Questions tagged [security]
Preventing a system from unauthorized access, modification, disruption, or destruction.
0
votes
2answers
65 views
Unable to find cause why Joomla website blacklisted by Google (Deceptive site ahead)
We developed a new website for our company.
The old website work on Joomla 2.5, for example https://www.company.com.
Page www.company.com/administrator closed by password via .htaccess
The new ...
3
votes
1answer
43 views
How do I get my website unblocked in Pakistan?
TL;DR: My website is blocked in Pakistan, how do I get it unblocked?
I've had reports that my website QuranX.com is inaccessible from Pakistan. I've had a number of people confirm this.
It seems ...
1
vote
0answers
36 views
Are Google API Key Application Restrictions Secure?
I believe an IP address or HTTP referrer can be spoofed, so can I trust that IP address or HTTP referrer application restrictions (configured via the Google API console) will prevent unauthorised ...
3
votes
1answer
72 views
Hourly connections to my WordPress site via XMLRPC block my IP on BlueHost because they see many email logins
I currently own a WordPress site in a hosting (BlueHost).
On the other hand, I have an application in our offices in .Net. This application, updates WordPress via XMLRPC every 1 hour.
The problem is ...
2
votes
0answers
38 views
Can many single page hits from a variety user agents from the same VPN with the same screen resolution be hurting my search rankings?
I am trying to clarify what is happening with the traffic on my site. Lately I am being flooded with many strange hits, mostly from US and they seem to only open 1 page or visit for few seconds.
The ...
0
votes
1answer
68 views
Is it safe to use JavaScript to insert GoDaddy site seal <script> into an HTML page?
The site seal provided by GoDaddy uses HTML code like:
<span id="siteseal"><script async type="text/javascript" src="https://seal.godaddy.com/getSeal?sealID=...
1
vote
0answers
24 views
Does cPanel pass along security updates from installed software (Mediawiki, WordPress, etc) in a timely manner?
I have an account with a bare-bones cPanel based web-host and I'd like to run a CMS from this account. (MediaWiki or WordPress. I've not decided yet. I hope that doesn't matter for this question.)
...
1
vote
1answer
40 views
SSL Verification files can't be read
I have created an Asp.Net Razor site in Visual Studio 2017. Anyway I was given a series of steps by Winhost for getting free SSL certificate. I followed those steps using SSL for Free. I've used ...
2
votes
0answers
19 views
Assessing TLS capabilities by examining user agent strings from log files
I have a long list of browser user agent strings pulled from website access logs which I would like to analyze to determine the TLS capabilities of our site's visitors in order to get a ballpark ...
3
votes
0answers
36 views
Google Chrome anti-virus checks take too long for downloads from our site. Can it be bypassed or sped up?
I host a windows software website. I noticed that new version of Google Chrome checks downloaded files presumably for viruses and it takes about 10-20 seconds to complete.
Is there any way to white ...
1
vote
0answers
31 views
Identify a user agent consuming massive bandwidth downloading and uploading specific files but never sending a referrer
Blank HTTP_REFERER user agents are downloading and uploading a couple specific files to and from our server! This is causing HUGE bandwidth and CPU usage.
We blocked blank referers on our CDN and ...
1
vote
0answers
447 views
Append basic authentication header NGINX to existing authentication header of upstream application
Assume the following setup:
The NGINX reverse proxy is asking for basic authentication (which is a good habit when you expose things on the internet). Basic authentication uses the Authorization ...
3
votes
1answer
51 views
GDPR & Outdated Browsers
So as a web developer we are always asked to support the old browsers for the potential that someone may fire up a decade old computer and visit our sites.
However with GDPR now in place I wonder if ...
0
votes
1answer
27 views
What is the risk of giving a 3rd party read only access to Google Analytics?
An agency has asked for access to my Google Analytics. I don't really trust them, but I need them to be able to verify my web site stats. What are the risks associated with giving them read only ...
1
vote
0answers
27 views
Why Using sha or likewise key in file or Image Urls? [closed]
As I'm new and do not have much insight about security what I have found while scraping websites using scrapy and such tools is that most of the websites like google while naming there image or other ...
1
vote
0answers
29 views
Can dbadmin be secured under nginx by using a rewrite rule to a 404?
I'm trying to redirect all 404 pages to a custom handler with NGINX.
I spent few hours to made the following rewrite in nginx but my question is: can it be a security breach?
location ~ ^/(?!(dbadmin)...
4
votes
1answer
79 views
Apache2: Require directive not working
I'm a tad confused after reading these docs:
https://httpd.apache.org/docs/2.4/sections.html
https://httpd.apache.org/docs/2.4/mod/mod_authz_core.html
I wrote this site definition:
$ cat /etc/...
0
votes
0answers
9 views
Spam referrals to my website [duplicate]
I noticed a spike in referral traffic to my website, the link showed up in a very odd format, see attached.
Does anyone know what this is and what can I do to stop it happening again?
Can anyone ...
1
vote
0answers
33 views
Deterministic hash function without storing secret keys
I am developing an application that allows users to post things anonymously yet comment on posts with their name and profile picture. I want to create a method of data storage that makes it impossible ...
1
vote
0answers
23 views
blocking website in my country where it has been copied a lot [closed]
I have an issue that my website has been copying in my country. i want to block in my country. does it impact on SEO?
4
votes
1answer
776 views
Is a PHP POST using cURL from HTTPS site to HTTP endpoint encrypted securely?
I have a website residing on a domain with a valid SSL certificate that is fully using HTTPS. If I take form data from this site that is secured with an SSL and send it to a non-secure HTTP endpoint ...
1
vote
1answer
30 views
Another url is indexed in google which has a link ending with rpid=5PO84Q269
My Website is indexed in google. When i was searching for the term in google for my website i found a url placing above my websites root URL which has same url as root URL but has a weird url ...
3
votes
1answer
2k views
What does this htaccess file do in this configuration?
I've never seen this configuration in .htaccess. This comes from my site that currently reset. I have no SSL certificate installed, but I remember seeing these names on previous certs though.
So does ...
2
votes
1answer
55 views
Can a URL that is not linked to from anywhere be discovered?
Let's say I have a URL that is not linked to from anywhere, and let's say the file portion is very long, so that it's unlikely it could be accidentally entered. Something like ...
1
vote
0answers
185 views
Self-hosting and Apache virtual host on a Synology NAS: any security risk?
I have a Synology NAS running an Apache web server with several Virtual Hosts. Currently, each vhost is associated with a different port, and my router is pointing on them individually. I also have a ...
1
vote
1answer
29 views
Are name=value style directories better for security and SEO than directories with values only specified by position?
Consider the following values for a link in my website's homepage:
/portal=testportal/page=1/lang=fa
/testportal/1/fa
Is there any priority between above options? I'm asking from the security point ...
0
votes
1answer
35 views
Help! Bad Code showing on the top of my Website [closed]
The code "*/" is showing at the top of my website. I can't locate where this is coming from and would love to see if someone can assist!
1
vote
0answers
57 views
Receiving SEC_ERROR_UNKNOWN_ISSUER when Attempting To Access Google Analytics [closed]
Whenever I attempt to access Google Analyics, I receive an "Insecure Connection" message.
In more detail:
analytics.google.com uses an invalid security certificate.
The certificate is not trusted ...
1
vote
1answer
279 views
How to restrict web site/intranet access to company network?
What is the best/most secure way to create a web site or intranet on an externally hosted server, but make it only accessible from within my company's network? I am trying to avoid running my own ...
4
votes
2answers
323 views
How do I get Google to mark my website as “safe” in the search results with a small green icon?
Some websites are marked as safe in the Google search results like shown in the image:
My website and others are not. How do I get this safe mark for my website?
0
votes
1answer
38 views
Is it illegal to create a website that allow a user to upload a file and make it accessible and downloadable for others? [closed]
I am working on a website in which a user can sign in and upload a file and other users can search for it by name and download it. Those files will be catagorized as audio, video, apps(linux, windows, ...
4
votes
2answers
2k views
What to do about certificates being distrusted by Google Chrome?
Recently Google Chrome started issuing a warning on the console which says:
The SSL certificate used to load resources from
https://www.example.com will be distrusted in M70. Once
distrusted, ...
1
vote
1answer
24 views
Keep order status private from search engines?
I searched hard before posting this question. I apologize if it is a duplicate or if this is not the correct forum.
We have a homegrown shopping cart website. We do not require shoppers to register ...
1
vote
0answers
186 views
Odd Apache Request “GET /shell?echo+jaws+123456;cat+/proc/cpuinfo HTTP/1.1”
I've been looking into an issue with my servers, and while looking I found this weird request in the Apache Access Log GET /shell?echo+jaws+123456;cat+/proc/cpuinfo HTTP/1.1.
This ended up returning ...
0
votes
1answer
90 views
HTTP webpage is showing “Not Secure” in Chrome
I've called GoDaddy a few different times and they said that it looks like it is a problem with my HTML file. Except, my HTML file is the basic outline of a webpage, nothing fancy at all.
Chrome ...
6
votes
4answers
4k views
Does SSL require a client side certificate of any kind at all?
A friend insists it does, that both browser and server both need certificates. I say no, only the server requires one, with two keys. The question is whether the browser uses some sort of certificate (...
1
vote
1answer
62 views
Adding another domain SAN to a shared hosting server's multi-domain SSL certificate?
I am familiar with simple DV certificates, but not any of the other fancier stuff - like EV, wildcard and Multi-domain SSL certs.
As the title suggests, I'd like to know what the process is for (and ...
1
vote
0answers
62 views
Are there security concerns with migrating a sub-sub domain to a new platform, leaving another in place, and abandoning a third?
I have been tasked with launching a website for my organization. It is a dept. within a parent organization.
Parent Organization Administers domain.com
Dept. Organization Administers sub.domain.com ...
7
votes
2answers
2k views
Google Search Console alert: Harmful content - Uncommon Downloads
today Google Search Console show me some alert on my website
click on link "Malware detected?" open a page with details:
but the list "Sample URLs" is empty and also "Download all samples" download ...
16
votes
7answers
5k views
Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?
One week ago Google sent me an email to go HTTPS. If I won't transfer HTTP to HTTPS then it will show my connection unsecured to all of my site visitors who will try to input text in my site.
Without ...
1
vote
1answer
32 views
Can access to Google Analytics with historical data be recovered after losing administrator access?
I have lost my administrative accessibility to my website under User Management in Google Analytics. I have discussed this with my webmaster, but he does not claim responsibility for it nor is he ...
1
vote
2answers
167 views
COMODO SSL Analyzer Error -14
I have a hard time understanding Comodo's SSL Analyser error in some cases.
If queried on smtp.tiscali.it:465,it returns the image below:
However, if querying in OpenSSL:
Or Digicert:
It seems ...
1
vote
0answers
16 views
How could viruses/malware launch from websites in user environment? [closed]
I'm familiar with web frontend only superficially.
However I'm wondering how is it possible to inject virus on the web site and cause it to run in the user environment (PC) only by visiting specific ...
0
votes
2answers
65 views
People can see my site but I can't, what can be wrong?
I can't see my own site, but other people can. I tried private settings and I don't see firewall. It is so frustrating, it keeps saying:
Hmmm...can’t reach this page
Try this
Make ...
2
votes
0answers
2k views
What does “Require all granted” on Directory / (root) REALY means? (Apache 2.4 on CentOS7
im sure, this question looks really stupid first. but i need a "second opinion" on this, even i did some research on my own but i am still unsure about this.
By default the Apache Configuration on ...
5
votes
1answer
76 views
Google wants sites to use SSL, but complains when compression is turned off to prevent BREACH hacks
Google has let it be known that they want websites to move to SSL, and they will start making it more and more clear that HTTP sites are 'insecure'. But then using their PageSpeed tool, they will mark ...
1
vote
1answer
33 views
Reach only one file through :80
I have an owncloud server which is using HTTPS (www/owncloud). I redirected all HTTP request to HTTPS.
Now I need to reach one file using HTTP (www/other/directory/file.txt). How can I achive this ...
1
vote
3answers
96 views
Website getting lots of visits from this address?
As the title says one of my clients website getting lots of visit from this domain ?
notify.discoverfinancial/notify-Legal_Notice_Splash_Page
What this is all about ?
Is there any security ...
3
votes
1answer
349 views
Where can I redirect exploit scanning bots?
I get a lot of those exploit scanning bots like the ones looking for a WordPress login (which I don't have) or guessing other exploitable URLs.
Where is a sensible place to redirect them to via ....
1
vote
0answers
26 views
Customer's financials compromised - they think it was my site [closed]
Sorry for the title, this is a confusing problem and I wasn't sure how to make the title succinct.
The background:
I have a client's website which sell products. The purchasing is all done through ...
