3

I have a website in a shared hosting environment. Recently I found out that I can load other websites' contents using my own domain through URLs like mysite.com/~othersite/. This has resulted in Google indexing a malicious phishing website through my domain and sent me warning emails about it.

Tech support say this is normal behavior and if it bothers me I should upgrade to a VPS. They confirmed that I cannot correct this in my own .htaccess file or by other means as this happens at a higher level.

My question: Is this the usual, best-practice configuration for shared hosting environments or is the hosting company incompetent (or deliberately creating inconvenience to motivate upgrading)?

Am I requesting something overly technically complicated when I say that content from website X should under no circumstances be returned when the request is addressed with the domain of website Y? Is this an unrealistic expectation in a shared environment?

  • If the url situation is EXACTLY the way you describe then yes your host is noob and they have incorrectly set up the server. I would ask for all your money back and move to a competent host. The only time you should be able to see other shared service content is if you don't have an SSL and you're trying to use https mode. – dhaupin Mar 30 '15 at 0:31
  • I second @dhaupin on this. I used to be a web-host and back in the day the whole ~ thing was the lazy and insecure way to handle things. As well, there is no way that you should be able to access another site from your domain name. Forget upgrading!! Change hosts immediately! Find a quality host without saying a word and just change hosts with a bit of overlap for when the DNS changes so that your site stays up. Then cancel you current host. Hell! If I were still doing the hosting thing, I would not even charge you for a few months just to get you started in the right direction. – closetnoc Mar 30 '15 at 0:49
  • This is a major player in the hosting business, at least that is the impression I got when reading reviews. Not sure if I can name them here. – isarandi Mar 30 '15 at 0:55
  • Yeah. This should not happen and if they are incompetent enough to do this, then how can you trust them with your site?? What if this breaks security further and give people more access to your site than you anticipate? – closetnoc Mar 30 '15 at 1:35
  • To help (short-term) fix this problem on your site (having other sites indexed under yours), you could perhaps block all /~ URLs in robots.txt. – MrWhite Mar 30 '15 at 20:24
1

Is it really mysite.com/~othersite and not hostingcompany.com/~othersite or ip.address/~othersite.

They are perfectly normal ways of people using temporary URLs to view a website before DNS changes

  • It is mysite.com/~otheruser. – isarandi Mar 30 '15 at 0:53
  • 1
    Sorry, I have a hosting business and a dedicated server and have never seen that happen. – Steve Mar 30 '15 at 4:06
  • 1
    Okay. I can see that it affects all websites using this hosting company, so I notified them about the seriousness of the issue. – isarandi Mar 30 '15 at 10:15
  • mysite.com/~otheruser - Where "otheruser" is the username used on the other account, not the domain as could perhaps be inferred by ~othersite in your question? Unfortunately, on a shared server mysite.com is going to resolve to the shared server IP and this behaviour is not that uncommon - although I'm sure the host can block this in the server config and make sure it is only accessible by the IP?! – MrWhite Mar 30 '15 at 19:51
  • Not all sites will actually function correctly when accessed this way since client-side root-relative links will break. You can certainly prevent your site from being accessed this way by checking the Host: header in the request and sending a 403 if it's not what you expect. – MrWhite Mar 30 '15 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.