Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

2
votes
1answer
17 views

My website URLs have fake search term query strings that are appering in Google search

A few days ago I was informed that my website appears when searching some random terms with a URL that, as far as I know, does not belong to it. My domain: example.com Search terms: "olympic" ...
0
votes
0answers
10 views

If I contract out a web dev project to a company, is it industry-standard to have a “warranty” of some sort for say the forseeable future? [on hold]

We paid £20,000 to a company to develop our game related website (much like kongregate but with in-app purchases as well). I have been informed by an acquaintance that they website is very easy to ...
-2
votes
0answers
13 views

Marking pdf on download to prevent unauthorized sharing [closed]

A paper magazine wants to extend their distribution through a PDF file. The editorial committee has asked for a solution to mark each page of the PDF the name, surname, and id of the user when he ...
3
votes
1answer
42 views

How can I give my users the proof that their data are encrypted?

I want to implement a feature on my website that will hold private client data. I want to promote this feature, but how can I give my clients a guarantee or proof that their data are encrypted and ...
4
votes
3answers
302 views

Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?

I'd like to submit my personal site into the Chrome HSTS preload list. The site there says: In order to be included on the HSTS preload list, your site must: Have a valid certificate. ...
2
votes
2answers
113 views

How to Secure Wordpress website using .htaccess , allowing only index.php execution access

I am responsible for security of lots of shared hosting server. We have at least 500 wordpress website in each server. Some of the website owners keep a weak password for WP admin or use vulnerable ...
1
vote
1answer
21 views

Collect personal data in europe using google forms

Since there have been issues regarding web service providers that store personal/confidential data of users outside of the European Union, I am somewhat precarious. Am I allowed to collect personal ...
0
votes
1answer
35 views

What kind of attack causes a JavaScript 'out of memory' on the attackers device?

We experienced a strange attack yesterday. Our error log picked up the same 'out of memory' JavaScript error from a single IP address every 10 seconds. The requests came from 6 client ports on the ...
0
votes
1answer
352 views

SIMPLEST way to set up password protection for a static site, with basic admin UI?

I have a static site. I would like the simplest approach to password protecting a directory, with a basic admin UI for adding/removing users. I will have so few users that I don't care about ...
2
votes
1answer
38 views

White labelling with frames and IE

I have a SaaS application that offers some basic white-labelling functionality related to CSS, company logos etc. However, one client now wants to white-label the application with their own URL so ...
1
vote
1answer
96 views

Restrict Plesk user for external developer access

We are commissioning an external developer to develop part of our site and he will also need access to a MySQL database attached to the domain but I can't figure out how to create a user that has the ...
2
votes
1answer
97 views

Suspicious Web Traffic from Amazon.com ISP

Just a few hours back I was checking my logs when I found a whole bunch of traffic from IP address 54.174.xx.xx and ISP Amazon.com (validated from Google analytics). It lasted for an hour and then ...
3
votes
1answer
54 views

restricting Google Maps js API keys to just my domain

My site uses the Google Maps javascript API, so I'm using a "Browser key", which is plainly visible in my javascript to anyone who does "View Source". Google's documentation on Browser keys in ...
1
vote
0answers
15 views

OpenStack Horizon behind reverse proxy (nginx preferred) [migrated]

Current situation: I have a Triple-O OpenStack installation (Liberty) where even the "public" network is in a private environment (10.24.7.0/24 network). The only way to get access to that network is ...
1
vote
1answer
87 views

How to setup an implicit FTPS encryption on cPanel server?

Currently my server is configured to use TLS encryption for FTP. It is explicit since it uses FTPES and on port 21. How can I switch to implicit FTPS that works on port 990? I'm using Pure_FTPd. I ...
1
vote
1answer
14 views

Can browser vulnerabilities effect wesbite security?

Can browser vulnerabilities lead to problems with a website Security? Let's say that I have a website that is globally accessed. Can an old browser having vulnerabilities be trouble for my website ...
0
votes
1answer
12 views

Separate server for images?

Should I be using a separate server for hosting images that are created on a website? For example, my application creates images and currently stores them on the same server. I have around 200k+ ...
0
votes
0answers
7 views

Web hosting service with support for HTTPS, HSTS, HPKP [duplicate]

Currently, I have my website deployed on a private server, but I'm looking to move to a "real" web hosting service to better serve my readers. I kind of believe in good encryption on the web. ...
2
votes
1answer
67 views

What file permissions should I set before I give website project folder to hosting service?

I am using a CMS called Jekyll to build a website. My understanding of jekyll at this point is that it helps me to generate static web pages by providing me a simple boilerplate for a website and ...
4
votes
1answer
66 views

Can spambots access pages available to only registered, authenticated users?

I have a web application where users register and are activated via an email sent to the email address they supplied. Then there are pages that are only visible to registered users (non-user access ...
5
votes
2answers
62 views

creating an archive/snapshot of a wordpress site — how?

I help to run a 15 year old site which is powered by wordpress (along with various kinds of legacy static content). The site has probably 20,000 wordpress posts. The main site administrator wants to ...
6
votes
1answer
44 views

Block IP requesting xmlrpc.php

We have a firewall with modsecurity installed. I would like to write a rule to block any IP address for 24 hours if that IP requests xmlrpc.php. Please note that we do not use WordPress on our ...
0
votes
0answers
22 views

Single Page Web App - Auto-login security conundrum

We have a single page web application written in Angular with a Java back-end. It is public facing and as part of the security model we use https, JWT tokens and take csrf measures. Occasionally, a ...
1
vote
0answers
17 views

Is it able to disable secure attribute for Cookie on SSL connection?

There are HTTP and HTTPS page on our site on Apache. So We need to convert from HTTPS to HTTP or from HTTP to HTTPS to prevent from login session cookie fired. I already know that it does not make ...
1
vote
1answer
13 views

Cannot get Content-Security-Policy to work

I'm trying to implement CSP, but cannot make the script-src work correctly. I strongly want to avoid unsafe-inline, but all attempts to circumvent this by using sha256 hashes seem to fail. This is ...
1
vote
0answers
21 views

How to find the folder in a host server with its name starts with a “~”?

For example: http://my-domain/~service In this case, I couldn't find a "~service" folder or file in the server but the url does work, which is very weird.
0
votes
0answers
9 views

What kind of information sites which we visit store and see about us? [duplicate]

I know that sites can see our Ip address and ISP when we visit them. MY question is Can they see our systems physical address? and what kind of other information they can store about us?.
0
votes
1answer
13 views

how do you handle input sanitization on forms? [closed]

how do you handle input sanitization on forms? do you use javascrpt or just client?
6
votes
3answers
124 views

Will data be encrypted if an HTTP page POSTs to a HTTPS handler that redirects back to HTTP?

My host gave me a subdomain of their domain that has HTTPS: https://mysite.example.com My own domain name has no SSL installed, so the only way I can take advantage of encryption is by using the ...
8
votes
1answer
90 views

Someone/something accessed a link in an email, but it was not who the email was sent to

Could anyone solve this mystery? We have an web application that is only available to invited users. Our admin create accounts for users, and then the application sends an activation email to that ...
20
votes
5answers
5k views

How can I tell if my website visitors are using LastPass or other password managers?

I want to make sure visitors to my website have the best experience possible so I want them to be able to use LastPass and other Password Managers. Is there any way of identifying whether or not my ...
0
votes
1answer
53 views

Does Cloudflare use different authentication mechanisms across platforms?

I'm using Cloudflare flexible SSL for a website I made, and after investigating certificate properties, I realized different authentication mechanisms are being used. Chrome 45 for Windows desktop ...
4
votes
3answers
53 views

When setting up LAMP for testing at a local machine, how do I make sure it's not remote accessible?

I'm setting up a LAMP stack on my local machine for testing. How do I make sure the web server is not remote accessible?
2
votes
1answer
251 views

Use GPG keys in cPanel?

So, the cPanel web hosting management console has a GnuPG Keys area, which allows you to create or import GPG/PGP keys. However, it doesn't seem that the server actually does anything with them once ...
2
votes
1answer
786 views

How to integrate Paypal Direct Payment (i.e. Paypal Pro) with custom shopping cart application?

I've written a basic shopping cart application that is fully functional except for the payment process. I have decided to use PayPal Direct Payment, or "PayPal Pro," but am unsure of how to integrate ...
3
votes
2answers
363 views

How can I avoid being hacked? [closed]

I have a website built on Joomla/PHP and it was going well until I found a RewriteCond directive in my .htaccess file to a website with porn content. RewriteEngine On RewriteCond %{HTTP_ACCEPT} "text/...
1
vote
1answer
169 views

AWS EBS Tomcat instance being hacked [closed]

I'm using AWS EBS instances with tomcat for my java web application. But somehow some guy manages to hack into my instances and all I can see are these processes being ran by tomcat: tomcat 26988 ...
2
votes
3answers
75 views

Does using the same mail and web server increases risk of DDos due to IP exposure?

I use the same server for sending my emails and web hosting.I send user registration and support forum mails from my server and occasional marketing mails or newsletters. I read on a cloudflare blog ...
1
vote
4answers
6k views

prevent IIS from executing scripts in a specific directory

I have a php web application that allows file uploads to a specific directory. I would like to prevent the execution of any file that is uploaded into that directory whether it is ASP, PHP, or ...
4
votes
3answers
161 views

How to detect if file with a .png extension contains code or an image?

I was in a trouble last few days since my web host was hacked for POST on PHP files. I've been dealing with files with .png extension that have PHP code inside. I can't even try to edit one-by-one to ...
5
votes
2answers
189 views

what is website security verification?

I have an e-commerce website and I recently came across a web page that talks about cyber crime and this has got me wondering what website security verification means. Does any one know what website ...
2
votes
1answer
45 views

Allow third party to use domain subdirectory without risk to your server

If you have a live site on example.com, is it possible to allow third-parties to set up their own site at example.com/project1, example.com/project2 etc without subjecting your server to risk? I ...
0
votes
1answer
30 views
3
votes
3answers
85 views

How to determine if a user agent string has proper syntax or might be a hacking attempt?

I was checking my server via awstats to see who was visiting my site and I have a user-agent of the following value: }__test|O:21:\ Some research has lead me to believe that someone was trying to ...
10
votes
8answers
969 views

How to find out the strength of the Wordpress (already stored) password?

I am responsible for security of lots of shared hosting server. Most of them are having WordPress websites. Each server is having at least 500 WordPress websites. In my expereince, the issue with ...
1
vote
2answers
43 views

How to list all URLs in the source code files of a website with command line tools?

I have folder that contains the source code files of a website (tons of html, css and php files). I would like to find an automatic method (preferably with command line tools) to scan this folder ...
4
votes
2answers
201 views

Will using HTTPS hurt my site's SEO or other statistics?

I've set up a WordPress blog. Since I have to log into it from many different locations/machines, I've also got an SSL certificate, and set up Apache to redirect HTTP to HTTPS. It all works, but I'm ...
4
votes
2answers
69 views

What are the benefits of requiring HTTPS between AWS CloudFront and the origin server?

I am hosting a website on Amazon CloudFront and we've recently updated the distribution to require HTTPS between CloudFront and viewers. With the introduction of AWS Certificate Manager and the ...
7
votes
5answers
605 views

Are indexed Wordpress admin pages a security threat?

Because it was blocking Googlebot from accessing important files, I recently updated our /robots.txt file and removed most of it, including wp-admin. Now, the people on charge of hosting and SEO ...
3
votes
1answer
15 views

How to monitor a website's networking activity towards 3rd party servers?

I have a Wordpress site with some plug-ins installed. I would like to check if my site tries to access any 3rd party servers in the background. I'm aware of that I can open any php file on my server ...