test my website against hacks? [duplicate]

Possible Duplicate: Tools to check for common vulnerabilities? Are there any applications out there that can run random queries against my website and try and find holes in it? My ...
13
votes
4answers
240 views

Prevent possible spammer from linking to my site

We own a website which, through google search results, we determined is either being linked to improperly or for spam purposes by another completely random source. They recently registered a domain ...
4
votes
3answers
469 views

How can I prevent users from creating multiple accounts?

I'm building a site that needs to guarantee user reputation scores are accurate by preventing users from creating more than one account, at the cost of decreased user signups. So far, the only ...
1
vote
1answer
248 views

Apache <Directory> blocks

I'm trying to make it so that the outside world can't access a specific section of my website. What I did was: <Directory /Library/WebServer/.../secrets/> Order deny,allow Deny from ...
0
votes
1answer
118 views

What are the types of verification which can be used for a social networking website?

I'm developing a social networking website for a small network. I would like to keep more security on registration process. I would like to keep some verification methods like SMS, Visa and Paypal (if ...
0
votes
2answers
442 views

Resolving a security issue with my private virtual server

When I search for "thelab athome-training" on Google, and click on a link that point to my site (thelab.athome-training.com), I am redirected to http://grooogle.osa.pl I googled and found that post: ...
0
votes
1answer
45 views

Storing Downloadable Content Securely

For a site where users can purchase videos for download. What would be the best way to store the media? Any other helpful considerations are more than welcome. Outside the root directory? Seperate ...
1
vote
3answers
66 views

fake returning visitor

I have a Live Support app installed on my website and I see a visitor every day, all day long for the last 3 months. This visitor has 3 or more IP addresses, but doesn't change them too often. It ...
4
votes
7answers
443 views

Hacked by our own hosting company!

OK, so our hosting company decided to clone our site and database onto a new serve. Without our knowledge or permission they then edited our code to point to the new database. The old server was left ...
2
votes
2answers
67 views

How to block certain pages/files of a web domain?

How do I make certain pages only viewable by me? For example, let's say I own mydomain.com, and I want to be the only one that can see mydomain.com/mypage.php. I tried changing the permissions of ...
4
votes
1answer
103 views

How to promote the quality/security of your a website to your its customers?

Our organization is building a Drupal web platform that we aim at reselling as a cloud service. In order to provide our customers with maximum confidence in our solution, we're looking at ways of ...
4
votes
1answer
95 views

What makes a SSL certificate “signed”?

When you buy a SSL certificate from Comodo, it is signed by Comodo and therefore trusted. How is it signed though? Why can't anyone sign the certificate pretending to be Comodo?
3
votes
4answers
247 views

Removing CAPTCHA is harmful for my forms?

I have some services on my site that developed by PHP , it seems having CAPTCHA in my registration form is decreasing registering users , I tend to remove CAPTCHA at least on my registering form , is ...
2
votes
1answer
206 views

Is SimplePHPBlog a secure blogging engine?

Has anyone used the blog engine SimplePHPBlog? It is a simple blog engine that uses only text files (no database). My problem with it is that the content directory where the texts files are stored ...
9
votes
1answer
411 views

Why chmod 777 is not secure?

chmod 777 file change the permissions of the file file to read, write, and execute for all. Ok, so the file can be manipulated in any way by any script on the server. But why is this not ...
1
vote
2answers
59 views

Account suspension on SMS [closed]

Hy Hello all, I have an idea to implement but I hate to copy if it is been used by any other website(s). My idea is about suspending an account using text SMS. The description follows. When a user ...
1
vote
1answer
54 views

How can a website survive an untrusted environment?

Let's say I have an internal website that holds pretty important data (well, contest strategies for stuff like FIRST), which I am bound to host on a Windows server with literally no security. I can't ...
2
votes
0answers
130 views

Fake Windows Security Alert [closed]

I have a website which is redirecting users to a fake windows security alert and I'm not to sure how to get rid of it. What's weird is that it's only happening in IE and that it seems to happen the ...
1
vote
1answer
92 views

Anonymous website [duplicate]

Possible Duplicate: How hard is to be the anonymous owner of a website? Is it possible to setup a website anonymously? I want to setup a domain and hosting but I don't want people to be ...
0
votes
3answers
174 views

File Access Permission

I need to upload a file to site with PHP code. How to set permission for upload folder if I want to users cant access to file by URL but PHP code read this file ?