Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

0
votes
2answers
48 views

How to block entire IPs of a VPN server by IP

I have website that identifies users only by their IPs. That makes it very difficult to keep it secure against unwanted users/attackers. They can simply change their IP by using VPN services that ...
10
votes
4answers
569 views

Does SSL really matter for most websites?

I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL. I've read plenty of ...
1
vote
1answer
19 views

Server flooded with Wordpress login requests. Need advice [closed]

Recently I was looking at the nginx access logs and found on 2 ocassions a large ammount of requests pointed towards my WP login page. There were over 50.000 requests coming from 2 different IP ...
0
votes
1answer
21 views

Does referrer header checking offer any real world security improvement?

At work we use a central portal that provides basic SSO functionality to other applications. In addition to verifying the SSO data sent, all of our existing in-house applications (used by the public) ...
6
votes
6answers
5k views

Identify “non-secure” content IE warns about [closed]

As many know, if you serve a page over https and the content loads resources (images, stylesheets, js, SWF objects, etc) over http, older versions of Internet Explorer will show the user a warning ...
0
votes
1answer
65 views

Filtering content from response body HTML (mod_security or other WAFs)

We have Apache on Linux with mod_security as the Web App Firewall (WAF) layer. To prevent content injections, we have some rules that basically disable a page containing some text patterns from ...
2
votes
2answers
70 views

Phishing alert but file never existed

I got an alert from Google Webmasters. They say the following file was present in my host: example.com/~jhostgop/identity.php I checked my files and it never existed at all. I've experience this ...
2
votes
0answers
12 views

Why are passwords exportable as plain text in WordPress? [migrated]

On my WordPress 3.9.2 installation can I extract the users plain text passwords by going to Users, select all users, and choosing Bulk Actions Export. When I look in the mySQL database with ...
3
votes
3answers
34 views

Web user authentication methods

Is there any method besides using a DB with username and password for authenticating a user?
1
vote
1answer
17 views

Why do I see requests from BOT/0.1 (BOT for JCE) in my server access log and what should I do about them?

My server keeps getting requests with user agent identified as BOT/0.1 (BOT for JCE). The first one arrived 2013-09-14 22:13:17 CEST, the last one yet about three days ago, 2014-08-12 06:05:39 CEST. ...
8
votes
2answers
150 views

Are there any disadvantages to Cloudflare’s “Flexible SSL”?

Cloudflare let you serve your site over SSL without having to purchase and install a security certificate, a product they call “Flexible SSL”. (They act as a proxy and serve your site over SSL from ...
0
votes
1answer
35 views

My shared hosting account is sending spam emails

My webhost has deactivated my shared hosting account, since it was sending spam emails through my domain. I have all unrouted mail such as mailto:aasdasd@domain.com set to be forwarded to a specific ...
1
vote
1answer
34 views

How much text does the average person generate per day?

I'm figuring out how to do comment rate limiting, and have decided that I'll keep track of the number of bytes each user (defined as IP address + port) generates on my drive (so, each comment adds a ...
1
vote
2answers
40 views

How do I prevent access to SPAM URLs and remove them from Google's index?

When I started managing my friends' website, I had found a folder in it with a bunch of garbage HTML files with names such as: free-nasscamd-server-31day, gorilla-quentin-trollip-pdf, etc... Assuming ...
1
vote
2answers
83 views

Are there security considerations with choosing shared vs VPS vs dedicated hosting

Are there security disadvantages to using a shared hosting environment instead of a VPS or dedicated server? Could using a shared server or a VPS be considered negligence in the event of a security ...
0
votes
2answers
36 views

Using SSL Certificates with shared hosting/different domain provider

I need to add a HTTPS address to an existing domain. Unfortunately there two companies involved: One for shared web-hosting, and one for the domain. How do SSL Certificated domains work in such ...
3
votes
1answer
1k views

How to protect Google Ads from yontoo layers runtime?

Since sometime I have observed that Google Ads on any website including my blog (http://blogs.digitss.com) gets replaced with something similar to uploaded image below. I am sure it's happening with ...
0
votes
1answer
36 views

Restricting access using IP address / Network Redirection?

I have a situation where we have a web server (lets call it A) that is hosting a set of HTTP based services. Due to some client restrictions, this web server is not open to the outside world but ...
2
votes
2answers
94 views

WordPress keeps redirecting my users to install.php, Is it caused by an injection hack?

I don't really know how to express my problem, so bear with me. This is a bit hard to explain. I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the ...
2
votes
2answers
126 views

Parallel website running a copy of my original website

We have been working on a gaming website. Recently while making note of the major traffic sources, I noticed a website that I found to be a carbon-copy of our website. It uses our logo, and everything ...
2
votes
1answer
94 views

Can forwarding https://example.com requests to https://www.example.com be a security risk?

I maintain a retail store's eCommerce website, provided by a 3rd party. The HTTPS links do not load ('ERR_CONNECTION_TIMED_OUT') unless you put in the WWW before the doman name. The HTTP links forward ...
1
vote
1answer
32 views

Privacy concern to track every user actions in your website?

We are building a system that track every user (logged in) actions, e.g. click, pageview, duration etc and store into a database. So all the user activities will be known and we are using them to ...
6
votes
2answers
601 views

Online gift certificates: Systems to avoid fraud

What good methods are there out there for avoiding fraud with electronic gift certificates (ones which are created and the information distributed electronically via website)? I'm looking to ...
1
vote
1answer
156 views

Permissions & File Structure w/ nginx & multiple sites

I am using nginx for the first time as a long time Apache user. I setup a Linode to test everything and to eventually port over my websites. Previously I had /home/user/www (wwwroot) I am looking ...
3
votes
3answers
193 views

How to deal with malicious domain redirections?

It is possible for anybody to buy a domain name containing negative terms and point it to someone's website in order to damage their reputation. For instance someone could buy the domain ...
4
votes
2answers
88 views

Making HTML5 videos stored on AWS S3 **difficult** to download (because I cant make it impossible)

I am building a website that hosts video's stored on AWS's S3 service. The videos are played thru a HTML5 player we have built. Ive just been asked to make sure "nobody can steal our video's". Now I ...
3
votes
1answer
54 views

Nginx and Google Appengine Reverse Proxy Security

The scenario is that I have a Google compute node running Nginx as a reverse proxy to the google appengine. The appengine is used to service REST calls from an single page application (SPA). HTTPS ...
3
votes
2answers
51 views

Can Joomla have a different URL for backend management?

My site will be maintained mostly by myself, and maybe 1 or 2 others. I want to know if it's possible if the back end can be managed from a different folder structure? ie. www.example.com <- user ...
0
votes
0answers
16 views

How to clean PmWiki from JS:Includer-AWG and protect my site from future infections?

I'm hosting a site for an NGO for several years now. The site seems to be based on a PmWiki backend. I don't know much details because I'm just hosting the site and I'm not the guy who set it up. I ...
2
votes
2answers
228 views

What are the Pros and Cons for password recovery change links in email?

Although a lot of sites still send your password in plain text through email, there has been a push to send a web page url instead. But how can that be any more secure than the password in clear ...
0
votes
0answers
53 views

Concrete5-based site hacked

It seems my Concrete5-based site has been hacked - found this in my default and homepage templates footers: <div style="position:absolute;left:-6397px;"> <a ...
0
votes
1answer
33 views

Is Google App Engine secure enough for financial applications?

I am wondering whether Google App Engine is secure enough for financial applications? This would involve storing sensitive information, access to users' funds, etc. Are there any applications like ...
1
vote
0answers
19 views

Hacked Wordpress site - Mobile Users only [closed]

My site has been hacked for users of mobiles only. I searched for advice here and found some advice but I couldn't see that it applied to my site nor could I fully understand the concepts. Does anyone ...
1
vote
1answer
26 views

How to change cPanel URL? Example: mydomain.com/cpanel

I want to change my website's cPanel URL/path for security reasons. I have a VPS with shell root access, running centOS 6.5 64-bit. I want to change cPanel path for my website on the VPS to be ...
1
vote
2answers
3k views

prevent IIS from executing scripts in a specific directory

I have a php web application that allows file uploads to a specific directory. I would like to prevent the execution of any file that is uploaded into that directory whether it is ASP, PHP, or ...
1
vote
1answer
50 views

Preventing Unvalidated Redirects

I have a project I'm working on, and I recently decided to add a "login bounceback" to my site. The idea is simple, and very common: The user is browsing the site, and runs into something they need to ...
0
votes
2answers
51 views

Emails from joomla 2.5 being marked as “Phishing” mails for vendor and client

The Mails from Joomla to customer as well as vendor are being marked as "phishing" mails. As per solutions provided in the other posts, I checked the header and it is being marked as "Spf-Fail". What ...
1
vote
1answer
74 views

My Server is returning a 404 instead of 403 when access if forbidden - is it good or bad?

via .htaccess, I forbid access to folders that have no index page inside (domain.com/images for example), and also block my site completely for several user-agents (such as wget). When I test to see ...
1
vote
3answers
34 views

AVG says web site is not secure

Recently a co-worker viewed our site from a different location. He said that AVG came up and said the site was not secure and blocked the site. However, when I run the site through AVG it says the ...
3
votes
2answers
65 views

How to hide existence of a private blog?

I have a friend who would like to start a 'blog'. The problem is that she would like it to be private so that only people invited can read it. So I told her to use a private WordPress. But she said ...
14
votes
5answers
553 views

Force Using SSL on Site now?

I am starting to see a majority of websites starting to use SSL as a standard practice for viewing the website securely now thanks to the revelations of Edward Snowden about the NSA surveillance that ...
1
vote
1answer
62 views

Hide website data for Chrome and FF addons: IP Whois & Flags Chrome & Norton

I've got this addon and want to hide the information they publish for our website. They show Popularity, IP address info, nameservers, etc. Plus the traffic levels they report, 'popularity' reflects ...
1
vote
2answers
26 views

eCommerce checkout security

I'm developing an eCommerce site and using SagePay as a card processor. Customers will enter their delivery/invoice details into a form which is then submitted to a checkout page. This page encrypts ...
4
votes
2answers
483 views

Trigger IP ban based on request of given file?

I run a website where "x.php" was known to have vulnerabilities. The vulnerability has been fixed and I don't have "x.php" on my site anymore. As such with major public vulnerabilities, it seems ...
2
votes
2answers
240 views

How to block user agent from accessing my WordPress site with htaccess?

I have noticed large amount of traffic coming to my site from different IP's with user agent. Mozilla/5.0 (compatible; SiteExplorer/1.0b; +http://siteexplorer.info/) I don't have much experience ...
2
votes
1answer
60 views

What was this hack-bot trying to achieve via directory traversal?

I was walking through my server logs and the following kinda stunned me: ACCESS ERROR 404 from IP 62.112.152.161: Path: /index.php?page=weblog&env=../../../../../../../../etc/passwd%00 ...
1
vote
2answers
38 views

Risk of Plaintext Email Addresses on Websites

What are the risks of putting a personal email address (Gmail, in case it matters) on a personal website? A glance around any forum will show many people using "address [at] domain.com" instead of ...
6
votes
3answers
157 views

Why don't we see websites hashing passwords before sending them? [closed]

(Note about the question title: by "we" I mean myself) Everytime I log on to any website, I have this thought that website asking me for my password and sending it back to the server is just basic ...
0
votes
0answers
21 views

Introduce security for web-service

This questions is with respect to including security in our architecture.Let me give a brief over-view. We have REST based web-service (Let's call it A) which is used by our web application and the ...
3
votes
1answer
81 views

Strange series of page visits to my web site

In my web log I see 5 hits (to the same web page) all about the same time but from different parts of the world: 180.247.114.192 /RelFinder?personId=17586 - From: null 2014-01-10 00:26:40.0 ...