Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

-2
votes
0answers
20 views

How can I stop users from canceling a free trial and opening a new account under a different email address? [on hold]

We are launching a website that will offer a 30 day free trial with the creation of an account. At the end of the trial, the account will convert to a paid subscription. We are thinking of ...
0
votes
1answer
34 views

How to setup an implicit FTPS encryption on cPanel server?

Currently my server is configured to use TLS encryption for FTP. It is explicit since it uses FTPES and on port 21. How can I switch to implicit FTPS that works on port 990? I'm using Pure_FTPd. I ...
0
votes
0answers
4 views

where did they get my gmail address? [migrated]

I pointed my browser at the website of a web developer I barely know, and the page returned was his home page, with the message "Welcome myname@gmail.com!" Whoa. Where did it get my gmail address? ...
0
votes
1answer
11 views

Methods to provide user data to web application in URL?

I am aware that one method to provide user data to web application is to use query strings. For example http://www.example.com/get-page.php?home=aaa.html would set variable home value to aaa.html and ...
1
vote
2answers
21 views

Online Marketing company want me to share my Google Account login details? Is this normal practice?

We are a small business and use "Google Apps for Work" and my google apps account was used to set up the business's "Google My Business" and related Google+ pages We have now engaged an online ...
2
votes
1answer
174 views

Permissions & File Structure w/ nginx & multiple sites

I am using nginx for the first time as a long time Apache user. I setup a Linode to test everything and to eventually port over my websites. Previously I had /home/user/www (wwwroot) I am looking ...
1
vote
1answer
61 views

How to set permissions for DooPHP?

I have downloaded and installed DooPHP according the Installation instructions. However, there is no statement on how to set permissions. Also not in INSTALL.TXT which comes with the product. The ...
13
votes
7answers
2k views

Are “trustmarks” such as McAfee Secure worth the cost?

There are a number of services that will scan a website for vulnerabilities and allow the display of a "trustmark" image if the site passes their tests. This allegedly increases the level of trust a ...
0
votes
1answer
83 views

Site speed when using ddos protection by cloudflare

I've recently noticed an increase of sites using ddos protection by cloudflare and wondering the effects on both user experience and SEO. I've notice these redirect messages last from anywhere from 2 ...
0
votes
3answers
52 views

WordPress Site Hacked? Phising scam?

We just got a note from CloudFlare that we got reported for phishing. The link they provided was (domain name removed): /wp-content/plugins/scure-bank/fea7b6cabec2fd724dd2d1b4ca7e898d/thankyou.php ...
3
votes
3answers
144 views

Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?

I'd like to submit my personal site into the Chrome HSTS preload list. The site there says: In order to be included on the HSTS preload list, your site must: Have a valid certificate. ...
0
votes
0answers
18 views

What kind of attack causes a JavaScript 'out of memory' on the attackers device?

We experienced a strange attack yesterday. Our error log picked up the same 'out of memory' JavaScript error from a single IP address every 10 seconds. The requests came from 6 client ports on the ...
5
votes
3answers
99 views

How do i make it difficult for users to make multiple accounts

I'm creating a website for my business and I want to offer free first deliveries for the first week but I'm afraid people will take advantage of that. I don't take any money or credit card info ...
0
votes
1answer
296 views

How to trace origin of script injected in my webpage

I was looking through a static site I created on my local server, in my web browser, and found a curious call to an external script <script ...
1
vote
1answer
14 views

Disable ftp://hostname for my website [closed]

I'm hosting a page and I'm having a problem. If I write ftp://myhostname, the browser asks for FTP username and password and I think this may be a security problem because it doesn't happen with other ...
0
votes
0answers
16 views

Possible to leave proc_open() enabled on a shared host?

We are working on a PHP component that requires proc_open() for it to work. Because of this, we have trouble running on common shared hosts because proc_open() together with other functions like ...
1
vote
1answer
33 views

Looking for easy-to-maintain and secure directory structure for multipart site

I recently inherited an older custom PHP website that consists of three parts: a public section for all to see, a members section, and an administrator section. The directory section resembles the ...
1
vote
0answers
25 views

Database of hacking attempt strings? [closed]

I have a strange URL request that's showing up in my logs, and I want to see if it's a hacking attempt. Is there a database or resource out there somewhere where I can see if this url is a common ...
0
votes
0answers
36 views

Security in MVC code-first entity framework

I am new to ASP.NET MVC and to Azure (in which our application will be hosted). And I am new to security in general. So I'm wondering how secure the use of code-first entity framework in asp's ...
13
votes
2answers
4k views

How to find domain registrar and DNS hosting with good DNSSEC support?

Simplified problem I want to buy a domain and make a website that is fully secured with DNSSEC. I want to make sure that only the one right SSL certificate could be validated by the browsers and all ...
1
vote
1answer
57 views

Suspicious script loads ONLY when navigating to site via search engines

I cannot find anywhere on our site where this code is referenced. More importantly it does not appear when navigating directly to our URL, it only appears when coming from a search engine (including ...
1
vote
1answer
24 views

In httpd.conf why would you want AddType for phps?

We have an AddType as follows: AddType application/x-httpd-php-source .phps I was wondering what this was, and did some searching. It seems this is barely documented anywhere. Based on a hunch, I ...
1
vote
1answer
100 views

Google's point of view to SSL - Do I need to force HTTPS protocol for all pages on website

Well now that google clearly declared that SSL would positively affect seo I want to know in which of the following conditions I fully benfit from ssl: 1.If I server https connection for all pages of ...
3
votes
1answer
48 views

How do I grant security to my site users to be able to upload files in Windows Server 2012

Using Windows Server 2012 and IIS 8, I want my site users to be able to upload pictures and generate eft files and export files etc. All of these tasks require my users to have write permission to ...
0
votes
2answers
601 views

What are the security implications of using Google Analytics?

I'd like to start using an analytics tool (namely Google Analytics) to collect information on how my web app is used, by whom, and what our user's technical capabilities are. As part of the ...
1
vote
2answers
87 views

Private folders which are not indexable

I have a requirement where I need to distribute about 400 copies of a pdf document (about 6 MB) and .pub files, that are personalized for each user. Every user must have access to only his/her set of ...
0
votes
0answers
32 views

SSL Certificate issue: “doesn't have public audit record”

After renewing ssl certificate in our website, there seen "doesn't have public audit record" What is mean by this dialogue? Is it make any problems in websites security and how can i overcome this ...
2
votes
4answers
342 views

WordPress keeps redirecting my users to install.php, Is it caused by an injection hack?

I don't really know how to express my problem, so bear with me. This is a bit hard to explain. I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the ...
1
vote
0answers
13 views

Secure Badges on Site? [duplicate]

I have a new client whose site I will be re-building. I noticed on his site he has a badge from McAfee saying the site is secure. Below is an example: I have seen similar type badges by other ...
1
vote
2answers
345 views

What are spiders trying to achieve on my site by fetching lots of non-existant urls such as various versions of phpMyAdmin?

I've recently set up a build server that compiles Java source on Github webhooks. I created a public page for downloading latest .jars with a top level domain and I'm logging requests to it. What are ...
3
votes
2answers
150 views

Website is being targeted by mail bots

have a small website. When I perform a netstat is shows a lot of traffic from .p.mail. I think this is some kind of mail bot, trying to harvest email addresses from my website. How can I prevent ...
0
votes
3answers
67 views

Get phone number of (via mobile networks) browsing mobile device

I recently figured out, that the web site of my phone provider (mobile) mysteriously identifies me and automatically logs me into my account when I'm accessing with my android phone, as if it knew my ...
1
vote
0answers
30 views

Security and Apache Methods

I occasionally get annoying POST requests but one lately caused a 500 error. Not a biggie really, but it got me thinking. My site does not have but one form. Outside of this, POST should not exist ...
0
votes
0answers
13 views

WordPress site hacked, recovered but Google still has hacked page description [duplicate]

My website got hacked recently and recovered it. It was populating casino ads on my website. There were virtually made URLs where casino pages were displayed. I suspected the code came through a ...
2
votes
1answer
74 views

Malicious copy of site

After seeing an increase of shady organic keyword results appearing in Google Analytics we identified the referring Hostname. After adding the exit page to hostname we discovered someone cloned our ...
0
votes
0answers
14 views

CGI/FastCGI does not prevent me from reading other users files

I installed mod_fcgid.so for Apache to run every script under its user account. I looked at PHPinfo to see if it is loaded, and it is OK. Now when I try to read file content that belongs to another ...
3
votes
2answers
252 views

How to remove adware pop up?

I get an ad pop up that should not be on the site. It has only appeared once. The HTML code for the pop up window that appeared: http://pastie.org/5674909 Here is the full HTML pastie: ...
1
vote
0answers
15 views

White labelling with frames and IE

I have a SaaS application that offers some basic white-labelling functionality related to CSS, company logos etc. However, one client now wants to white-label the application with their own URL so ...
1
vote
1answer
39 views

What might happen if I use FTP client without TLS?

For some reason connecting to server using FTP client (eg. filezilla) is not working with TLS encryption enabled. I had to disable it to use FTP. So wondering why is TLS needed in the first place and ...
2
votes
0answers
31 views

mod_ident not to be trusted? [closed]

I'm looking at Apache's mod_ident: http://httpd.apache.org/docs/2.2/mod/mod_ident.html However, on this page it has the following disclaimer: The information should not be trusted in any way except ...
2
votes
1answer
42 views

How do I get Windows Server 2012 to prompt me for credentials when I go to a restricted subfolder of my site?

The "Users" group has read access to my entire website so the public can browse my site. Now, I have created an "admin" subfolder which I do not want the public to have access to. So in the ...
2
votes
1answer
63 views

How can I figure out how a search engine is finding hidden pages?

We have a system hosting many websites for our customers, and inside that system there is a method that non-live customers can view their sites before we turn them on. Say the link is something like ...
0
votes
0answers
50 views

Framekiller and google rankings

This is the javacript code that I use to prevent clickjacking in my current project. <style id="antiClickjack">body{display:none !important;}</style> <script ...
0
votes
0answers
17 views

External clients get a certificate mismatch - but internal clients do not [closed]

I have a scenario where external clients are receiving a certificate that is different than the one that is bound to the IIS site. This is Win2008R2 / IIS, in the following configuration: ...
5
votes
4answers
2k views

How To Hide From BuiltWith?

Out of curiosity, does anyone know how builtwith.com works? How does it identify the platform or app a website is using? And most importantly does anyone know how to hide the details from it? Somehow ...
2
votes
1answer
67 views

Unknown subdomains pointing to my domain name

About 6 months ago I purchased the domain name example.net. Today I was trying to go to my control panel at example.net/cpanel but accidentally went to cpanel.example.net. I found a completely ...
12
votes
1answer
454 views

Could somebody hijack my Google Analytics for a site?

I track many websites in Google Analytics. Recently I accidentally added tracking code for site A to site B, which I noticed a couple of weeks later. By then, one website had two weeks of no visitors, ...
1
vote
2answers
134 views

Can Internet Explorer use the AES crytographic algorithm for HTTPS?

I wanted to disable RC4 and "force" PFS on my website. Without modification, every browser used RC4. As I don't have access to the root directory I did it by modifying the .htaccess file. Note: The ...
1
vote
1answer
13 views

Security issues around giving directory link

I have a directory under my public directory that I use for file transfer purposes. I put songs I'm working on here and then send the link to other band members, etc. It's the simplest way I've found ...
0
votes
1answer
42 views

SSL issue with firefox

My website is hosted on hostgator and i have purchased their ssl service. Now when i open my website in chrome then it works fine but when i open it in firefox it gives me error like The ...