Questions tagged [security]
Preventing a system from unauthorized access, modification, disruption, or destruction.
544
questions
2
votes
1answer
21 views
Can cursor based pagination be used for SEO?
We have a category page which may contain hundreds of thousands of posts. We want to paginate these results using cursor based pagination.
The base page may look like:
www.example.com/topic/category
...
8
votes
2answers
3k views
How should I handle the problem of people entering others' e-mail addresses without annoying them with “verification” e-mails?
I have forms on my in-development website which require the person to enter an e-mail address.
I don't want to have to send them a "verification" e-mail with a URL containing a code, or ...
0
votes
0answers
4 views
Unable to set the samesite attribute on bm_sv cookie [closed]
0
Found DAST scan error "Cookie Without SameSite Attribute" on Frond end application
Front end application build on node js and React js.
I can see the cookie are added back in response ...
1
vote
0answers
26 views
`noopener`/`noreferrer` - What do you “really” need to use nowadays? [Discussion] [closed]
Add rel="noopener" to outgoing links with target="_blank" for security and better performance.
But is this enough nowadays?
There are already a good number of pages and articles ...
2
votes
0answers
34 views
How to fix security headers COEP, COOP and CORP?
What is the best way to deal with the new security headers?
Cross-Origin-Embedder-Policy (COEP) https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy
Cross-Origin-...
2
votes
1answer
39 views
How can I find and remove WordPress malware resulting in URLs with this styling: / top:0; left:-9999px
I'm breaking my head for 2 days with this one, and would appreciate some extra thoughts.
These links are found in wp-content/cache/wp-rocket .html files only, while they are not present on the actual ...
0
votes
1answer
22 views
Why this image is so large despite small dimension [closed]
I have any image which is 760x400 in dimension but it about 7MB in size. it comes out clean on VirustTotal.com and even Image Meta doesnt show anything unusual other than lots of text info.
Since i ...
2
votes
1answer
60 views
Should I worry about exposing my server's IP address?
I currently use Cloudflare for DNS, and they advertise that they will hide the IP address of my server if I proxy through them. Should I worry about this since the IP points to a dedicated server (not ...
0
votes
0answers
5 views
Where to host my django application that uses a redis server, postgres database and websockets with least worry? [duplicate]
I made a small web application for a customer and everything is working now on a VPS.
Stack:
nginx to route traffic and serve static files
gunicorn to run several django workers that serve http
...
0
votes
1answer
34 views
Can I securely allow users of my site to change their email address if they forgot their password and no longer have access to the old email address?
How do I securely allow users to change their emails if they lose access to the original email? Do I need 2 factor?
It's a social media site coded in nodejs where I have their username, password, and ...
1
vote
0answers
8 views
Does the same site cookie policy potentially change anything for CORS
According to the new same-site cookie policy (once implemented across all browsers) , a third party call from another page would not send along the cookies by default, unless the third party ...
1
vote
0answers
16 views
Can a reverse-proxied Facebook in an IFRAME access the other logged-in Facebook's in other windows and IFRAMEs?
We have set up a reverse proxy to Facebook. We wound up another subdomain on our server and pointed it at https://www.facebook.com using the following web.config. (Redacted slightly for security's ...
1
vote
0answers
56 views
Flood of GET requests for path /{GUID}/{GUID}/from?get&nocache={/\S{5}/}
This afternoon I got a flood of request (400+ within 10 minutes) to one of my web applications, from the same IP address, for non-existent URI.
All of the requests were GET with a path the matches the ...
1
vote
1answer
24 views
Separating web domain from email domain - sound security strategy?
A friend's website was recently hacked. (An outsourced project manager wasn't diligent in applying Wordpress security updates.)
An unfortunate effect of the hacking is that ISP's are now flagging ...
2
votes
1answer
73 views
How to disable .htaccess file using JavaScript?
By the way, the .htaccess was already enabled to my main directory. Is there any way to disable it using JavaScript? to my client-side? I was just curious about how my files are being secured. Thanks ...
0
votes
0answers
15 views
allow users to post url schems that not http/https?
i have a blog comment section where users write their website and a comment about it and it is shown like this
<a href="https://example.com">Website</a>
<br>
<span>my website ...
0
votes
0answers
29 views
how to get rid of mailicious redirect
I'm in charge of a Wordpress site (currently offline) that's affected by a malicious redirect, i.e. going to that address redirects to a phishing site (curiously though it only happens when getting ...
2
votes
0answers
40 views
Let spambots “successfully” submit form?
I'm about to set up my html forms so spam bots are being caught and rejected.
I wonder.. Let's say a spambot submits the form in a way that is not accepted.
Should I then let the page with the form ...
2
votes
1answer
27 views
Can I see a history of site index from Bing?
I'm at a small internet company that has several apps. Our customers (all businesses) each have their own app-name/customer-name url. Currently, if you request a page preview from Bing's link preview ...
1
vote
1answer
57 views
Is it safe if I use the same Google Recaptcha site key and secret key on 2 different servers?
I have 2 servers, staging server and production server. Server staging is used for testing my website. While the production server is for live website
Now I use the same site key and secret key for ...
3
votes
2answers
89 views
What are some things that Webmasters should be preparing for or doing in response to the COVID-19 pandemic?
This is a community wiki intended for our users to be able to share ideas as to what might be helpful to Webmasters during the COVID-19 pandemic.
As many of you are aware, there's been a shift all ...
2
votes
1answer
93 views
Site reported as blacklisted by Norton Safe Web, with no reason given. How to resolve?
A WordPress website that I monitor using ManageWP (by running a daily security report) has been reported as blacklisted by Norton.
I visited the Norton website to investigate the reason (creating an ...
3
votes
0answers
26 views
NGINX configuration for the same folder protection rewrites in each of thousands of subdirectories
The following code allows me to protect a specific folder with the membership software we're using. The problem is if we have 1,000 folders we need to protect, we need to copy/paste this same code for ...
2
votes
1answer
93 views
New hostile web crawler from China throttling server
My server has been crashes several times the last 24 hours by a new extremely aggressive hostile distributed web crawler.
It is hitting over 1000 pages per minute and seems to be crawling all content ...
0
votes
0answers
10 views
How to stop the IP of the server from redirecting to the domain if accessed directly?
So there is a site, that is behind Cloudflare so the IP is protected, but in addition to that, I want to make it so that if you have the IP and type it in the browser, it will not disclose the domain ...
1
vote
1answer
688 views
Why is G Suite passing DMARC when alignment fails?
I have a G Suite account with a primary and secondary domains. I have successfully setup DMARC for my primary domain. Now I am trying to setup DMARC for my secondary domain.
SPF is setup for my ...
4
votes
1answer
75 views
Does the presence of a flash banner on a site inherently create a vulnerability on the site?
Does the presence of a flash banner inherently open the site up to exploits, or is there a way to ensure the flash banner does not have "access" to anything important on the page.
The page in ...
1
vote
0answers
32 views
What does this code do? [closed]
I've been looking at ways to make websites more secure and in particular WordPress site and found a blog post with a few suggestions. Most of them I was already using but found this one with no ...
1
vote
1answer
135 views
Changing name when a domain holder is a citizen of one country; possible problems
I am a citizen of Israel and I desire to generally cut all ties with it besides generally with family, friends and job.
Currently I live in another state as a temporary resident.
I consider changing ...
2
votes
1answer
43 views
Would two factor authentication on my web hosting account protect against email phishing targeting my site?
I was recently attacked on my Bluehost account after clicking on an email that looked like it was from Bluehost (never going to click on another Bluehost email again). While talking to the support ...
2
votes
1answer
67 views
Block/allow access to certain PHP pages
I have a number of PHP scripts that are meant to be included into other PHP scripts, but otherwise should not be directly accessible to anyone via a Web browser. How do I block people from accessing ...
2
votes
1answer
162 views
Is it safe to BAN ASN from Hosting providers?
I have some bot problem, i found their ASN and it comes from web hosting providers. Not ISP's. For example:
Hetzner: AS24940
Digital Ocean: AS14061
AMAZON-AES: AS14618
Is it safe to ban entire ASN's ...
2
votes
1answer
1k views
Delete Firefox JavaScript console history?
How do I the clear the command history of Firefox's JavaScript console? Clearing all history, cookies, cache, etc., doesn't clear the JavaScript console history.
3
votes
1answer
45 views
Standard or common way to secure a destination-email-address of a client-side contact-form
I have a website with a minimal, client-side HTML-CSS-JavaScript contact form but I desire to hide the destination email address of that form from the HTML source code so that form users would not be ...
1
vote
0answers
301 views
Why are 300+ Huawei bots crawling my forum?
Since a few days ago, I've seen a huge increase in traffic to my forum by guest users, all use the same ip range which traces back to china, Huawei to be more specific.
Is there any indication why ...
2
votes
0answers
26 views
Impersonation in web contact forms [closed]
Many websites have contact us form usually requiring sender's name and email address. Now assume someone uses the contact form but fills in an email address (a valid address) which does not belong to ...
1
vote
0answers
18 views
few questions about running image hosting website [closed]
I'm about to launch a new image hosting website, nevertheless, few questions are still on my mind and i would love to know your take on them.
Q1- how do i prevent users from uploading pornographic ...
1
vote
1answer
36 views
Unusual Web Traffic Submitting Extremely Long URLs
thanks in advance for the help. This isn't my usual job, but our website admin/full stack developer is on leave and my boss has asked me to look into it. Recently we've had a huge spike (talking tens ...
1
vote
1answer
53 views
Researching .htaccess Syntax
In my template .htaccess file I have been copying and pasteing alot of rules and researching .htaccess for around 2 weeks in an attempt to try and better understand the syntax, different modules & ...
1
vote
1answer
18 views
How to resolve a verified property not appearing in the security issues property dropdown?
I have several verified properties across Google Search Console / Google Analytics.
Unfortunately, I've recently taken on a client that has been red flagged by Google as a Phishing site (which they ...
2
votes
4answers
331 views
Secure way to share unfinished web-page with a customer?
What are the options to share unfinished web-page with a customer without allowing third-party to see the work in progress when developer has control over the web-server? I could come up with ...
2
votes
1answer
81 views
Will adding a random letter to the end of the URL prevent content from being scraped and stolen while allowing SEO?
I have built a website which is a directory of venues / places in a country and client has asked me to make URLs more SEO friendly.
There has been some misunderstanding in communication and I have ...
0
votes
2answers
191 views
Do browser developer tools expose your PHP code?
Browser "development tools" are a great way to learn from others, but are they a security risk? I'm working on a project using PHP. My understanding is that PHP code is hidden. So, someone calling for ...
1
vote
2answers
52 views
Can I restrict access to certain areas of my site using the user's access to restricted areas of another site?
I'd like to restrict access to certain areas of my site (site X) based on whether or not the user has access to certain restricted areas of another site (site Y), which is not under my control.
To be ...
2
votes
1answer
68 views
Best way to handle email address for use with domain registration?
I have registered a domain that I use exclusively for email. In addition to my main email address (foo@example.com), I have companyA@example.com, companyB@example.com, justforfriends@example.com, etc....
3
votes
1answer
517 views
rel=“noreferrer noopener” in target=“_blank” external links
In numerous sites I have been reading, they say that you must use rel="noreferrer noopener" when using target="_blank" within external links.
I can understand why you should use noopener as a ...
1
vote
2answers
53 views
Wordpress targeted by attacker, how to install in that situation?
I have my wordpress installed in my purchased hosting company.
I see from my security plugin that the attacker changes IP and installs malware such as WP-vcd, and changing the themes such as wordpress ...
0
votes
2answers
59 views
Is using SiteGround CPanel over http secure?
I have a website hosted on SiteGround. Their CPanel can be served via http or https ( http://cpanel.us261.siteground.us/login/ ). In my case it is not working via https; the support says it's because ...
0
votes
0answers
151 views
Invalid traffic coming from Sogou
I have not indexed my website in Sogou. I have only very less visitors. But i am getting traffic from Sogou daily. The search keyword is "site:mywebsitename" and is from China. Just visiting main page....
2
votes
1answer
864 views
Firebase and Godaddy: Hosting redirection to www doesn't work for https
I have a website whose domain name is example.com from GoDaddy and my SSL certificate and hosting is on firebase.
Currently www.example.com forwards properly to https://www.example.com but https://...
