Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

7
votes
5answers
584 views

Better Spam Protection than reCAPTCHA?

I hope this is a valid question to ask here... but knows anyone a better spam protection than reCAPTCHA? We've now using reCAPTCHA for some time but got now the situation that obviously more and more ...
2
votes
2answers
105 views

Should I store address in encrypted form?

What are the general rules relating to address fields and others. I only store password in encrypted form, the rest are not. Email is also used during login. Can someone give me a suggestion related ...
3
votes
2answers
144 views

Where should I redirect (removed) phishing pages

I was unfortunately the victim of a PHP exploit. Looking through my webserver logs, people are still attempting to reach the URL used in the phish. I want to redirect them to a site that will educate ...
1
vote
2answers
115 views

Opensource package for securly allowing users to log in and provide information

I have a site written in mostly php and html. I also have a sql database of personal information like names and addresses. I would like my users to be able to log in to my website with a login I can ...
2
votes
2answers
67 views

How to block certain pages/files of a web domain?

How do I make certain pages only viewable by me? For example, let's say I own mydomain.com, and I want to be the only one that can see mydomain.com/mypage.php. I tried changing the permissions of ...
3
votes
3answers
2k views

What is deleteme.xxxxxxxx.php

I was going through page hit logs on awstats and I noticed the following two entries: /deleteme.lcivykmt.php /deleteme.nctqicjg.php I was wondering if anyone recognised them and whether I should ...
4
votes
1answer
95 views

What makes a SSL certificate “signed”?

When you buy a SSL certificate from Comodo, it is signed by Comodo and therefore trusted. How is it signed though? Why can't anyone sign the certificate pretending to be Comodo?
4
votes
1answer
103 views

How to promote the quality/security of your a website to your its customers?

Our organization is building a Drupal web platform that we aim at reselling as a cloud service. In order to provide our customers with maximum confidence in our solution, we're looking at ways of ...
6
votes
3answers
214 views

PayPal Basic vs PayPal Pro and credit card security

This link provides a comparison between PayPal Basic and PayPal Pro plans. To me basic PayPal is ideal but I need to be able to transfer funds between two PayPal accounts and for that I have to ...
3
votes
1answer
108 views

SiteAdvisor advice?

At the time I submitted my site for testing with McAfee's Site Advisor as I noticed my site received a bad review as a spam/scam site. See here . From a development perspective, how important are ...
3
votes
4answers
247 views

Removing CAPTCHA is harmful for my forms?

I have some services on my site that developed by PHP , it seems having CAPTCHA in my registration form is decreasing registering users , I tend to remove CAPTCHA at least on my registering form , is ...
1
vote
2answers
533 views

How to block malicious requests before they reach Apache?

I have a RESTful web service that gets hit by a large number of requests coming from various IPs with dummy logins and random inputs. I have already denied these requests at the HTTP level (using the ...
9
votes
1answer
410 views

Why chmod 777 is not secure?

chmod 777 file change the permissions of the file file to read, write, and execute for all. Ok, so the file can be manipulated in any way by any script on the server. But why is this not ...
1
vote
2answers
59 views

Account suspension on SMS [closed]

Hy Hello all, I have an idea to implement but I hate to copy if it is been used by any other website(s). My idea is about suspending an account using text SMS. The description follows. When a user ...
1
vote
1answer
54 views

How can a website survive an untrusted environment?

Let's say I have an internal website that holds pretty important data (well, contest strategies for stuff like FIRST), which I am bound to host on a Windows server with literally no security. I can't ...
2
votes
0answers
130 views

Fake Windows Security Alert [closed]

I have a website which is redirecting users to a fake windows security alert and I'm not to sure how to get rid of it. What's weird is that it's only happening in IE and that it seems to happen the ...
1
vote
1answer
92 views

Anonymous website [duplicate]

Possible Duplicate: How hard is to be the anonymous owner of a website? Is it possible to setup a website anonymously? I want to setup a domain and hosting but I don't want people to be ...
2
votes
2answers
114 views

Hacking resources

I'm currently developing a web application which has a lot of javascript working behind it. Before I deploy it (which will take a couple of months), I want to make sure that it is atleast a bit ...
2
votes
3answers
91 views

suspicious crawler activity

I'm noticing that I get accesses 66.249.66.198 - - [01/Jul/2011:17:13:46 +0200] "GET /img/clip.incubus.torrent.phtml HTTP/1.1" 404 143 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; ...
3
votes
2answers
497 views

PCI compliance when using third-party processing

My company is outsourcing the development of our new e-commerce site to a third party web development company. The way they set up our site to handle transactions is by having the user enter the ...
2
votes
2answers
128 views

Deny access to a folder on hosting server but serve the pages

My hosting server allows to host multiple websites. The directory structure is like this root |_ www.a.com |_ www.b.com |_ www.c.com |_ www.d.com I want to put some PHP files on the www.d.com ...
6
votes
1answer
95 views

Is it necessary for a web developer to know how to hack website?

I'm a web developer. I'm just wondering that is it necessary for a web developer to know how to hack website than developing a website?
4
votes
3answers
621 views

client website compromised, found a strange .php file. any ideas?

I do support work for a web development company and I found a suspicious file today on the website of one of our clients called "hope.php" which contained several ...
3
votes
3answers
2k views

Do internal intranet websites need to be secure?

The question is in the title. Does an internal site need to have https security? For example we have an internal site that handles our client's license keys -- do we need for that to be secure since ...
1
vote
1answer
95 views

Site overthrown by Turkish hackers

Go ahead, laugh. I forgot to remove the default admin/admin account on my blog. SOmebody got in and has replaced my homepage with some internet graffiti. I've used .htaccess to replace the page with a ...
6
votes
1answer
320 views

A bounce-rate attack to manipulate SEO?

This is a question to experienced people that might help us shed some light on the issue. We noticed a very strange behavior on our site, in Google Analytics. Some dude from Finland, namely, from ...
2
votes
1answer
81 views

Are there any risks involved in Hosting your website on free webhosts?

I am planning to host my collage project web site on any such free webhost, is it secure or are there any disadvantages or risks or security issues that i may experience if i go for free web-hosting? ...
0
votes
1answer
449 views

someone was able to upload php files without ftp access to my server

I have website in PHP/MYSQL developing using CakePHP framework. Recently it was hacked and someone was able to upload some PHP and JS files and the site was down. The website FTP, control panel etc ...
1
vote
1answer
101 views

Ultimate security checklist

I'm looking for a complete security checklist that will allow me to secure my websites. After some research here is what I got: -use SSL to protect authenticated content -tighten the server TCP/IP ...
4
votes
4answers
892 views

PCI DSS compliance for a VPS using Centos

I have a VPS with linode, great hosting by the way. I am confident with centos apache ect but I know nothing about PCI DSS compliance, I usually let SagePay or PayPal deal with it. But I have a ...
6
votes
2answers
599 views

Online gift certificates: Systems to avoid fraud

What good methods are there out there for avoiding fraud with electronic gift certificates (ones which are created and the information distributed electronically via website)? I'm looking to ...
4
votes
2answers
111 views

How to prevent stat sites from getting/publishing my traffic and hosting information?

When I recently googled my website, stat sites came up that had more info on my website than I even knew off the top of my head! Daily traffic, Nameservers, analytics id, etc. I removed google ...
0
votes
1answer
129 views

Apache webserver user setup and security issues

I have a server running Centos 5.6/PHP/MySQL etc that will only host one website all the time. New question Is there any security implication on leaving a single website hosted in the default ...
3
votes
2answers
117 views

What are recommended password reset mecanisms?

All, I'm developing a small, non-commercial web app. I'm trying to decide how to help a user who might have lost their password. I need a mechanism that is, in order of priority: 1) User friendly; ...
5
votes
4answers
483 views

How to protect SHTML pages from crawlers/spiders/scrapers?

I have A LOT of SHTML pages I want to protect from crawlers, spiders & scrapers. I understand the limitations of SSIs. An implementation of the following can be suggested in conjunction with any ...
5
votes
3answers
753 views

Disadvantages of a fake phpMyAdmin honeypot that causes ip blacklisting and robots.txt disallow/exclusion of the honeypot?

I'm trying to figure out whether I should set up a honeypot system with a fake phpMyAdmin (site gets hits all the time with people spidering for insecurities with that app). My thought was to create ...
3
votes
2answers
202 views

I found a SQL injection bug on a public facing website, what should I do?

I found (ridiculously easy to discover) a SQL injection bug on a public facing website. I strongly suspect that in the same database are stored credit card numbers of their customers (although not ...
3
votes
2answers
956 views

What does this code mean that was placed in my hacked Web site?

My website was hacked, with the following code added to the end of the page: <img heigth="1" width="1" border="0" src="http://imgddd.net/t.php?id=########"> (The id had an 8 digit ...
0
votes
3answers
174 views

File Access Permission

I need to upload a file to site with PHP code. How to set permission for upload folder if I want to users cant access to file by URL but PHP code read this file ?
1
vote
0answers
149 views

Is posting a document with a hand signature insecure? [closed]

Every once and a while, one of our departments would like to post a hand-signed document on the web site. Up until now I've scanned them in as a PDF and posted them without much thought, but recently ...
4
votes
3answers
97 views

How Do You Store Website Backups?

I'm not that great about backing up my site, which is something I want to improve on. Currently, I save backups of my site on my local computer and on an external thumb drive. I was thinking of ...
4
votes
2answers
159 views

what is website security verification?

I have an ecommerce website and I recently came accross a web page that talks about cyber crime and this has got me wondering what website security verification means. I saw this and I am a bit ...
9
votes
1answer
307 views

Is an externally-hosted subdomain a security risk?

A company I've been developing a web site for wants to keep their current domain, which is something like company.parentcompany.com. Because we wanted to use a different CMS, the parent company ...
1
vote
1answer
10k views

.htaccess password protection generates 500 internal server error

I have created a .htpasswd file using htaccess tools of which I have uploaded to the root of my web hosting space (/public_html is my web root). I created a .htaccess file which referenced the ...
2
votes
1answer
1k views

How do I save user uploaded files outside of the web folder but use them on my page?

I have read that one of the best things to do for security with user uploaded files is to store them outside of the web folder, as there is very little you can do to ensure that that jpg image the ...
3
votes
1answer
504 views

Is this safe? <a href=http://javascript:…>

I wonder if href and src attributes on <a> and <img> tags are always safe w.r.t. XSS attacks, if they start with http:// or https://. For example, is it possible to append javascript: ... ...
2
votes
1answer
337 views

How Do I Prevent Users from Accessing a Page More Then Once?

Hi I have a URL say for example http://www.xyz.com/form1.html. Now i need to hide this URL since I dont want people to keep coming back to this URL and using it. What I mean is I need this URL to be ...
1
vote
4answers
78 views

Website security

I have a website which uses membership/roles for security. However, I really want this site to be secure. My concern is one day something happens to server and the membership/roles is turned off. Is ...
1
vote
1answer
802 views

What is best practice for securing access to GMail for an enterprise?

Is there any way to restrict access to Gmail accounts from certain IP/MAC addresses ? For instance, can I setup Google Apps so that my users can access their GMail account from within the corporate ...
2
votes
2answers
420 views

Keeping files private on the internet (.htaccess password or software/php/wordpress password)

I was asked a while ago to setup a server such that only authenticated users can access files. It was like a test server for clients to view WIP sites. More recently, I want to do something similar ...