Preventing a system from unauthorized access, modification, disruption, or destruction.
34
votes
9answers
1k views
Tools to check for common vulnerabilities?
Are there any good tools (desktop or online) which allow you to check whether your website has common vulnerabilities (e.g. SQL Injection, XSS)?
49
votes
10answers
2k views
Storing credit card details
I need to store credit card numbers for recurring billing through our 3rd party merchant.
Are there any standards I need to adhere to regarding the storage of the details? We've been accepting credit ...
5
votes
2answers
2k views
How can I secure an installation of MediaWiki?
I want to run an installation of MediaWiki as a Internet-accessible personal wiki, running on wiki.mysite.com. However, I want to ensure that I am the only one who can read and write to this wiki. In ...
7
votes
1answer
140 views
Is there any good reason I would want my website to be framed?
I'm building a website that's not security-critical in any way at all, so having somebody put a page in an <iframe> is not particularly dangerous to its users. However, as my website doesn't ...
6
votes
5answers
4k views
Identify “non-secure” content IE warns about
As many know, if you serve a page over https and the content loads resources (images, stylesheets, js, SWF objects, etc) over http, older versions of Internet Explorer will show the user a warning ...
4
votes
4answers
402 views
How to protect SHTML pages from crawlers/spiders/scrapers?
I have A LOT of SHTML pages I want to protect from crawlers, spiders & scrapers.
I understand the limitations of SSIs. An implementation of the following can be suggested in conjunction with any ...
3
votes
3answers
158 views
Are files in a hidden directory safe?
I have a directory on my ISP's web server, I don't want users to see files inside that directory, so I have a index.html file in it to redirect user to my main page, I wonder someone could still write ...
2
votes
1answer
313 views
Trigger IP ban based on request of given file?
I run a website where "x.php" was known to have vulnerabilities. The vulnerability has been fixed and I don't have "x.php" on my site anymore.
As such with major public vulnerabilities, it seems ...
1
vote
3answers
952 views
My website has been hacked/attacked, says “reported attack page”
Three days back my website http://www.ganapatihegde.com has been hacked/attacked by some hacker. Now, when anyone tries to see my website, it says "Reported Attack Page!". I am using server provided ...
0
votes
2answers
2k views
What kind of information can websites collect about a user/client?
This is a multi-part question:
1) What kind of information can websites collect about someone (someone's computer or device) when they visit your website?
I know we log IP's, and can determine your ...
11
votes
6answers
2k views
How Can I Secure A VPS Installation?
What are the basic steps to securing a VPS installation that I plan to install Webmin on to host my blogs and personal projects?
6
votes
5answers
203 views
What do I need to do to enable my site to accept credit cards?
I want to store my customers' credit card information in my database so that they can quickly check out again without having to re-enter their info. What do I need to know about security/https/etc to ...
13
votes
2answers
413 views
If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from?
If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from? Are some SSL certificate vendors better than others? If so, why?
4
votes
2answers
179 views
Any tools for measuring the security of a site?
I'm wondering is there any tool for measuring or testing the security of a website ?
I've written some ASP.NET web-app , So i would like measure the security of my own application and if there is ...
3
votes
4answers
223 views
9
votes
1answer
507 views
How did Google manage to crawl my 403 pages?
I had a couple private files in a directory on my school folder. You could see that the files existed by going to myschool.edu/myusername/myfolder, but trying to access the files themselves via ...
6
votes
2answers
115 views
Does https site needs extra configuration after installation of SSL certificate?
I recently developed an incentive website for a European bank, and one of the requirements was SSL - the website displays some personal customer data (though no financial or really sensitive data).
...
6
votes
3answers
236 views
How to fix a site that Google tells you is infected
I work for a company that setup a website, this one thelinearshop.com (warning this site contains malware so don't go there if you are concerned), before I started working for them. The site uses ...
5
votes
1answer
86 views
Is it necessary for a web developer to know how to hack website?
I'm a web developer. I'm just wondering that is it necessary for a web developer to know how to hack website than developing a website?
4
votes
3answers
263 views
SSL versus EV SSL
As I understand it, SSL certificates verify the connection between the host and the browser, preventing MITM attacks. Is it true that EV SSL verifies the host itself, thus preventing (in theory) ...
1
vote
2answers
316 views
GWT “Big traffic change for top URL”
I recently received an email from GWT saying that one of my URL's traffic has suddenly dropped. As it turned out the traffic to the whole site has drastically dropped, from some 300+ unique visitors ...
1
vote
2answers
168 views
Proper password handling for login
I have read a lot about PHP login security recently, but many questions on Stack Overflow regarding security are outdated.
I understand bcrypt is one of the best ways of hashing passwords today. ...
