3

I have a website in a shared hosting environment. Recently I found out that I can load other websites' contents using my own domain through URLs like mysite.com/~othersite/. This has resulted in Google indexing a malicious phishing website through my domain and sent me warning emails about it.

Tech support say this is normal behavior and if it bothers me I should upgrade to a VPS. They confirmed that I cannot correct this in my own .htaccess file or by other means as this happens at a higher level.

My question: Is this the usual, best-practice configuration for shared hosting environments or is the hosting company incompetent (or deliberately creating inconvenience to motivate upgrading)?

Am I requesting something overly technically complicated when I say that content from website X should under no circumstances be returned when the request is addressed with the domain of website Y? Is this an unrealistic expectation in a shared environment?

Improve this question
8
  • If the url situation is EXACTLY the way you describe then yes your host is noob and they have incorrectly set up the server. I would ask for all your money back and move to a competent host. The only time you should be able to see other shared service content is if you don't have an SSL and you're trying to use https mode.
    – dhaupin
    Mar 30, 2015 at 0:31
  • I second @dhaupin on this. I used to be a web-host and back in the day the whole ~ thing was the lazy and insecure way to handle things. As well, there is no way that you should be able to access another site from your domain name. Forget upgrading!! Change hosts immediately! Find a quality host without saying a word and just change hosts with a bit of overlap for when the DNS changes so that your site stays up. Then cancel you current host. Hell! If I were still doing the hosting thing, I would not even charge you for a few months just to get you started in the right direction.
    – closetnoc
    Mar 30, 2015 at 0:49
  • This is a major player in the hosting business, at least that is the impression I got when reading reviews. Not sure if I can name them here.
    – isarandi
    Mar 30, 2015 at 0:55
  • Yeah. This should not happen and if they are incompetent enough to do this, then how can you trust them with your site?? What if this breaks security further and give people more access to your site than you anticipate?
    – closetnoc
    Mar 30, 2015 at 1:35
  • To help (short-term) fix this problem on your site (having other sites indexed under yours), you could perhaps block all /~ URLs in robots.txt.
    – MrWhite
    Mar 30, 2015 at 20:24

1 Answer 1

Reset to default
1

Is it really mysite.com/~othersite and not hostingcompany.com/~othersite or ip.address/~othersite.

They are perfectly normal ways of people using temporary URLs to view a website before DNS changes

Improve this answer
8
  • It is mysite.com/~otheruser.
    – isarandi
    Mar 30, 2015 at 0:53
  • 1
    Sorry, I have a hosting business and a dedicated server and have never seen that happen.
    – Steve
    Mar 30, 2015 at 4:06
  • 1
    Okay. I can see that it affects all websites using this hosting company, so I notified them about the seriousness of the issue.
    – isarandi
    Mar 30, 2015 at 10:15
  • mysite.com/~otheruser - Where "otheruser" is the username used on the other account, not the domain as could perhaps be inferred by ~othersite in your question? Unfortunately, on a shared server mysite.com is going to resolve to the shared server IP and this behaviour is not that uncommon - although I'm sure the host can block this in the server config and make sure it is only accessible by the IP?!
    – MrWhite
    Mar 30, 2015 at 19:51
  • Not all sites will actually function correctly when accessed this way since client-side root-relative links will break. You can certainly prevent your site from being accessed this way by checking the Host: header in the request and sending a 403 if it's not what you expect.
    – MrWhite
    Mar 30, 2015 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.