Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

2
votes
2answers
180 views

How to set restrictions on my website?

Currently my website is under maintenance. I want to be the only person who's able to access/view the website online until I finish maintenance. How to set restrictions to others ? I hate stalkers.
35
votes
9answers
2k views

Tools to check for common vulnerabilities?

Are there any good tools (desktop or online) which allow you to check whether your website has common vulnerabilities (e.g. SQL Injection, XSS)?
51
votes
10answers
4k views

Storing credit card details

I need to store credit card numbers for recurring billing through our 3rd party merchant. Are there any standards I need to adhere to regarding the storage of the details? We've been accepting credit ...
5
votes
2answers
2k views

How can I secure an installation of MediaWiki?

I want to run an installation of MediaWiki as a Internet-accessible personal wiki, running on wiki.mysite.com. However, I want to ensure that I am the only one who can read and write to this wiki. In ...
8
votes
4answers
1k views

Are “trustmarks” such as McAfee Secure worth the cost?

There are a number of services that will scan a website for vulnerabilities and allow the display of a "trustmark" image if the site passes their tests. This allegedly increases the level of trust a ...
7
votes
1answer
157 views

Is there any good reason I would want my website to be framed?

I'm building a website that's not security-critical in any way at all, so having somebody put a page in an <iframe> is not particularly dangerous to its users. However, as my website doesn't ...
6
votes
1answer
323 views

A bounce-rate attack to manipulate SEO?

This is a question to experienced people that might help us shed some light on the issue. We noticed a very strange behavior on our site, in Google Analytics. Some dude from Finland, namely, from ...
6
votes
6answers
5k views

Identify “non-secure” content IE warns about [closed]

As many know, if you serve a page over https and the content loads resources (images, stylesheets, js, SWF objects, etc) over http, older versions of Internet Explorer will show the user a warning ...
6
votes
3answers
265 views

How to fix a site that Google tells you is infected

I work for a company that setup a website, this one thelinearshop.com (warning this site contains malware so don't go there if you are concerned), before I started working for them. The site uses ...
5
votes
4answers
484 views

How to protect SHTML pages from crawlers/spiders/scrapers?

I have A LOT of SHTML pages I want to protect from crawlers, spiders & scrapers. I understand the limitations of SSIs. An implementation of the following can be suggested in conjunction with any ...
4
votes
2answers
488 views

Trigger IP ban based on request of given file?

I run a website where "x.php" was known to have vulnerabilities. The vulnerability has been fixed and I don't have "x.php" on my site anymore. As such with major public vulnerabilities, it seems ...
1
vote
2answers
4k views

What kind of information can websites collect about a user/client?

This is a multi-part question: 1) What kind of information can websites collect about someone (someone's computer or device) when they visit your website? I know we log IP's, and can determine your ...
4
votes
3answers
216 views

Are files in a hidden directory safe?

I have a directory on my ISP's web server, I don't want users to see files inside that directory, so I have a index.html file in it to redirect user to my main page, I wonder someone could still write ...
3
votes
3answers
2k views

What is deleteme.xxxxxxxx.php

I was going through page hit logs on awstats and I noticed the following two entries: /deleteme.lcivykmt.php /deleteme.nctqicjg.php I was wondering if anyone recognised them and whether I should ...
1
vote
3answers
1k views

My website has been hacked/attacked, says “reported attack page”

Three days back my website ganapatihegde.com has been hacked/attacked by some hacker. Now, when anyone tries to see my website, it says "Reported Attack Page!". I am using server provided by Free ...
15
votes
6answers
4k views

How Can I Secure A VPS Installation?

What are the basic steps to securing a VPS installation that I plan to install Webmin on to host my blogs and personal projects?
7
votes
5answers
216 views

What do I need to do to enable my site to accept credit cards?

I want to store my customers' credit card information in my database so that they can quickly check out again without having to re-enter their info. What do I need to know about security/https/etc to ...
10
votes
4answers
574 views

Does SSL really matter for most websites?

I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL. I've read plenty of ...
14
votes
2answers
464 views

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from?

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from? Are some SSL certificate vendors better than others? If so, why?
6
votes
3answers
207 views

Is website security accreditation worth having?

My site handles sensitive data, is there any website security accreditation that is well respected and worth having?
5
votes
3answers
225 views

Any tools for measuring the security of a site?

I'm wondering is there any tool for measuring or testing the security of a website ? I've written some ASP.NET web-app , So i would like measure the security of my own application and if there is ...
4
votes
4answers
258 views

How to restrict access to my site using htaccess

How to disallow access to site except me?
1
vote
2answers
674 views

GWT “Big traffic change for top URL”

I recently received an email from GWT saying that one of my URL's traffic has suddenly dropped. As it turned out the traffic to the whole site has drastically dropped, from some 300+ unique visitors ...
10
votes
1answer
607 views

How did Google manage to crawl my 403 pages?

I had a couple private files in a directory on my school folder. You could see that the files existed by going to myschool.edu/myusername/myfolder, but trying to access the files themselves via ...
6
votes
2answers
157 views

Does https site needs extra configuration after installation of SSL certificate?

I recently developed an incentive website for a European bank, and one of the requirements was SSL - the website displays some personal customer data (though no financial or really sensitive data). ...
6
votes
1answer
96 views

Is it necessary for a web developer to know how to hack website?

I'm a web developer. I'm just wondering that is it necessary for a web developer to know how to hack website than developing a website?
5
votes
3answers
320 views

SSL versus EV SSL

As I understand it, SSL certificates verify the connection between the host and the browser, preventing MITM attacks. Is it true that EV SSL verifies the host itself, thus preventing (in theory) ...
2
votes
2answers
127 views

Parallel website running a copy of my original website

We have been working on a gaming website. Recently while making note of the major traffic sources, I noticed a website that I found to be a carbon-copy of our website. It uses our logo, and everything ...
1
vote
2answers
491 views

Host header vulnerability reported by Acunetix Scanner

I am getting ready to launch a small web app and decided to scan the site with the Acunetix Web Vulnerability Scanner. I was quite pleased with the results for the most part, but the scanner reports a ...
1
vote
2answers
69 views

Posting public key

Should I put my public PGP key on my website so that people can securely contact me? I have seen personal sites where their public key is at the bottom of the page, such as this site by the computer ...
1
vote
2answers
184 views

Proper password handling for login

I have read a lot about PHP login security recently, but many questions on Stack Overflow regarding security are outdated. I understand bcrypt is one of the best ways of hashing passwords today. ...