Questions tagged [security]
Preventing a system from unauthorized access, modification, disruption, or destruction.
517
questions
1
vote
0answers
27 views
What does this code do? [closed]
I've been looking at ways to make websites more secure and in particular WordPress site and found a blog post with a few suggestions. Most of them I was already using but found this one with no ...
1
vote
1answer
131 views
Changing name when a domain holder is a citizen of one country; possible problems
I am a citizen of Israel and I desire to generally cut all ties with it besides generally with family, friends and job.
Currently I live in another state as a temporary resident.
I consider changing ...
2
votes
1answer
23 views
Would two factor authentication on my web hosting account protect against email phishing targeting my site?
I was recently attacked on my Bluehost account after clicking on an email that looked like it was from Bluehost (never going to click on another Bluehost email again). While talking to the support ...
2
votes
1answer
59 views
Block/allow access to certain PHP pages
I have a number of PHP scripts that are meant to be included into other PHP scripts, but otherwise should not be directly accessible to anyone via a Web browser. How do I block people from accessing ...
2
votes
1answer
45 views
Is it safe to BAN ASN from Hosting providers?
I have some bot problem, i found their ASN and it comes from web hosting providers. Not ISP's. For example:
Hetzner: AS24940
Digital Ocean: AS14061
AMAZON-AES: AS14618
Is it safe to ban entire ASN's ...
1
vote
1answer
97 views
Delete Firefox JavaScript console history?
How do I the clear the command history of Firefox's JavaScript console? Clearing all history, cookies, cache, etc., doesn't clear the JavaScript console history.
3
votes
1answer
45 views
Standard or common way to secure a destination-email-address of a client-side contact-form
I have a website with a minimal, client-side HTML-CSS-JavaScript contact form but I desire to hide the destination email address of that form from the HTML source code so that form users would not be ...
1
vote
0answers
150 views
Why are 300+ Huawei bots crawling my forum?
Since a few days ago, I've seen a huge increase in traffic to my forum by guest users, all use the same ip range which traces back to china, Huawei to be more specific.
Is there any indication why ...
2
votes
0answers
24 views
Impersonation in web contact forms [closed]
Many websites have contact us form usually requiring sender's name and email address. Now assume someone uses the contact form but fills in an email address (a valid address) which does not belong to ...
1
vote
0answers
18 views
few questions about running image hosting website [closed]
I'm about to launch a new image hosting website, nevertheless, few questions are still on my mind and i would love to know your take on them.
Q1- how do i prevent users from uploading pornographic ...
1
vote
1answer
32 views
Unusual Web Traffic Submitting Extremely Long URLs
thanks in advance for the help. This isn't my usual job, but our website admin/full stack developer is on leave and my boss has asked me to look into it. Recently we've had a huge spike (talking tens ...
1
vote
1answer
46 views
Researching .htaccess Syntax
In my template .htaccess file I have been copying and pasteing alot of rules and researching .htaccess for around 2 weeks in an attempt to try and better understand the syntax, different modules & ...
1
vote
1answer
16 views
How to resolve a verified property not appearing in the security issues property dropdown?
I have several verified properties across Google Search Console / Google Analytics.
Unfortunately, I've recently taken on a client that has been red flagged by Google as a Phishing site (which they ...
2
votes
4answers
314 views
Secure way to share unfinished web-page with a customer?
What are the options to share unfinished web-page with a customer without allowing third-party to see the work in progress when developer has control over the web-server? I could come up with ...
2
votes
1answer
68 views
Will adding a random letter to the end of the URL prevent content from being scraped and stolen while allowing SEO?
I have built a website which is a directory of venues / places in a country and client has asked me to make URLs more SEO friendly.
There has been some misunderstanding in communication and I have ...
0
votes
2answers
64 views
Do browser developer tools expose your PHP code?
Browser "development tools" are a great way to learn from others, but are they a security risk? I'm working on a project using PHP. My understanding is that PHP code is hidden. So, someone calling for ...
1
vote
2answers
35 views
Can I restrict access to certain areas of my site using the user's access to restricted areas of another site?
I'd like to restrict access to certain areas of my site (site X) based on whether or not the user has access to certain restricted areas of another site (site Y), which is not under my control.
To be ...
2
votes
1answer
54 views
Best way to handle email address for use with domain registration?
I have registered a domain that I use exclusively for email. In addition to my main email address (foo@example.com), I have companyA@example.com, companyB@example.com, justforfriends@example.com, etc....
2
votes
1answer
159 views
rel=“noreferrer noopener” in target=“_blank” external links
In numerous sites I have been reading, they say that you must use rel="noreferrer noopener" when using target="_blank" within external links.
I can understand why you should use noopener as a ...
1
vote
2answers
52 views
Wordpress targeted by attacker, how to install in that situation?
I have my wordpress installed in my purchased hosting company.
I see from my security plugin that the attacker changes IP and installs malware such as WP-vcd, and changing the themes such as wordpress ...
0
votes
2answers
38 views
Is using SiteGround CPanel over http secure?
I have a website hosted on SiteGround. Their CPanel can be served via http or https ( http://cpanel.us261.siteground.us/login/ ). In my case it is not working via https; the support says it's because ...
0
votes
0answers
48 views
Invalid traffic coming from Sogou
I have not indexed my website in Sogou. I have only very less visitors. But i am getting traffic from Sogou daily. The search keyword is "site:mywebsitename" and is from China. Just visiting main page....
2
votes
1answer
254 views
Firebase and Godaddy: Hosting redirection to www doesn't work for https
I have a website whose domain name is example.com from GoDaddy and my SSL certificate and hosting is on firebase.
Currently www.example.com forwards properly to https://www.example.com but https://...
1
vote
1answer
33 views
Is it insecure to have your Google Analytics tag visible publicly?
I just started adding Google Analytics to my GitHub Pages site, which calls for putting it in the _config.yml file. Is it insecure to keep the _config.yml file in my public GitHub repository, or is it ...
0
votes
1answer
29 views
What is page hijacking?
I tried to read here, for example, but I misunderstand what is Page Hijacking. I saw we don't have a session on this.
What is page hijacking?
3
votes
1answer
136 views
Alexa-rank complaining about insecure generator meta-tag
The Alexa-rank auditing tool is complaining about a generator meta-tag that is according to the HTML5 standard:
<meta name="generator" content="Company Name">
The Alexa Site Audit Report ...
1
vote
0answers
16 views
Best resources for learning how to prevent malicious usage? [closed]
I'd like to work on creating a public website, but I'm concerned about the potential for it to be the target of some attack. I'm aware of some of the more common attacks like XSS, query injection, ...
2
votes
1answer
44 views
How can I ban mediawiki logins from IPs that persistently fail?
I have a MediaWiki website and someone is trying to login as my WikiSysop user by guessing lots of passwords.
What can I do to ban IPs if they exceed a threshold of failed login attempts?
(Okay, no-...
1
vote
2answers
54 views
Block any other domains from using my server
Someone has set their domain to use my server. It's not a mirror, the database and everything works and updates with mine. He's basically stealing my content, and he's showing up on google instead of ...
0
votes
2answers
139 views
Unable to find cause why Joomla website blacklisted by Google (Deceptive site ahead)
We developed a new website for our company.
The old website work on Joomla 2.5, for example https://www.company.com.
Page www.company.com/administrator closed by password via .htaccess
The new ...
3
votes
1answer
48 views
How do I get my website unblocked in Pakistan?
TL;DR: My website is blocked in Pakistan, how do I get it unblocked?
I've had reports that my website QuranX.com is inaccessible from Pakistan. I've had a number of people confirm this.
It seems ...
1
vote
0answers
87 views
Are Google API Key Application Restrictions Secure?
I believe an IP address or HTTP referrer can be spoofed, so can I trust that IP address or HTTP referrer application restrictions (configured via the Google API console) will prevent unauthorised ...
3
votes
1answer
136 views
Hourly connections to my WordPress site via XMLRPC block my IP on BlueHost because they see many email logins
I currently own a WordPress site in a hosting (BlueHost).
On the other hand, I have an application in our offices in .Net. This application, updates WordPress via XMLRPC every 1 hour.
The problem is ...
2
votes
0answers
41 views
Can many single page hits from a variety user agents from the same VPN with the same screen resolution be hurting my search rankings?
I am trying to clarify what is happening with the traffic on my site. Lately I am being flooded with many strange hits, mostly from US and they seem to only open 1 page or visit for few seconds.
The ...
0
votes
1answer
243 views
Is it safe to use JavaScript to insert GoDaddy site seal <script> into an HTML page?
The site seal provided by GoDaddy uses HTML code like:
<span id="siteseal"><script async type="text/javascript" src="https://seal.godaddy.com/getSeal?sealID=...
1
vote
0answers
24 views
Does cPanel pass along security updates from installed software (Mediawiki, WordPress, etc) in a timely manner?
I have an account with a bare-bones cPanel based web-host and I'd like to run a CMS from this account. (MediaWiki or WordPress. I've not decided yet. I hope that doesn't matter for this question.)
...
1
vote
1answer
52 views
SSL Verification files can't be read
I have created an Asp.Net Razor site in Visual Studio 2017. Anyway I was given a series of steps by Winhost for getting free SSL certificate. I followed those steps using SSL for Free. I've used ...
2
votes
0answers
24 views
Assessing TLS capabilities by examining user agent strings from log files
I have a long list of browser user agent strings pulled from website access logs which I would like to analyze to determine the TLS capabilities of our site's visitors in order to get a ballpark ...
4
votes
1answer
49 views
Google Chrome anti-virus checks take too long for downloads from our site. Can it be bypassed or sped up?
I host a windows software website. I noticed that new version of Google Chrome checks downloaded files presumably for viruses and it takes about 10-20 seconds to complete.
Is there any way to white ...
2
votes
0answers
35 views
Identify a user agent consuming massive bandwidth downloading and uploading specific files but never sending a referrer
Blank HTTP_REFERER user agents are downloading and uploading a couple specific files to and from our server! This is causing HUGE bandwidth and CPU usage.
We blocked blank referers on our CDN and ...
1
vote
0answers
681 views
Append basic authentication header NGINX to existing authentication header of upstream application
Assume the following setup:
The NGINX reverse proxy is asking for basic authentication (which is a good habit when you expose things on the internet). Basic authentication uses the Authorization ...
3
votes
1answer
55 views
GDPR & Outdated Browsers
So as a web developer we are always asked to support the old browsers for the potential that someone may fire up a decade old computer and visit our sites.
However with GDPR now in place I wonder if ...
0
votes
1answer
38 views
What is the risk of giving a 3rd party read only access to Google Analytics?
An agency has asked for access to my Google Analytics. I don't really trust them, but I need them to be able to verify my web site stats. What are the risks associated with giving them read only ...
asked Aug 23 '18 at 23:08
1
vote
0answers
28 views
Why Using sha or likewise key in file or Image Urls? [closed]
As I'm new and do not have much insight about security what I have found while scraping websites using scrapy and such tools is that most of the websites like google while naming there image or other ...
1
vote
0answers
31 views
Can dbadmin be secured under nginx by using a rewrite rule to a 404?
I'm trying to redirect all 404 pages to a custom handler with NGINX.
I spent few hours to made the following rewrite in nginx but my question is: can it be a security breach?
location ~ ^/(?!(dbadmin)...
4
votes
1answer
405 views
Apache2: Require directive not working
I'm a tad confused after reading these docs:
https://httpd.apache.org/docs/2.4/sections.html
https://httpd.apache.org/docs/2.4/mod/mod_authz_core.html
I wrote this site definition:
$ cat /etc/...
1
vote
0answers
35 views
Deterministic hash function without storing secret keys
I am developing an application that allows users to post things anonymously yet comment on posts with their name and profile picture. I want to create a method of data storage that makes it impossible ...
1
vote
0answers
24 views
blocking website in my country where it has been copied a lot [closed]
I have an issue that my website has been copying in my country. i want to block in my country. does it impact on SEO?
4
votes
1answer
950 views
Is a PHP POST using cURL from HTTPS site to HTTP endpoint encrypted securely?
I have a website residing on a domain with a valid SSL certificate that is fully using HTTPS. If I take form data from this site that is secured with an SSL and send it to a non-secure HTTP endpoint ...
1
vote
1answer
42 views
Another url is indexed in google which has a link ending with rpid=5PO84Q269
My Website is indexed in google. When i was searching for the term in google for my website i found a url placing above my websites root URL which has same url as root URL but has a weird url ...
