Tag Info

New answers tagged

0

Is redirecting only to URLs that start with "/" sufficient validation? If you are passing the URL to redirect to as a URL parameter then you still need to validate (or at least sanitize) it as much as possible. Remove any strange characters, strip (or validate) the query string, etc. You should also be constructing an absolute URL for your Location: ...


0

Without a doubt, you need to disclose these practices in your term of service and privacy policy. My rule of thumb is that you probably shouldn't collect anything that you wouldn't feel comfortable explaining to your users or disclosing publicly (what if you ended up having to explain it in court?). Obviously, you need to be very careful (PCI compliance ...


0

You need to: Create the sending e-mail account on your server/host Set up DomainKeys and SPF on your hosting account Configure the account as SMTP, with the CORRECT e-mail adress on Joomla Global Configuration (if you need to get replies to another account, use the "reply to" field, but that isn't very good, as sometimes it counts points towards spam ...


1

The 403 Forbidden error is due to the access denied issue as intended, there is no issue here - that seems fine. The 404 Page Not Found error is due to your .htaccess file looking for and not finding where it expects, some kind of customised error page to show in this circumstance. It's possible your hosting provider may have this configured at the ...


1

Some types of malware that creep into sites are triggered by "referrer" eg; using a bookmark, or going directly to site comes up clean, however when the referrer is a search engine like Google or Bing, the malware becomes active, and detectable. The old "pharmahack" worked this way. When in doubt, FTP a copy of your sites files and scan them locally. You ...


1

Maybe check the website on http://sucuri.net or similar which will show you the blacklist status on some of the most popular monitoring services such as Google, Norton and SiteAdvisor etc. If you haven't already, set up a Google Webmaster Tools account including a valid email address for the website and Webmaster Tools will notify you when malware is ...


3

It's possible he tried to surf to your site as https://yoursite.com instead of http://yoursite.com and AVG told him the security certificate is not valid and blocked the site. Browsers usually handle that, but AVG may have handled it in this case If your site does not have a Security Certificate, browsers and anti-virus will warn you that an SSL error has ...


2

A hosted WordPress.com blog would already seem to offer all the privacy settings you would need. Not only can this block the content from search engines, but can also be set to "invite only": Source: Site Visibility - Privacy Settings


5

1. Serverside - block Search Engines Create a robots.txt file in your root directory and add this text to it: User-agent: * Disallow: / Theoretically, This should block all search engines (the ones that honour robots.txt). 2. Know how Search Engines are crawling your site and control your site's visibility. Since you want it to be extremely private, I ...


1

HTTPS can achieve two things: Authentication. Making sure that you are communicating with the real domain owner. Encryption. Making sure that only this domain owner and you can read the communication. Probably everyone agrees that HTTPS should be mandatory when transmitting secrets (like passwords, banking data etc.). But there are several other cases ...


1

With me helping with the back-end system for a web hosting company, we strive to make sure our customers personal data is secured by SSL and we do encrypt their name, address, and phone numbers to just make sure if there is any data breaches, there should be minimal damage as possible. Trust is one thing when it comes to having loyal clients. As for your ...


1

You'll want to use SSL for any pages in the checkout process, for sure. Encrypting address data in your own database is optional. If someone were able to access your database, they'd likely be able to get your encryption key also, so that would provide little defense. Also name and address are not nearly as sensitive of information as credit card data.


-1

Hi to be honest to the best of my knowledge the most common WP hacks are either weak PW security that has been compromised and allowed malicious code / updates to be made (consider the number of WP admins that didnt change the default UN 'wp-admin' thats already half of the auth guessed). Or for historic installs / ones with the offending versions bad ...


0

The PHP code that John Conde posted does not work. It replaces the entire .htaccess file as an undesirable result. The PHP below would be a good replacement for his PHP and I have tested it. <?php $ipdeny = 'deny from ' . $_SERVER['REMOTE_ADDR']; file_put_contents('.htaccess', $ipdeny . PHP_EOL, FILE_APPEND); ?>



Top 50 recent answers are included