Questions tagged [security]

Preventing a system from unauthorized access, modification, disruption, or destruction.

Filter by
Sorted by
Tagged with
0 votes
0 answers
30 views

Blocking "malicious" VPN access

I run a small website that averages about 500 hits a day. About once a month I have a day where I see a spike of 5,000 in GA4. When looking closer, the traffic would appear to be a bot using a VPN ...
Trebor's user avatar
  • 3,145
2 votes
1 answer
56 views

How to hide my username from the URL? [closed]

At my WordPress site, on every post (and comment) my DISPLAY NAME (author's name) appears, and it is fine. If a reader clicks that name then it shows the author page (blog page) with all the posts by ...
Kumar's user avatar
  • 23
0 votes
1 answer
30 views

Problem to detect security script like X-Frame through .htaccess file in WordPress and how to trace and find the problem?

I transferred my WordPress website from a hosting company to a virtual machine. I want to add some security scripts like X-Frame, CSP, and HSTS. Before that, I edited the .htaccess file from the ...
Mohsen Akhavan's user avatar
0 votes
0 answers
29 views

Website spoofing our site under different domain. How do I block it?

I've been trying to stop another domain operator from spoofing one of my client's websites and can't figure out how to do it. Our site is https://autism-products.com and the site spoofing us is https:/...
eCommerce Institute's user avatar
0 votes
1 answer
246 views

"Deceptive site ahead" issue with my Laravel app

I developed a Laravel app using Laravel. After deployment, every time I try to access the app, it says "Deceptive site ahead". I tried searching for fixes and doing almost everything that I ...
Syl's user avatar
  • 3
0 votes
0 answers
110 views

"GET / HTTP/1.1" requests getting 404 from malicious agents and bots?

I was checking my server logs and I see some requests simply for "GET / HTTP/1.1" are getting 404 error but only from seemingly malicious users and bots. I thought 404 was only server-side ...
user1086516's user avatar
0 votes
1 answer
62 views

Antivirus software flags website with "Caution: This site may contain content that could affect your online security" in Google Search results

I'm a web developer. A local installation of the WebRoot antivirus software is flagging my client's construction website with the warning "Caution: This site may contain content that could affect ...
Highly Irregular's user avatar
1 vote
1 answer
215 views

Using dynamic content in Wordpress by decoding and using a JWT passed on the URL, without logging in any user

I have a Wordpress and I don't want to create users for the next functionality: I need a page that has this behaviour: URL1 = https://my-site.example.com/some-page/ => Renders some public content ...
Xavi Montero's user avatar
1 vote
0 answers
21 views

Will Website Security tests (Security Penetration) hurt my WordPress page? [closed]

I have a WP page. I did a security checkup through the usual website auditing tools. I'd like to use a tool specialized for Security checks. Will it hurt my website somehow? What would you recommend, ...
Sarian Morio's user avatar
2 votes
1 answer
135 views

Why the facebook pixel tests well in Chrome but not in Firefox?

I've a website with a facebook pixel via Tag Manager. I fire a "page view" FB event triggered on the "page view" tag manager event. In chrome I then open the pixel tester on Chrome ...
Xavi Montero's user avatar
0 votes
1 answer
84 views

What is the real risk in not using an SSL certificate?

Note, I'm not asking whether or not I should use an SSL certificate, as I will always use one when possible. Better safe than sorry, but now I'm working on a group chat using a PHP web socket and ...
Vincent's user avatar
  • 181
2 votes
3 answers
1k views

Cloudflare WAF rule for blocking a path except from two countries instead block all traffic to the site

I want Cloudflare WAF to restrict admin section of WordPress site/wp-admin/ and allow access to WP admin section from only two countries India & UAE. For some reason it block traffic from all ...
Learning's user avatar
  • 711
1 vote
0 answers
20 views

I change everything but again Instagram knows it's me [closed]

I change my device, my public dynamic IP address, account, username, password, email, browser, app, cookies and everything and again Instagram knows it's me, and my question was do you know that can ...
AndroidCrop's user avatar
1 vote
0 answers
34 views

Unwanted ads so on websites seems to be ad malware

Google popup Ads randomly show on two of our websites which are hosted with same hosting provider and possible on same server as its shared hosting. We dont use and kind of ads on our websites Ads ...
Learning's user avatar
  • 711
2 votes
1 answer
190 views

Security headers set in .htaccess not taking effect on WordPress site with Cloudflare

We have a site on WPEngine that uses WP Rocket cache and Cloudflare where I have added security header directives in the .htaccess file, <IfModule mod_headers.c> # X-XSS-Protection ...
AlanP's user avatar
  • 121
3 votes
2 answers
100 views

Rules in .htaccess only if the requested URL is /wp-admin

I want these lines from my .htaccess to execute only if the URL is not /wp-admin: Header add Content-Security-Policy "default-src 'self';" Header add Content-Security-Policy "script-src ...
hendrik-eg's user avatar
3 votes
0 answers
75 views

Avoiding Microsoft Edge "isn't commonly downloaded" warning

I have shifted software downloads for our customers to download from our domain instead of Dropbox. Now Microsoft Edge raises the "isn't commonly downloaded" warning. I had this on Chrome ...
DLT's user avatar
  • 31
0 votes
0 answers
22 views

How to correct company website classification at the database level from companies like Sophos

A Corporate client using web blocker such as Sophos cannot access our company website. Blocker comes back and indicates our site is "Sex Education" however it is mental health education. I ...
Steven MacIntyre's user avatar
0 votes
1 answer
30 views

Malicious activity on website using site's search bar

It started with a few but now the number has increased to more than a hundred. I am seeing strange urls getting hit as errors in my Google search console, not sure how is this being done but someone ...
Akash Parcha's user avatar
2 votes
1 answer
240 views

Can I replace rua entry with ruf in DMARC record?

I currently have a DMARC record set up like this: v=DMARC1; p=none; fo=1; rua=mailto:[email protected] but I am receiving a lot of reports everyday. I would like to only receive failure reports (...
user1448031's user avatar
0 votes
0 answers
22 views

Is single-word form submission a known attack?

I have one website that is consistently getting weird form submissions. It's a contact form that captures name, email, subject, and message. Five to ten times per day it gets a submission where all ...
philolegein's user avatar
1 vote
0 answers
992 views

.htaccess security headers for IONOS

I need to implement security headers for a website hosted by IONOS. I've used the following code, which works on sites hosted elsewhere, but not here. <IfModule mod_headers.c> Header set ...
Andrew's user avatar
  • 119
2 votes
1 answer
98 views

As a Webmaster, how are you handling the response to the war in Ukraine in regards to managing your site(s)?

This is a community wiki intended for our users to be able to share ideas as to how Webmasters are managing the response to the war in Ukraine for their site(s). There are no right or wrong answers, ...
3 votes
2 answers
123 views

Do I need a wildcard SSL certificate to secure my website and email subdomains through cPanel?

I have a website and emails through the same hosting provider which I manage through cpanel. At the moment I am using zeroSSL to secure my website (www.example.com), however, this does not support my ...
Odoug4's user avatar
  • 33
3 votes
0 answers
38 views

'[0] appended to multiple URL parameters, is something scanning for vulnerabilities?

I use a WAF that monitors suspicious query string and form POST values. Typical script-kiddie stuff like common SQL injection strings, etc. Over the last several months I've noticed a dramatic uptick ...
CodeWhisperer's user avatar
3 votes
2 answers
1k views

My website has been cloned without authorization. What can I do?

I have the following problem: I operate an online service and about 2 months ago a Copy Cat clone appeared under a strange domain unknown to me. My portal is simply mirrored/redirected to another ...
user avatar
1 vote
0 answers
17 views

Limiting what affiliate's Google Tag Manager can inject into my site

I am managing a website where we sell products. We have an affiliate program. I want to facilitate the affiliates the tracking for them to optimize the campaigns. Currently we display a different ...
Xavi Montero's user avatar
14 votes
1 answer
7k views

Spike in Traffic from "Facebot Twitterbot" user agent

My website, which typically has very low volume, suddenly received a huge spike in traffic all from the same user agent. We were receiving about 3 requests per second for a sustained period of about ...
Wold's user avatar
  • 372
0 votes
0 answers
308 views

How are credentials stored and encrypted in Nexus Repository Manager OSS 2.14?

How does Nexus Repository Manager OSS 2.14 store and encrypt it's user credentials? I couldn’t finy anything in the documentation, knowledge base nor on the web on how credentials (local users) are ...
BlackEye's user avatar
  • 101
5 votes
2 answers
923 views

Should rel="noopener" be set on links to external sites even if I own the site?

We've had a policy to always set rel="noopener" for all external links. However is that necessary if the external link is to a site in our own control? Let's say we own both coffee.example....
Drkawashima's user avatar
2 votes
1 answer
32 views

Recording / Logging CSP Violations

I am in the process of implementing a CSP policy for a variety of domains and am looking for a method to record/log browser CSP violations encountered by any end user. I want to make sure I don't miss ...
Mark Bosky's user avatar
0 votes
1 answer
69 views

Restricting access to a website without using sessions or IP whitelisting? [duplicate]

I want to restrict access to a private website that needs to be accessible to multiple people. In the event the website has public and private areas, a login to a user session is the usual solution. ...
Timothy B.'s user avatar
1 vote
0 answers
40 views

Hosting web site with onion share [closed]

So, i don't use any kind of social media and i decided to make my web site instead of that. This idea is inspired by guy named Luke Smith from youtube and i want to make it to look smiliar to this: ...
Ivan's user avatar
  • 11
1 vote
1 answer
60 views

Is there a reason not to use HTTPS? [closed]

Edit: this question is more complete than mine. I sometimes login to a website that provides both HTTP and HTTPS, even for the login page. Although I use HTTPS to encrypt my credentials, it would be ...
Dan R.'s user avatar
  • 113
4 votes
2 answers
145 views

Is there any way I can defend against automated file download bots?

My company offers a very specifically tailored Android application to supplement our other software. Since users must have an account in our other software in order to use the Android application, is ...
Ben Bloodworth's user avatar
3 votes
2 answers
250 views

Is it possible for a hacker to point another domain at my domain?

Recently when I search my website on google, I find that another domain's description is identical to my domain. I'm terrified and try to understand the security breaches of my website as much as ...
LittleTeemo's user avatar
1 vote
1 answer
39 views

How to securely share a link to a video on my server

I've created a web system for daycares on which the educators can upload videos of the kids, and then share those videos with the parents. Currently the way I'm doing this is very simple. My system ...
Vincent's user avatar
  • 181
2 votes
1 answer
55 views

Making a domain more trustworthy to corporate networks so that it won't be blocked by their filters

I developed a web app for a customer which is made in basic PHP/MySQL, pretty normal site, lighter than WordPress, and when my customer went to his client to sell the app the domain was blocked by the ...
Charles Bergeron's user avatar
1 vote
0 answers
34 views

Gratis email boxes filter my contact form emails ; local email box doesn't ; but what if I want a domain registrar email box? [closed]

My domain registrar and my hosting provider are not the same company. On my shared hosting environment with CentOS, Bash, Apache, PHP and MySQL I host an all core MediaWiki website with a CMS-agnostic ...
timesharer's user avatar
1 vote
0 answers
36 views

What steps should you take to harden your website against censorship? [closed]

I am thinking about making a website for conservative crowdsourcing. Since AWS has shown they will ban customers, who spent who knows how much time building a platform on their infrastructure, I am ...
user875234's user avatar
0 votes
1 answer
76 views

Hosting SQL on localhost or remote server?

Years ago I was advised to use two servers for hosting a basic Linux webserver, that it's best to have SQL hosted separately from NGINX or Apache. Personally I prefer MariaDB over MySQL, but I don't ...
Admish's user avatar
  • 1
1 vote
1 answer
115 views

How does Google Chrome determine a safe and unsafe website?

Google chrome has a way of determining safe and unsafe websites. When it does find an unsafe one, it says that your connection isn't private and that attackers could be on the same website. However, ...
Matthew Schell's user avatar
6 votes
1 answer
444 views

Chrome incorrectly marking our domain without a hyphen as deceptive when we own and use both versions

Chrome has a fairly new "lookalike URL" or "typo squatting" detection feature. The aim is to warn users if they are accidentally going to the wrong URL. We own two sites (made up ...
BRass's user avatar
  • 161
1 vote
1 answer
284 views

Can cursor based pagination be used for SEO?

We have a category page which may contain hundreds of thousands of posts. We want to paginate these results using cursor based pagination. The base page may look like: www.example.com/topic/category ...
code's user avatar
  • 111
9 votes
2 answers
3k views

How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?

I have forms on my in-development website which require the person to enter an e-mail address. I don't want to have to send them a "verification" e-mail with a URL containing a code, or ...
P Sarauer's user avatar
  • 107
1 vote
0 answers
728 views

`noopener`/`noreferrer` - What do you "really" need to use nowadays? [Discussion] [closed]

Add rel="noopener" to outgoing links with target="_blank" for security and better performance. But is this enough nowadays? There are already a good number of pages and articles ...
Nico W.'s user avatar
  • 11
3 votes
0 answers
235 views

Cross origin resource policy violation for JS file when setting COEP, COOP and CORP headers

What is the best way to deal with the new security headers? Cross-Origin-Embedder-Policy (COEP) https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy Cross-Origin-...
qräbnö's user avatar
  • 141
3 votes
1 answer
160 views

How can I find and remove WordPress malware resulting in URLs with this styling: / top:0; left:-9999px

I'm breaking my head for 2 days with this one, and would appreciate some extra thoughts. These links are found in wp-content/cache/wp-rocket .html files only, while they are not present on the actual ...
Dorian C.'s user avatar
0 votes
1 answer
36 views

Why this image is so large despite small dimension [closed]

I have any image which is 760x400 in dimension but it about 7MB in size. it comes out clean on VirustTotal.com and even Image Meta doesnt show anything unusual other than lots of text info. Since i ...
Learning's user avatar
  • 711
4 votes
1 answer
442 views

Should I worry about exposing my server's IP address?

I currently use Cloudflare for DNS, and they advertise that they will hide the IP address of my server if I proxy through them. Should I worry about this since the IP points to a dedicated server (not ...
Josiah Ogburn's user avatar

1
2 3 4 5
12