Tag Info

New answers tagged

0

You can put this script into you're .htaccess file on root directory of you're website: ## block IP access ## order allow,deny deny from 81.17.31.162 deny from 81.17.31.164 allow from all ## block IP access ## In this case make all IP Address unless 81.17.31.162 and 81.17.31.164 to access you're website


2

As of August 2014 Google has officially indicated that HTTPS will be used as a ranking signal. This means that even if your website is a completely static website, if you care about SEO you should at least consider setting up an SSL certificate. Of course HTTPS is just one ranking signal out of hundreds, so there are probably more important things you can ...


0

I've been using the Wordfence Security plugin for Wordpress, as it: Allows you to ban certain IP addresses via Wordpress. Can be configured to block IP addresses after too many failed Wordpress logins. It will also email you whenever somebody has been locked out (or if somebody has logged in). Typically speaking, I get at least 10+ emails a day as bots ...


0

From the OWASP The referrer field (actually spelled 'referer') in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking. The OWASP actually regards this as vulnerability when used as the sole integrity or authentication method. Increasingly, I've observed bots no longer use blank referrers but use ...


1

We've made a tool for that – SslCheck. We've got tired of checking every web page manually and created a crawler. It goes through all pages and shows you which ones have "non-secure" content. All you need to do is enter you root URL. Hope it saves someone some time.


0

They malware might have infected the .htaccess on your site to redirect, identity.php to something else without ever touching the file system. Or it could be a hack into the PHP code to capture calls to identity.php and do something wit it. I would recommend your best course of action is to download the whole site codebase & do a search for identity.php ...


1

Oh boy are there! OAuth (Facebook, Google, Twitter), SAML, LDAP, PAM, HTTP Basic, HTTP Client Certificate, IP restriction, 2-Factor authentication, RSA token, biometrics.


2

Depending on how users access the site, you might be able to authenticate simply by their IP address. There is also HTTP authentication, both basic and digest. But if you need to differentiate between multiple users then these need to be stored somewhere, and regardless of the method used, this is a "database".


0

You could try using some eternal authentication like OAuth http://oauth.net/ or Facebook Login https://developers.facebook.com/docs/facebook-login/login-flow-for-web/v2.1 I believe OAuth still requires SQL usage though.


1

Yes, this bot is trying to exploit JCE. It’s probably using a very powerful publicly available exploit (+ mirror) for JCE < 2.0.11. Although this is a really outdated version, many instances are still in the wild. JCE 2.0.11 was released on 2011-08-29, the exploit has been available after the release (if its author kept his word). If JCE is not installed ...


3

This link explains what the CloudFlare SSL options are. Flexible SSL, at least at this time, does not fully encrypt to your server. The issue being discussed on the blog by Matthew ("Actually, we'll be providing a free certificate that's pinned to the domain that you can install on your server for end-to-end crypto.... for free") isn't available just yet. ...


1

There is not enough information for anyone to really know what is going on here. But here is what you may be missing. Any system has several services installed along with applications; FTP, HTTP, SSH, DNS, and PHP and Java are fairly common. You will have more. Each service and application can be vulnerable. PHP and Java are environments/languages that can ...


4

CloudFlare's Flexible SSL does not negate the need for a certificate on their servers. They will simply be providing you one for free. So there is still an SSL certificate tied to your domain that they provide. It only negates the need of a certificate on the origin server. From the discussion on the CloudFlare Blog Actually, we'll be providing a ...



Top 50 recent answers are included