Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

8
votes
3answers
2k views

Prevent spam using Honey Pots

I am really curious about how to prevent comment spam in a forum using a honey pot trap for spam bots. What if CSS and javascript is turned off in a browser? Do you see any other disadvantages in ...
2
votes
1answer
88 views

HTTPS on all pages where user is logged on

I know this is considered best practise to prevent cookie hijacking. I would like to adopt this approach, but ran across a problem on our forum where the users post images which either aren't posted ...
1
vote
2answers
41 views

Blocking path scanning

I'm seeing in my access log a number of request very suspicious: /i /im /imaa /imag /image /images /images/d /images/di /images/dis They part from a known resource (in the above example ...
0
votes
2answers
526 views

How can we secure our web application codes?

I have a web application written in the Struts2 framework. I want to host the application with another company. Is there any way to hide the code which is hosted on the server? What I want is to ...
1
vote
2answers
151 views

How to prevent copying of the image folder of your website

How to Prevent copying of the original image folder when the entire website is being copied. Also,what are the measures that should be taken to prevent guessing of the original images.
0
votes
2answers
112 views

Are there any programs that i can use to test my website against hacks? [duplicate]

Possible Duplicate: Tools to check for common vulnerabilities? Are there any applications out there that can run random queries against my website and try and find holes in it? My ...
1
vote
2answers
103 views

Serious Googlebot crawl spike using up a ton of bandwidth

One of the sites I maintain has seen Googlebot use 23gb of bandwidth this month. This seems utterly mental to me, what can I do about it? I have reduced the crawl rate on webmaster tools, and ...
4
votes
6answers
976 views

Is it dangerous to keep Thumbs.db on a web server?

Windows Thumbs.db system files that are in most of folders were uploaded with all other files from the localhost to the server. Is it dangerous, if you forget to delete them on the server? I am on ...
13
votes
4answers
241 views

Prevent possible spammer from linking to my site

We own a website which, through google search results, we determined is either being linked to improperly or for spam purposes by another completely random source. They recently registered a domain ...
2
votes
3answers
251 views

Intellectual Property theft from our webserver. What should we do?

So we caught some computers trying to download a ton of files from our webserver, and we stopped them before they got much (used iptables to drop their IPs). These were not web crawlers, but scripts ...
4
votes
3answers
485 views

How can I prevent users from creating multiple accounts?

I'm building a site that needs to guarantee user reputation scores are accurate by preventing users from creating more than one account, at the cost of decreased user signups. So far, the only ...
1
vote
1answer
257 views

Apache <Directory> blocks

I'm trying to make it so that the outside world can't access a specific section of my website. What I did was: <Directory /Library/WebServer/.../secrets/> Order deny,allow Deny from ...
2
votes
1answer
12k views

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request

I have a joomla website installed and working good. i installed Qlue404 component which redirects 404 page to a custom page., sometimes when i try the symbols ' and some others the 404 page appears ...
0
votes
1answer
118 views

What are the types of verification which can be used for a social networking website?

I'm developing a social networking website for a small network. I would like to keep more security on registration process. I would like to keep some verification methods like SMS, Visa and Paypal (if ...
1
vote
2answers
4k views

What kind of information can websites collect about a user/client?

This is a multi-part question: 1) What kind of information can websites collect about someone (someone's computer or device) when they visit your website? I know we log IP's, and can determine your ...
0
votes
2answers
444 views

Resolving a security issue with my private virtual server

When I search for "thelab athome-training" on Google, and click on a link that point to my site (thelab.athome-training.com), I am redirected to http://grooogle.osa.pl I googled and found that post: ...
0
votes
1answer
47 views

Storing Downloadable Content Securely

For a site where users can purchase videos for download. What would be the best way to store the media? Any other helpful considerations are more than welcome. Outside the root directory? Seperate ...
1
vote
3answers
67 views

fake returning visitor

I have a Live Support app installed on my website and I see a visitor every day, all day long for the last 3 months. This visitor has 3 or more IP addresses, but doesn't change them too often. It ...
7
votes
5answers
603 views

Better Spam Protection than reCAPTCHA?

I hope this is a valid question to ask here... but knows anyone a better spam protection than reCAPTCHA? We've now using reCAPTCHA for some time but got now the situation that obviously more and more ...
2
votes
2answers
105 views

Should I store address in encrypted form?

What are the general rules relating to address fields and others. I only store password in encrypted form, the rest are not. Email is also used during login. Can someone give me a suggestion related ...
3
votes
2answers
146 views

Where should I redirect (removed) phishing pages

I was unfortunately the victim of a PHP exploit. Looking through my webserver logs, people are still attempting to reach the URL used in the phish. I want to redirect them to a site that will educate ...
1
vote
2answers
116 views

Opensource package for securly allowing users to log in and provide information

I have a site written in mostly php and html. I also have a sql database of personal information like names and addresses. I would like my users to be able to log in to my website with a login I can ...
2
votes
2answers
67 views

How to block certain pages/files of a web domain?

How do I make certain pages only viewable by me? For example, let's say I own mydomain.com, and I want to be the only one that can see mydomain.com/mypage.php. I tried changing the permissions of ...
3
votes
3answers
2k views

What is deleteme.xxxxxxxx.php

I was going through page hit logs on awstats and I noticed the following two entries: /deleteme.lcivykmt.php /deleteme.nctqicjg.php I was wondering if anyone recognised them and whether I should ...
4
votes
1answer
95 views

What makes a SSL certificate “signed”?

When you buy a SSL certificate from Comodo, it is signed by Comodo and therefore trusted. How is it signed though? Why can't anyone sign the certificate pretending to be Comodo?
4
votes
1answer
103 views

How to promote the quality/security of your a website to your its customers?

Our organization is building a Drupal web platform that we aim at reselling as a cloud service. In order to provide our customers with maximum confidence in our solution, we're looking at ways of ...
6
votes
3answers
216 views

PayPal Basic vs PayPal Pro and credit card security

This link provides a comparison between PayPal Basic and PayPal Pro plans. To me basic PayPal is ideal but I need to be able to transfer funds between two PayPal accounts and for that I have to ...
3
votes
1answer
108 views

SiteAdvisor advice?

At the time I submitted my site for testing with McAfee's Site Advisor as I noticed my site received a bad review as a spam/scam site. See here . From a development perspective, how important are ...
3
votes
4answers
253 views

Removing CAPTCHA is harmful for my forms?

I have some services on my site that developed by PHP , it seems having CAPTCHA in my registration form is decreasing registering users , I tend to remove CAPTCHA at least on my registering form , is ...
1
vote
2answers
543 views

How to block malicious requests before they reach Apache?

I have a RESTful web service that gets hit by a large number of requests coming from various IPs with dummy logins and random inputs. I have already denied these requests at the HTTP level (using the ...
10
votes
1answer
435 views

Why chmod 777 is not secure?

chmod 777 file change the permissions of the file file to read, write, and execute for all. Ok, so the file can be manipulated in any way by any script on the server. But why is this not ...
1
vote
2answers
59 views

Account suspension on SMS [closed]

Hy Hello all, I have an idea to implement but I hate to copy if it is been used by any other website(s). My idea is about suspending an account using text SMS. The description follows. When a user ...
1
vote
1answer
54 views

How can a website survive an untrusted environment?

Let's say I have an internal website that holds pretty important data (well, contest strategies for stuff like FIRST), which I am bound to host on a Windows server with literally no security. I can't ...
2
votes
0answers
130 views

Fake Windows Security Alert [closed]

I have a website which is redirecting users to a fake windows security alert and I'm not to sure how to get rid of it. What's weird is that it's only happening in IE and that it seems to happen the ...
1
vote
1answer
95 views

Anonymous website [duplicate]

Possible Duplicate: How hard is to be the anonymous owner of a website? Is it possible to setup a website anonymously? I want to setup a domain and hosting but I don't want people to be ...
2
votes
2answers
114 views

Hacking resources

I'm currently developing a web application which has a lot of javascript working behind it. Before I deploy it (which will take a couple of months), I want to make sure that it is atleast a bit ...
2
votes
3answers
91 views

suspicious crawler activity

I'm noticing that I get accesses 66.249.66.198 - - [01/Jul/2011:17:13:46 +0200] "GET /img/clip.incubus.torrent.phtml HTTP/1.1" 404 143 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; ...
3
votes
2answers
516 views

PCI compliance when using third-party processing

My company is outsourcing the development of our new e-commerce site to a third party web development company. The way they set up our site to handle transactions is by having the user enter the ...
2
votes
2answers
131 views

Deny access to a folder on hosting server but serve the pages

My hosting server allows to host multiple websites. The directory structure is like this root |_ www.a.com |_ www.b.com |_ www.c.com |_ www.d.com I want to put some PHP files on the www.d.com ...
6
votes
1answer
98 views

Is it necessary for a web developer to know how to hack website?

I'm a web developer. I'm just wondering that is it necessary for a web developer to know how to hack website than developing a website?
4
votes
3answers
670 views

client website compromised, found a strange .php file. any ideas?

I do support work for a web development company and I found a suspicious file today on the website of one of our clients called "hope.php" which contained several ...
3
votes
3answers
2k views

Do internal intranet websites need to be secure?

The question is in the title. Does an internal site need to have https security? For example we have an internal site that handles our client's license keys -- do we need for that to be secure since ...
1
vote
1answer
95 views

Site overthrown by Turkish hackers

Go ahead, laugh. I forgot to remove the default admin/admin account on my blog. SOmebody got in and has replaced my homepage with some internet graffiti. I've used .htaccess to replace the page with a ...
6
votes
1answer
328 views

A bounce-rate attack to manipulate SEO?

This is a question to experienced people that might help us shed some light on the issue. We noticed a very strange behavior on our site, in Google Analytics. Some dude from Finland, namely, from ...
2
votes
1answer
82 views

Are there any risks involved in Hosting your website on free webhosts?

I am planning to host my collage project web site on any such free webhost, is it secure or are there any disadvantages or risks or security issues that i may experience if i go for free web-hosting? ...
0
votes
1answer
497 views

someone was able to upload php files without ftp access to my server

I have website in PHP/MYSQL developing using CakePHP framework. Recently it was hacked and someone was able to upload some PHP and JS files and the site was down. The website FTP, control panel etc ...
1
vote
1answer
104 views

Ultimate security checklist

I'm looking for a complete security checklist that will allow me to secure my websites. After some research here is what I got: -use SSL to protect authenticated content -tighten the server TCP/IP ...
4
votes
4answers
939 views

PCI DSS compliance for a VPS using Centos

I have a VPS with linode, great hosting by the way. I am confident with centos apache ect but I know nothing about PCI DSS compliance, I usually let SagePay or PayPal deal with it. But I have a ...
6
votes
2answers
629 views

Online gift certificates: Systems to avoid fraud

What good methods are there out there for avoiding fraud with electronic gift certificates (ones which are created and the information distributed electronically via website)? I'm looking to ...
4
votes
2answers
111 views

How to prevent stat sites from getting/publishing my traffic and hosting information?

When I recently googled my website, stat sites came up that had more info on my website than I even knew off the top of my head! Daily traffic, Nameservers, analytics id, etc. I removed google ...