Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

3
votes
3answers
1k views

Do internal intranet websites need to be secure?

The question is in the title. Does an internal site need to have https security? For example we have an internal site that handles our client's license keys -- do we need for that to be secure since ...
1
vote
1answer
94 views

Site overthrown by Turkish hackers

Go ahead, laugh. I forgot to remove the default admin/admin account on my blog. SOmebody got in and has replaced my homepage with some internet graffiti. I've used .htaccess to replace the page with a ...
6
votes
1answer
297 views

A bounce-rate attack to manipulate SEO?

This is a question to experienced people that might help us shed some light on the issue. We noticed a very strange behavior on our site, in Google Analytics. Some dude from Finland, namely, from ...
2
votes
1answer
79 views

Are there any risks involved in Hosting your website on free webhosts?

I am planning to host my collage project web site on any such free webhost, is it secure or are there any disadvantages or risks or security issues that i may experience if i go for free web-hosting? ...
0
votes
1answer
396 views

someone was able to upload php files without ftp access to my server

I have website in PHP/MYSQL developing using CakePHP framework. Recently it was hacked and someone was able to upload some PHP and JS files and the site was down. The website FTP, control panel etc ...
1
vote
1answer
99 views

Ultimate security checklist

I'm looking for a complete security checklist that will allow me to secure my websites. After some research here is what I got: -use SSL to protect authenticated content -tighten the server TCP/IP ...
4
votes
4answers
829 views

PCI DSS compliance for a VPS using Centos

I have a VPS with linode, great hosting by the way. I am confident with centos apache ect but I know nothing about PCI DSS compliance, I usually let SagePay or PayPal deal with it. But I have a ...
5
votes
2answers
533 views

Online gift certificates: Systems to avoid fraud

What good methods are there out there for avoiding fraud with electronic gift certificates (ones which are created and the information distributed electronically via website)? I'm looking to ...
4
votes
2answers
110 views

How to prevent stat sites from getting/publishing my traffic and hosting information?

When I recently googled my website, stat sites came up that had more info on my website than I even knew off the top of my head! Daily traffic, Nameservers, analytics id, etc. I removed google ...
0
votes
1answer
126 views

Apache webserver user setup and security issues

I have a server running Centos 5.6/PHP/MySQL etc that will only host one website all the time. New question Is there any security implication on leaving a single website hosted in the default ...
3
votes
2answers
113 views

What are recommended password reset mecanisms?

All, I'm developing a small, non-commercial web app. I'm trying to decide how to help a user who might have lost their password. I need a mechanism that is, in order of priority: 1) User friendly; ...
5
votes
4answers
459 views

How to protect SHTML pages from crawlers/spiders/scrapers?

I have A LOT of SHTML pages I want to protect from crawlers, spiders & scrapers. I understand the limitations of SSIs. An implementation of the following can be suggested in conjunction with any ...
5
votes
3answers
710 views

Disadvantages of a fake phpMyAdmin honeypot that causes ip blacklisting and robots.txt disallow/exclusion of the honeypot?

I'm trying to figure out whether I should set up a honeypot system with a fake phpMyAdmin (site gets hits all the time with people spidering for insecurities with that app). My thought was to create ...
3
votes
2answers
201 views

I found a SQL injection bug on a public facing website, what should I do?

I found (ridiculously easy to discover) a SQL injection bug on a public facing website. I strongly suspect that in the same database are stored credit card numbers of their customers (although not ...
3
votes
2answers
950 views

What does this code mean that was placed in my hacked Web site?

My website was hacked, with the following code added to the end of the page: <img heigth="1" width="1" border="0" src="http://imgddd.net/t.php?id=########"> (The id had an 8 digit ...
0
votes
3answers
171 views

File Access Permission

I need to upload a file to site with PHP code. How to set permission for upload folder if I want to users cant access to file by URL but PHP code read this file ?
1
vote
0answers
145 views

Is posting a document with a hand signature insecure? [closed]

Every once and a while, one of our departments would like to post a hand-signed document on the web site. Up until now I've scanned them in as a PDF and posted them without much thought, but recently ...
4
votes
3answers
97 views

How Do You Store Website Backups?

I'm not that great about backing up my site, which is something I want to improve on. Currently, I save backups of my site on my local computer and on an external thumb drive. I was thinking of ...
4
votes
2answers
149 views

what is website security verification?

I have an ecommerce website and I recently came accross a web page that talks about cyber crime and this has got me wondering what website security verification means. I saw this and I am a bit ...
9
votes
1answer
294 views

Is an externally-hosted subdomain a security risk?

A company I've been developing a web site for wants to keep their current domain, which is something like company.parentcompany.com. Because we wanted to use a different CMS, the parent company ...
1
vote
1answer
9k views

.htaccess password protection generates 500 internal server error

I have created a .htpasswd file using htaccess tools of which I have uploaded to the root of my web hosting space (/public_html is my web root). I created a .htaccess file which referenced the ...
2
votes
1answer
1k views

How do I save user uploaded files outside of the web folder but use them on my page?

I have read that one of the best things to do for security with user uploaded files is to store them outside of the web folder, as there is very little you can do to ensure that that jpg image the ...
3
votes
1answer
439 views

Is this safe? <a href=http://javascript:…>

I wonder if href and src attributes on <a> and <img> tags are always safe w.r.t. XSS attacks, if they start with http:// or https://. For example, is it possible to append javascript: ... ...
2
votes
1answer
326 views

How Do I Prevent Users from Accessing a Page More Then Once?

Hi I have a URL say for example http://www.xyz.com/form1.html. Now i need to hide this URL since I dont want people to keep coming back to this URL and using it. What I mean is I need this URL to be ...
1
vote
4answers
77 views

Website security

I have a website which uses membership/roles for security. However, I really want this site to be secure. My concern is one day something happens to server and the membership/roles is turned off. Is ...
1
vote
1answer
744 views

What is best practice for securing access to GMail for an enterprise?

Is there any way to restrict access to Gmail accounts from certain IP/MAC addresses ? For instance, can I setup Google Apps so that my users can access their GMail account from within the corporate ...
2
votes
2answers
407 views

Keeping files private on the internet (.htaccess password or software/php/wordpress password)

I was asked a while ago to setup a server such that only authenticated users can access files. It was like a test server for clients to view WIP sites. More recently, I want to do something similar ...
8
votes
8answers
369 views

What are the reasons to have a two step login? (Username on one page, password on the second.)

So I've recently been encountering more two step login processes, where I'm required to enter my username on one page and my password on a second. I really don't like this pattern, as it requires an ...
9
votes
3answers
3k views

what is wwws.site.com

I know about https for securing important pages like login and such. But why would someone create a separate subdomain like wwws as well? for example https://wwws.site.com/login
0
votes
3answers
341 views

MODX based site has been compromised, and tagged by Google as malware

I'm the webmaster (inherited the site from the developer) for a site called kenbrook.org. The site is currently being tagged as malware infected by Google, and gives the following details: ...
2
votes
2answers
132 views

Implications on automatically “open” third party domain aliasing to one of my subdomains

I have a domain, let's call it www.mydomain.com where I have a portal with an active community of users. In this portal users cooperate in a wiki way to build some "kind of software". These software ...
3
votes
1answer
239 views

User registration usability vs security

What are cons and pros of the following: asking to repeat password asking to have a certain length-password asking to repeat e-mail address using captcha sending confirmation e-mail what do you ...
1
vote
3answers
110 views

What are some internet trends that you've noticed over the past ~10 years? [closed]

I'll give an example of one that I've noticed: the number of web sites that ask for your email address (GOOG ID, YAHOO! ID, etc.) has skyrocketed. I can come up with no legitimate reason for this ...
0
votes
2answers
319 views

block users by country in .htaccess

Is there a way to block users from a particular region. Currently I have compiled a list of over 100 IP addresses that I block in my .htaccess file. Unfortunately as the list grows I see a great ...
2
votes
1answer
204 views

Is SimplePHPBlog a secure blogging engine?

Has anyone used the blog engine SimplePHPBlog? It is a simple blog engine that uses only text files (no database). My problem with it is that the content directory where the texts files are stored ...
2
votes
1answer
166 views

A single request appears to have come from all the browsers? Should I be worried?

I was looking over my site access logs when I noticed a request with the following user agent string: "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12) Gecko/20101026 ...
4
votes
2answers
455 views

Trigger IP ban based on request of given file?

I run a website where "x.php" was known to have vulnerabilities. The vulnerability has been fixed and I don't have "x.php" on my site anymore. As such with major public vulnerabilities, it seems ...
3
votes
5answers
2k views

Disallow robots.txt from being accessed in a browser but still accessible by spiders?

We make use of the robots.txt file to prevent Google (and other search spiders) from crawling certain pages/directories in our domain. Some of these directories/files are secret, meaning they aren't ...
1
vote
0answers
256 views

Does the Adblock Plus extension prevent malicious code from downloading/executing? [closed]

Firefox and Chrome are my favourite browsers. The main reason is an extension called Adblock Plus. Basically, it blocks all the ad networks if you subscribe to one of the lists, like EasyList. Does it ...
0
votes
1answer
128 views

Free forum engine with good anti-attack mechanisms [duplicate]

Possible Duplicate: What Forum Software should I use? I am looking for forum engine (for discussions) with good attack countermeasures built in. Windows (preferrably) or Linux. Free (as ...
1
vote
3answers
1k views

My website has been hacked/attacked, says “reported attack page”

Three days back my website ganapatihegde.com has been hacked/attacked by some hacker. Now, when anyone tries to see my website, it says "Reported Attack Page!". I am using server provided by Free ...
0
votes
1answer
245 views

Developing payment gateway

I have an idea of developing internet payment gateway similar to PayPal or Webmoney. Since i'm only sophomore at Computer Science, and i've only taken intermediate programming classes, i've no idea ...
1
vote
1answer
108 views

Is there a way of listing files for a directory if it contains index.html?

On my server (over which I have little control), directories are listed by default, so for mysite.com/images I get: Index of /images Parent Directory BirdsAreHere.png ...
7
votes
3answers
195 views

How should a site respond to automated login attempts with phony usernames?

For the last couple weeks I've been seeing a consistent stream of 15-30 invalid login attempts per hours on my site. Many of them are non-sensical usernames that nobody would ever register for real, ...
1
vote
3answers
202 views

Are there any security considerations if users are allowed to upload flash files

Lets say I have a website where users are allowed to upload files which will be displayed publicly as a portfolio gallery. For example, users might upload screenshots of a website they designed, or a ...
1
vote
1answer
62 views

Problematic using Captcha on billing page

I have simple captcha on user page. I want make it refresh if user input incorrect captcha, I just wanna ask Should I do it or I just add a simple button to refresh it.
1
vote
1answer
119 views

What is the purpose of the appserv_root requests?

I see a lot of requests for nonexistent php files on my website. They tend to have a querystring like appserv_root=http://www.example.com, using domains with evil-looking php code. I am pretty ...
0
votes
1answer
142 views

Why does my certificate provider ask me to disable its root certificate?

I received an SSL certificate from GoDaddy yesterday and their instructions to install the certificate seemed weird. To be precise, they asked me to disable their root certificate in server. NOTE: ...
5
votes
3answers
216 views

Any tools for measuring the security of a site?

I'm wondering is there any tool for measuring or testing the security of a website ? I've written some ASP.NET web-app , So i would like measure the security of my own application and if there is ...
3
votes
1answer
65 views

Cost effective way to provide static media content

I'd like to be able to deliver around 50MB of static content, either in about 30 individual files up to 10MB or grouped into 3 compressed files, around 5k to 20k times a day. Ideally I'd like to put ...