Questions tagged [security]
Preventing a system from unauthorized access, modification, disruption, or destruction.
571
questions
1
vote
0
answers
15
views
Security headers set in .htaccess not taking effect on WordPress site with Cloudflare
We have a site on WPEngine that uses WP Rocket cache and Cloudflare where I have added security header directives in the .htaccess file,
<IfModule mod_headers.c>
# X-XSS-Protection
...
- 111
3
votes
2
answers
18
views
Rules in .htaccess only if the requested URL is /wp-admin
I want these lines from my .htaccess to execute only if the URL is not /wp-admin:
Header add Content-Security-Policy "default-src 'self';"
Header add Content-Security-Policy "script-src ...
- 31
2
votes
0
answers
26
views
Avoiding Microsoft Edge "isn't commonly downloaded" warning
I have shifted software downloads for our customers to download from our domain instead of Dropbox. Now Microsoft Edge raises the "isn't commonly downloaded" warning. I had this on Chrome ...
- 21
0
votes
0
answers
17
views
How to correct company website classification at the database level from companies like Sophos
A Corporate client using web blocker such as Sophos cannot access our company website. Blocker comes back and indicates our site is "Sex Education" however it is mental health education. I ...
0
votes
1
answer
26
views
Malicious activity on website using site's search bar
It started with a few but now the number has increased to more than a hundred. I am seeing strange urls getting hit as errors in my Google search console, not sure how is this being done but someone ...
- 13
2
votes
1
answer
21
views
Can I replace rua entry with ruf in DMARC record?
I currently have a DMARC record set up like this:
v=DMARC1; p=none; fo=1; rua=mailto:hello@example.com but I am receiving a lot of reports everyday.
I would like to only receive failure reports (...
- 364
0
votes
0
answers
19
views
Is single-word form submission a known attack?
I have one website that is consistently getting weird form submissions. It's a contact form that captures name, email, subject, and message. Five to ten times per day it gets a submission where all ...
- 131
0
votes
0
answers
88
views
.htaccess security headers for IONOS
I need to implement security headers for a website hosted by IONOS. I've used the following code, which works on sites hosted elsewhere, but not here.
<IfModule mod_headers.c>
Header set ...
- 109
2
votes
1
answer
83
views
As a Webmaster, how are you handling the response to the war in Ukraine in regards to managing your site(s)?
This is a community wiki intended for our users to be able to share ideas as to how Webmasters are managing the response to the war in Ukraine for their site(s). There are no right or wrong answers, ...
2
votes
2
answers
51
views
Do I need a wildcard SSL certificate to secure my website and email subdomains through cPanel?
I have a website and emails through the same hosting provider which I manage through cpanel.
At the moment I am using zeroSSL to secure my website (www.example.com), however, this does not support my ...
- 23
2
votes
0
answers
24
views
'[0] appended to multiple URL parameters, is something scanning for vulnerabilities?
I use a WAF that monitors suspicious query string and form POST values. Typical script-kiddie stuff like common SQL injection strings, etc.
Over the last several months I've noticed a dramatic uptick ...
2
votes
2
answers
63
views
My website has been cloned without authorization. What can I do?
I have the following problem:
I operate an online service and about 2 months ago a Copy Cat clone appeared under a strange domain unknown to me. My portal is simply mirrored/redirected to another ...
Elvira13
1
vote
0
answers
8
views
Limiting what affiliate's Google Tag Manager can inject into my site
I am managing a website where we sell products. We have an affiliate program.
I want to facilitate the affiliates the tracking for them to optimize the campaigns.
Currently we display a different ...
- 111
5
votes
1
answer
808
views
Spike in Traffic from "Facebot Twitterbot" user agent
My website, which typically has very low volume, suddenly received a huge spike in traffic all from the same user agent. We were receiving about 3 requests per second for a sustained period of about ...
- 282
0
votes
0
answers
48
views
How are credentials stored and encrypted in Nexus Repository Manager OSS 2.14?
How does Nexus Repository Manager OSS 2.14 store and encrypt it's user credentials?
I couldn’t finy anything in the documentation, knowledge base nor on the web on how credentials (local users) are ...
- 101
3
votes
2
answers
537
views
Should rel="noopener" be set on links to external sites even if I own the site?
We've had a policy to always set rel="noopener" for all external links.
However is that necessary if the external link is to a site in our own control?
Let's say we own both coffee.example....
- 183
2
votes
1
answer
26
views
Recording / Logging CSP Violations
I am in the process of implementing a CSP policy for a variety of domains and am looking for a method to record/log browser CSP violations encountered by any end user. I want to make sure I don't miss ...
- 21
0
votes
1
answer
33
views
Restricting access to a website without using sessions or IP whitelisting? [duplicate]
I want to restrict access to a private website that needs to be accessible to multiple people.
In the event the website has public and private areas, a login to a user session is the usual solution.
...
- 193
1
vote
0
answers
36
views
Hosting web site with onion share [closed]
So, i don't use any kind of social media and i decided to make my web site instead of that. This idea is inspired by guy named Luke Smith from youtube and i want to make it to look smiliar to this: ...
- 11
1
vote
1
answer
56
views
Is there a reason not to use HTTPS? [closed]
Edit: this question is more complete than mine.
I sometimes login to a website that provides both HTTP and HTTPS, even for the login page. Although I use HTTPS to encrypt my credentials, it would be ...
- 113
4
votes
2
answers
95
views
Is there any way I can defend against automated file download bots?
My company offers a very specifically tailored Android application to supplement our other software. Since users must have an account in our other software in order to use the Android application, is ...
- 141
3
votes
2
answers
221
views
Is it possible for a hacker to point another domain at my domain?
Recently when I search my website on google, I find that another domain's description is identical to my domain. I'm terrified and try to understand the security breaches of my website as much as ...
- 33
1
vote
1
answer
30
views
How to securely share a link to a video on my server
I've created a web system for daycares on which the educators can upload videos of the kids, and then share those videos with the parents.
Currently the way I'm doing this is very simple. My system ...
- 171
0
votes
0
answers
20
views
Strange entries in cPanel Web Disk log
We have a website and email system that uses cPanel / WHM. The log /usr/local/cpanel/logs/cpdavd_session_log contains a list of strange IP addresses hitting the cpdavd service (WebDAV, which cPanel ...
- 1
1
vote
1
answer
48
views
Making a domain more trustworthy to corporate networks so that it won't be blocked by their filters
I developed a web app for a customer which is made in basic PHP/MySQL, pretty normal site, lighter than WordPress, and when my customer went to his client to sell the app the domain was blocked by the ...
1
vote
0
answers
32
views
Gratis email boxes filter my contact form emails ; local email box doesn't ; but what if I want a domain registrar email box? [closed]
My domain registrar and my hosting provider are not the same company.
On my shared hosting environment with CentOS, Bash, Apache, PHP and MySQL I host an all core MediaWiki website with a CMS-agnostic ...
- 21
1
vote
0
answers
32
views
What steps should you take to harden your website against censorship? [closed]
I am thinking about making a website for conservative crowdsourcing. Since AWS has shown they will ban customers, who spent who knows how much time building a platform on their infrastructure, I am ...
- 111
0
votes
1
answer
33
views
Hosting SQL on localhost or remote server?
Years ago I was advised to use two servers for hosting a basic Linux webserver, that it's best to have SQL hosted separately from NGINX or Apache. Personally I prefer MariaDB over MySQL, but I don't ...
- 1
1
vote
1
answer
38
views
How does Google Chrome determine a safe and unsafe website?
Google chrome has a way of determining safe and unsafe websites. When it does find an unsafe one, it says that your connection isn't private and that attackers could be on the same website. However, ...
- 111
5
votes
0
answers
200
views
Chrome incorrectly marking our domain without a hyphen as deceptive when we own and use both versions
Chrome has a fairly new "lookalike URL" or "typo squatting" detection feature. The aim is to warn users if they are accidentally going to the wrong URL.
We own two sites (made up ...
- 151
1
vote
1
answer
161
views
Can cursor based pagination be used for SEO?
We have a category page which may contain hundreds of thousands of posts. We want to paginate these results using cursor based pagination.
The base page may look like:
www.example.com/topic/category
...
- 111
9
votes
2
answers
3k
views
How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?
I have forms on my in-development website which require the person to enter an e-mail address.
I don't want to have to send them a "verification" e-mail with a URL containing a code, or ...
- 107
1
vote
0
answers
425
views
`noopener`/`noreferrer` - What do you "really" need to use nowadays? [Discussion] [closed]
Add rel="noopener" to outgoing links with target="_blank" for security and better performance.
But is this enough nowadays?
There are already a good number of pages and articles ...
- 11
3
votes
0
answers
183
views
Cross origin resource policy violation for JS file when setting COEP, COOP and CORP headers
What is the best way to deal with the new security headers?
Cross-Origin-Embedder-Policy (COEP) https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy
Cross-Origin-...
- 141
3
votes
1
answer
95
views
How can I find and remove WordPress malware resulting in URLs with this styling: / top:0; left:-9999px
I'm breaking my head for 2 days with this one, and would appreciate some extra thoughts.
These links are found in wp-content/cache/wp-rocket .html files only, while they are not present on the actual ...
- 71
0
votes
1
answer
24
views
Why this image is so large despite small dimension [closed]
I have any image which is 760x400 in dimension but it about 7MB in size. it comes out clean on VirustTotal.com and even Image Meta doesnt show anything unusual other than lots of text info.
Since i ...
- 669
2
votes
1
answer
128
views
Should I worry about exposing my server's IP address?
I currently use Cloudflare for DNS, and they advertise that they will hide the IP address of my server if I proxy through them. Should I worry about this since the IP points to a dedicated server (not ...
0
votes
1
answer
46
views
Can I securely allow users of my site to change their email address if they forgot their password and no longer have access to the old email address?
How do I securely allow users to change their emails if they lose access to the original email? Do I need 2 factor?
It's a social media site coded in nodejs where I have their username, password, and ...
- 193
1
vote
0
answers
13
views
Does the same site cookie policy potentially change anything for CORS
According to the new same-site cookie policy (once implemented across all browsers) , a third party call from another page would not send along the cookies by default, unless the third party ...
- 131
1
vote
0
answers
85
views
Can a reverse-proxied Facebook in an IFRAME access the other logged-in Facebook's in other windows and IFRAMEs?
We have set up a reverse proxy to Facebook. We wound up another subdomain on our server and pointed it at https://www.facebook.com using the following web.config. (Redacted slightly for security's ...
- 111
3
votes
1
answer
191
views
Flood of GET requests for path /{GUID}/{GUID}/from?get&nocache={/\S{5}/}
This afternoon I got a flood of request (400+ within 10 minutes) to one of my web applications, from the same IP address, for non-existent URI.
All of the requests were GET with a path the matches the ...
- 131
1
vote
1
answer
32
views
Separating web domain from email domain - sound security strategy?
A friend's website was recently hacked. (An outsourced project manager wasn't diligent in applying Wordpress security updates.)
An unfortunate effect of the hacking is that ISP's are now flagging ...
- 11
2
votes
1
answer
137
views
How to disable .htaccess file using JavaScript?
By the way, the .htaccess was already enabled to my main directory. Is there any way to disable it using JavaScript? to my client-side? I was just curious about how my files are being secured. Thanks ...
- 137
0
votes
0
answers
16
views
allow users to post url schems that not http/https?
i have a blog comment section where users write their website and a comment about it and it is shown like this
<a href="https://example.com">Website</a>
<br>
<span>my website ...
- 121
0
votes
0
answers
33
views
how to get rid of mailicious redirect
I'm in charge of a Wordpress site (currently offline) that's affected by a malicious redirect, i.e. going to that address redirects to a phishing site (curiously though it only happens when getting ...
- 123
2
votes
0
answers
45
views
Let spambots "successfully" submit form?
I'm about to set up my html forms so spam bots are being caught and rejected.
I wonder.. Let's say a spambot submits the form in a way that is not accepted.
Should I then let the page with the form ...
- 312
2
votes
1
answer
54
views
Can I see a history of site index from Bing?
I'm at a small internet company that has several apps. Our customers (all businesses) each have their own app-name/customer-name url. Currently, if you request a page preview from Bing's link preview ...
- 21
1
vote
1
answer
123
views
Is it safe if I use the same Google Recaptcha site key and secret key on 2 different servers?
I have 2 servers, staging server and production server. Server staging is used for testing my website. While the production server is for live website
Now I use the same site key and secret key for ...
- 325
3
votes
2
answers
96
views
What are some things that Webmasters should be preparing for or doing in response to the COVID-19 pandemic?
This is a community wiki intended for our users to be able to share ideas as to what might be helpful to Webmasters during the COVID-19 pandemic.
As many of you are aware, there's been a shift all ...
3
votes
1
answer
171
views
Site reported as blacklisted by Norton Safe Web, with no reason given. How to resolve?
A WordPress website that I monitor using ManageWP (by running a daily security report) has been reported as blacklisted by Norton.
I visited the Norton website to investigate the reason (creating an ...
- 481