10

I'm trying to think of ways to, as securely as possible, verify that a user owns a website that they claim to own.

Here are some ways I've seen:

  • Upload an obscurely-named HTML file to the root directory with given contents
  • Include a meta tag or other comment somewhere in the home page source
  • Send an email to an address @domainwearetryingtovalidate.tld with a verification link
  • Check a CNAME or TXT record
  • Check WHOIS records
  • Physically validate by calling or emailing the support line, manually updating records

And here are the problems with those methods, in order:

  • Some website configurations may not allow for simply uploading a file to the root
  • Poor site design might allow a user of that site to add this meta tag themselves
  • Websites which provide email services make this useless; take gmail.com for example
  • That's too complex for most small website owners to figure out how to do
  • Those are public; anyone can claim to be whoever. Not to mention most often inaccurate.
  • Huuuuge waste of time

Are there any other ways to verify that a user on your site owns a particular website? Of the methods I listed, which of these are best and worst? I ordered them from best to worst in my own opinion, but I'd like to see what others think as well.

I plan on implementing one or more of these in PHP.

Improve this question
10
  • For an automated solution, you're stuck to what you listed. Other major companies (i.e. Google) use one of the first four options. I'd find it incredibly irregular for a user not to be able to do one of the first four.
    – Jonny Keogh
    Aug 11, 2011 at 18:01
  • I love how you actually thought so long and hard about this silly requirement, but then when you came to the only viable solution, called it a "huuuuge waste of time". Megalols.
    – Lightness Races in Orbit
    Aug 11, 2011 at 18:09
  • @Tomalak: If you'd like to work for my site for free and manually email and call contact addresses, you can start work Thursday ;)
    – Cyclone
    Aug 11, 2011 at 18:11
  • 2
    I think that the first problem you have to solve is to decide: what does "owning" a website mean? Being an administrator? Having access to the filesystem? Having a legal ownership right? Having a maintenance duty by way of written or spoken agreement? Paying the hosting bills? Paying the domain bills? Paying the designers?
    – Lightness Races in Orbit
    Aug 11, 2011 at 18:12
  • 1
    @Cyclone: I am working for you for free, by virtue of the fact that I'm completely wasting my time contributing to this question.
    – Lightness Races in Orbit
    Aug 11, 2011 at 18:12

5 Answers 5

Reset to default
9

I definitely think

  • Upload an obscurely named html file to the root directory with given contents

is the best way to go. I've actually had to do this once. And I don't think many website configurations prevent you from doing this.

If you're really concerned about this, why not allow all (safe) options?

Regarding your comment:

Yes but with MVC systems (such as codeigniter), it can be a hassle to figure out how to access a physical file which isn't a part of the main system

In these rare cases, let those admins go with the CNAME / TXT records or call them :-)

Improve this answer
7
  • 1
    Right.. that's actually where I had to do it ;-)
    – aioobe
    Aug 11, 2011 at 18:02
  • 2
    The first two I listed were from google webmaster tools
    – Cyclone
    Aug 11, 2011 at 18:03
  • @Cyclone, I agree with you that the former one seems more secure than the second one.
    – aioobe
    Aug 11, 2011 at 18:03
  • The thing that sucks about this is that you end up with one obscurely-named file per service, cluttering up the root directory. It's not a terrible flaw, but there are cleaner alternatives.
    – Bobby Jack
    Mar 11, 2018 at 14:19
  • 1
    @BobbyJack "cluttering up the root directory" - The service implementing the verification process doesn't need to use the root directory. They could, for instance, use a /.well-known subdirectory instead. If the service requires a file in the root, then the website could internally rewrite the request elsewhere so nothing needs to be physically stored in the root directory if that is not desirable.
    – MrWhite
    Jul 26, 2021 at 16:28
7

Uploading an obscurely named file is the way to go.

You wrote the drawback is that they may not be allowed to upload a file to the root. Well in that case it means they don't own the website, which is what you're trying to find out.

Improve this answer
7
  • Exactly. You don't need "root" access to the server, i.e. outside of the html or www folder.
    – Chris Laplante
    Aug 11, 2011 at 18:04
  • I mean not allowed to in that rewrite rules may make it difficult or complex to upload the file
    – Cyclone
    Aug 11, 2011 at 18:04
  • @Cyclone, true but I guess it's quite rare to disallow access to a physical HTML file.
    – Laurent
    Aug 11, 2011 at 18:06
  • Yes but with MVC systems (such as codeigniter), it can be a hassle to figure out how to access a physical file which isn't a part of the main system
    – Cyclone
    Aug 11, 2011 at 18:07
  • I think CI still allows access to physical HTML files. But just in case, you could also allow the metatag method, so that your users are not stuck in case there's a problem with their .htaccess file or MVC framework.
    – Laurent
    Aug 11, 2011 at 18:09
1

I would recommend using meta tag...

  • Include a meta tag
Improve this answer
1
  • 1
    Why? (What if the root document doesn't serve a text/html response?)
    – MrWhite
    Jul 26, 2021 at 12:20
0

The microformats site is down now as I write this, but the Google cache is available. This is a solution for you:

http://microformats.org/wiki/RelMeAuth

Improve this answer
-1

Personally I would go with the automated email option.

Ask the user to input their URL and email address, checking that the domain is the same in both cases. The use the same system as password reset systems use:

  • Generate a random hash, partly made up of the current microtime and domain
  • Store the hash in a database
  • Send the user an email with a verification link, where the 'id' parameter is the hash
  • Now the user is verified (delete the row from the database)

For added security, store the time that the hash was generated, and then have it time out after an hour or two.

Improve this answer
1
  • This doesn't verify ownership of a website - just that they have access to "an" email account on that domain. The email could be managed by an entirely different service to the website. Also, if I run a service that gives end users an <email-address>@mydomain.com - should those users be able to verify ownership of mydomain.com?!
    – MrWhite
    Jul 26, 2021 at 16:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.