Questions tagged [security]
Preventing a system from unauthorized access, modification, disruption, or destruction.
0
votes
0answers
5 views
Crawler Web Form Submissions with “Crawler Typing Text” in Field
We have a form on our public website that users can use to request an account from us. Just today we had hundreds of form submissions that said "crawler typing text..." in the email and name field, ...
2
votes
1answer
13 views
Firebase and Godaddy: Hosting redirection to www doesn't work for https
I have a website whose domain name is example.com from GoDaddy and my SSL certificate and hosting is on firebase.
Currently www.example.com forwards properly to https://www.example.com but https://...
1
vote
1answer
17 views
Is it insecure to have your Google Analytics tag visible publicly?
I just started adding Google Analytics to my GitHub Pages site, which calls for putting it in the _config.yml file. Is it insecure to keep the _config.yml file in my public GitHub repository, or is it ...
0
votes
1answer
22 views
What is page hijacking?
I tried to read here, for example, but I misunderstand what is Page Hijacking. I saw we don't have a session on this.
What is page hijacking?
3
votes
1answer
96 views
Alexa-rank complaining about insecure generator meta-tag
The Alexa-rank auditing tool is complaining about a generator meta-tag that is according to the HTML5 standard:
<meta name="generator" content="Company Name">
The Alexa Site Audit Report ...
1
vote
0answers
12 views
Best resources for learning how to prevent malicious usage? [closed]
I'd like to work on creating a public website, but I'm concerned about the potential for it to be the target of some attack. I'm aware of some of the more common attacks like XSS, query injection, ...
0
votes
1answer
21 views
How can I ban mediawiki logins from IPs that persistently fail?
I have a MediaWiki website and someone is trying to login as my WikiSysop user by guessing lots of passwords.
What can I do to ban IPs if they exceed a threshold of failed login attempts?
(Okay, no-...
0
votes
2answers
41 views
Block any other domains from using my server
Someone has set their domain to use my server. It's not a mirror, the database and everything works and updates with mine. He's basically stealing my content, and he's showing up on google instead of ...
0
votes
2answers
76 views
Unable to find cause why Joomla website blacklisted by Google (Deceptive site ahead)
We developed a new website for our company.
The old website work on Joomla 2.5, for example https://www.company.com.
Page www.company.com/administrator closed by password via .htaccess
The new ...
3
votes
1answer
43 views
How do I get my website unblocked in Pakistan?
TL;DR: My website is blocked in Pakistan, how do I get it unblocked?
I've had reports that my website QuranX.com is inaccessible from Pakistan. I've had a number of people confirm this.
It seems ...
1
vote
0answers
52 views
Are Google API Key Application Restrictions Secure?
I believe an IP address or HTTP referrer can be spoofed, so can I trust that IP address or HTTP referrer application restrictions (configured via the Google API console) will prevent unauthorised ...
3
votes
1answer
92 views
Hourly connections to my WordPress site via XMLRPC block my IP on BlueHost because they see many email logins
I currently own a WordPress site in a hosting (BlueHost).
On the other hand, I have an application in our offices in .Net. This application, updates WordPress via XMLRPC every 1 hour.
The problem is ...
2
votes
0answers
38 views
Can many single page hits from a variety user agents from the same VPN with the same screen resolution be hurting my search rankings?
I am trying to clarify what is happening with the traffic on my site. Lately I am being flooded with many strange hits, mostly from US and they seem to only open 1 page or visit for few seconds.
The ...
0
votes
1answer
96 views
Is it safe to use JavaScript to insert GoDaddy site seal <script> into an HTML page?
The site seal provided by GoDaddy uses HTML code like:
<span id="siteseal"><script async type="text/javascript" src="https://seal.godaddy.com/getSeal?sealID=...
1
vote
0answers
24 views
Does cPanel pass along security updates from installed software (Mediawiki, WordPress, etc) in a timely manner?
I have an account with a bare-bones cPanel based web-host and I'd like to run a CMS from this account. (MediaWiki or WordPress. I've not decided yet. I hope that doesn't matter for this question.)
...
1
vote
1answer
44 views
SSL Verification files can't be read
I have created an Asp.Net Razor site in Visual Studio 2017. Anyway I was given a series of steps by Winhost for getting free SSL certificate. I followed those steps using SSL for Free. I've used ...
2
votes
0answers
20 views
Assessing TLS capabilities by examining user agent strings from log files
I have a long list of browser user agent strings pulled from website access logs which I would like to analyze to determine the TLS capabilities of our site's visitors in order to get a ballpark ...
3
votes
0answers
36 views
Google Chrome anti-virus checks take too long for downloads from our site. Can it be bypassed or sped up?
I host a windows software website. I noticed that new version of Google Chrome checks downloaded files presumably for viruses and it takes about 10-20 seconds to complete.
Is there any way to white ...
1
vote
0answers
32 views
Identify a user agent consuming massive bandwidth downloading and uploading specific files but never sending a referrer
Blank HTTP_REFERER user agents are downloading and uploading a couple specific files to and from our server! This is causing HUGE bandwidth and CPU usage.
We blocked blank referers on our CDN and ...
1
vote
0answers
492 views
Append basic authentication header NGINX to existing authentication header of upstream application
Assume the following setup:
The NGINX reverse proxy is asking for basic authentication (which is a good habit when you expose things on the internet). Basic authentication uses the Authorization ...
3
votes
1answer
51 views
GDPR & Outdated Browsers
So as a web developer we are always asked to support the old browsers for the potential that someone may fire up a decade old computer and visit our sites.
However with GDPR now in place I wonder if ...
0
votes
1answer
27 views
What is the risk of giving a 3rd party read only access to Google Analytics?
An agency has asked for access to my Google Analytics. I don't really trust them, but I need them to be able to verify my web site stats. What are the risks associated with giving them read only ...
1
vote
0answers
28 views
Why Using sha or likewise key in file or Image Urls? [closed]
As I'm new and do not have much insight about security what I have found while scraping websites using scrapy and such tools is that most of the websites like google while naming there image or other ...
1
vote
0answers
30 views
Can dbadmin be secured under nginx by using a rewrite rule to a 404?
I'm trying to redirect all 404 pages to a custom handler with NGINX.
I spent few hours to made the following rewrite in nginx but my question is: can it be a security breach?
location ~ ^/(?!(dbadmin)...
4
votes
1answer
115 views
Apache2: Require directive not working
I'm a tad confused after reading these docs:
https://httpd.apache.org/docs/2.4/sections.html
https://httpd.apache.org/docs/2.4/mod/mod_authz_core.html
I wrote this site definition:
$ cat /etc/...
1
vote
0answers
33 views
Deterministic hash function without storing secret keys
I am developing an application that allows users to post things anonymously yet comment on posts with their name and profile picture. I want to create a method of data storage that makes it impossible ...
1
vote
0answers
24 views
blocking website in my country where it has been copied a lot [closed]
I have an issue that my website has been copying in my country. i want to block in my country. does it impact on SEO?
4
votes
1answer
798 views
Is a PHP POST using cURL from HTTPS site to HTTP endpoint encrypted securely?
I have a website residing on a domain with a valid SSL certificate that is fully using HTTPS. If I take form data from this site that is secured with an SSL and send it to a non-secure HTTP endpoint ...
1
vote
1answer
31 views
Another url is indexed in google which has a link ending with rpid=5PO84Q269
My Website is indexed in google. When i was searching for the term in google for my website i found a url placing above my websites root URL which has same url as root URL but has a weird url ...
3
votes
1answer
3k views
What does this htaccess file do in this configuration?
I've never seen this configuration in .htaccess. This comes from my site that currently reset. I have no SSL certificate installed, but I remember seeing these names on previous certs though.
So does ...
2
votes
1answer
56 views
Can a URL that is not linked to from anywhere be discovered?
Let's say I have a URL that is not linked to from anywhere, and let's say the file portion is very long, so that it's unlikely it could be accidentally entered. Something like ...
1
vote
0answers
239 views
Self-hosting and Apache virtual host on a Synology NAS: any security risk?
I have a Synology NAS running an Apache web server with several Virtual Hosts. Currently, each vhost is associated with a different port, and my router is pointing on them individually. I also have a ...
1
vote
1answer
29 views
Are name=value style directories better for security and SEO than directories with values only specified by position?
Consider the following values for a link in my website's homepage:
/portal=testportal/page=1/lang=fa
/testportal/1/fa
Is there any priority between above options? I'm asking from the security point ...
0
votes
1answer
35 views
Help! Bad Code showing on the top of my Website [closed]
The code "*/" is showing at the top of my website. I can't locate where this is coming from and would love to see if someone can assist!
1
vote
0answers
60 views
Receiving SEC_ERROR_UNKNOWN_ISSUER when Attempting To Access Google Analytics [closed]
Whenever I attempt to access Google Analyics, I receive an "Insecure Connection" message.
In more detail:
analytics.google.com uses an invalid security certificate.
The certificate is not trusted ...
1
vote
1answer
354 views
How to restrict web site/intranet access to company network?
What is the best/most secure way to create a web site or intranet on an externally hosted server, but make it only accessible from within my company's network? I am trying to avoid running my own ...
4
votes
2answers
373 views
How do I get Google to mark my website as “safe” in the search results with a small green icon?
Some websites are marked as safe in the Google search results like shown in the image:
My website and others are not. How do I get this safe mark for my website?
0
votes
1answer
41 views
Is it illegal to create a website that allow a user to upload a file and make it accessible and downloadable for others? [closed]
I am working on a website in which a user can sign in and upload a file and other users can search for it by name and download it. Those files will be catagorized as audio, video, apps(linux, windows, ...
5
votes
2answers
2k views
What to do about certificates being distrusted by Google Chrome?
Recently Google Chrome started issuing a warning on the console which says:
The SSL certificate used to load resources from
https://www.example.com will be distrusted in M70. Once
distrusted, ...
1
vote
1answer
25 views
Keep order status private from search engines?
I searched hard before posting this question. I apologize if it is a duplicate or if this is not the correct forum.
We have a homegrown shopping cart website. We do not require shoppers to register ...
1
vote
0answers
188 views
Odd Apache Request “GET /shell?echo+jaws+123456;cat+/proc/cpuinfo HTTP/1.1”
I've been looking into an issue with my servers, and while looking I found this weird request in the Apache Access Log GET /shell?echo+jaws+123456;cat+/proc/cpuinfo HTTP/1.1.
This ended up returning ...
0
votes
1answer
93 views
HTTP webpage is showing “Not Secure” in Chrome
I've called GoDaddy a few different times and they said that it looks like it is a problem with my HTML file. Except, my HTML file is the basic outline of a webpage, nothing fancy at all.
Chrome ...
6
votes
4answers
5k views
Does SSL require a client side certificate of any kind at all?
A friend insists it does, that both browser and server both need certificates. I say no, only the server requires one, with two keys. The question is whether the browser uses some sort of certificate (...
1
vote
1answer
63 views
Adding another domain SAN to a shared hosting server's multi-domain SSL certificate?
I am familiar with simple DV certificates, but not any of the other fancier stuff - like EV, wildcard and Multi-domain SSL certs.
As the title suggests, I'd like to know what the process is for (and ...
1
vote
0answers
62 views
Are there security concerns with migrating a sub-sub domain to a new platform, leaving another in place, and abandoning a third?
I have been tasked with launching a website for my organization. It is a dept. within a parent organization.
Parent Organization Administers domain.com
Dept. Organization Administers sub.domain.com ...
7
votes
2answers
3k views
Google Search Console alert: Harmful content - Uncommon Downloads
today Google Search Console show me some alert on my website
click on link "Malware detected?" open a page with details:
but the list "Sample URLs" is empty and also "Download all samples" download ...
16
votes
7answers
5k views
Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?
One week ago Google sent me an email to go HTTPS. If I won't transfer HTTP to HTTPS then it will show my connection unsecured to all of my site visitors who will try to input text in my site.
Without ...
1
vote
1answer
32 views
Can access to Google Analytics with historical data be recovered after losing administrator access?
I have lost my administrative accessibility to my website under User Management in Google Analytics. I have discussed this with my webmaster, but he does not claim responsibility for it nor is he ...
1
vote
2answers
183 views
COMODO SSL Analyzer Error -14
I have a hard time understanding Comodo's SSL Analyser error in some cases.
If queried on smtp.tiscali.it:465,it returns the image below:
However, if querying in OpenSSL:
Or Digicert:
It seems ...
1
vote
0answers
16 views
How could viruses/malware launch from websites in user environment? [closed]
I'm familiar with web frontend only superficially.
However I'm wondering how is it possible to inject virus on the web site and cause it to run in the user environment (PC) only by visiting specific ...
