Questions tagged [security]
Preventing a system from unauthorized access, modification, disruption, or destruction.
506
questions
1
vote
1answer
36 views
Researching .htaccess Syntax
In my template .htaccess file I have been copying and pasteing alot of rules and researching .htaccess for around 2 weeks in an attempt to try and better understand the syntax, different modules & ...
1
vote
1answer
10 views
How to resolve a verified property not appearing in the security issues property dropdown?
I have several verified properties across Google Search Console / Google Analytics.
Unfortunately, I've recently taken on a client that has been red flagged by Google as a Phishing site (which they ...
2
votes
4answers
304 views
Secure way to share unfinished web-page with a customer?
What are the options to share unfinished web-page with a customer without allowing third-party to see the work in progress when developer has control over the web-server? I could come up with ...
2
votes
1answer
62 views
Will adding a random letter to the end of the URL prevent content from being scraped and stolen while allowing SEO?
I have built a website which is a directory of venues / places in a country and client has asked me to make URLs more SEO friendly.
There has been some misunderstanding in communication and I have ...
0
votes
2answers
59 views
Do browser developer tools expose your PHP code?
Browser "development tools" are a great way to learn from others, but are they a security risk? I'm working on a project using PHP. My understanding is that PHP code is hidden. So, someone calling for ...
1
vote
2answers
29 views
Can I restrict access to certain areas of my site using the user's access to restricted areas of another site?
I'd like to restrict access to certain areas of my site (site X) based on whether or not the user has access to certain restricted areas of another site (site Y), which is not under my control.
To be ...
1
vote
1answer
36 views
Best way to handle email address for use with domain registration?
I have registered a domain that I use exclusively for email. In addition to my main email address (foo@example.com), I have companyA@example.com, companyB@example.com, justforfriends@example.com, etc....
2
votes
0answers
62 views
rel=“noreferrer noopener” in target=“_blank” external links
In numerous sites I have been reading, they say that you must use rel="noreferrer noopener" when using target="_blank" within external links.
I can understand why you should use noopener as a ...
1
vote
2answers
46 views
Wordpress targeted by attacker, how to install in that situation?
I have my wordpress installed in my purchased hosting company.
I see from my security plugin that the attacker changes IP and installs malware such as WP-vcd, and changing the themes such as wordpress ...
0
votes
2answers
29 views
Is using SiteGround CPanel over http secure?
I have a website hosted on SiteGround. Their CPanel can be served via http or https ( http://cpanel.us261.siteground.us/login/ ). In my case it is not working via https; the support says it's because ...
0
votes
0answers
20 views
Invalid traffic coming from Sogou
I have not indexed my website in Sogou. I have only very less visitors. But i am getting traffic from Sogou daily. The search keyword is "site:mywebsitename" and is from China. Just visiting main page....
2
votes
1answer
35 views
Firebase and Godaddy: Hosting redirection to www doesn't work for https
I have a website whose domain name is example.com from GoDaddy and my SSL certificate and hosting is on firebase.
Currently www.example.com forwards properly to https://www.example.com but https://...
1
vote
1answer
26 views
Is it insecure to have your Google Analytics tag visible publicly?
I just started adding Google Analytics to my GitHub Pages site, which calls for putting it in the _config.yml file. Is it insecure to keep the _config.yml file in my public GitHub repository, or is it ...
0
votes
1answer
28 views
What is page hijacking?
I tried to read here, for example, but I misunderstand what is Page Hijacking. I saw we don't have a session on this.
What is page hijacking?
3
votes
1answer
112 views
Alexa-rank complaining about insecure generator meta-tag
The Alexa-rank auditing tool is complaining about a generator meta-tag that is according to the HTML5 standard:
<meta name="generator" content="Company Name">
The Alexa Site Audit Report ...
1
vote
0answers
16 views
Best resources for learning how to prevent malicious usage? [closed]
I'd like to work on creating a public website, but I'm concerned about the potential for it to be the target of some attack. I'm aware of some of the more common attacks like XSS, query injection, ...
2
votes
1answer
32 views
How can I ban mediawiki logins from IPs that persistently fail?
I have a MediaWiki website and someone is trying to login as my WikiSysop user by guessing lots of passwords.
What can I do to ban IPs if they exceed a threshold of failed login attempts?
(Okay, no-...
0
votes
2answers
48 views
Block any other domains from using my server
Someone has set their domain to use my server. It's not a mirror, the database and everything works and updates with mine. He's basically stealing my content, and he's showing up on google instead of ...
0
votes
2answers
93 views
Unable to find cause why Joomla website blacklisted by Google (Deceptive site ahead)
We developed a new website for our company.
The old website work on Joomla 2.5, for example https://www.company.com.
Page www.company.com/administrator closed by password via .htaccess
The new ...
3
votes
1answer
45 views
How do I get my website unblocked in Pakistan?
TL;DR: My website is blocked in Pakistan, how do I get it unblocked?
I've had reports that my website QuranX.com is inaccessible from Pakistan. I've had a number of people confirm this.
It seems ...
1
vote
0answers
76 views
Are Google API Key Application Restrictions Secure?
I believe an IP address or HTTP referrer can be spoofed, so can I trust that IP address or HTTP referrer application restrictions (configured via the Google API console) will prevent unauthorised ...
3
votes
1answer
105 views
Hourly connections to my WordPress site via XMLRPC block my IP on BlueHost because they see many email logins
I currently own a WordPress site in a hosting (BlueHost).
On the other hand, I have an application in our offices in .Net. This application, updates WordPress via XMLRPC every 1 hour.
The problem is ...
2
votes
0answers
39 views
Can many single page hits from a variety user agents from the same VPN with the same screen resolution be hurting my search rankings?
I am trying to clarify what is happening with the traffic on my site. Lately I am being flooded with many strange hits, mostly from US and they seem to only open 1 page or visit for few seconds.
The ...
0
votes
1answer
110 views
Is it safe to use JavaScript to insert GoDaddy site seal <script> into an HTML page?
The site seal provided by GoDaddy uses HTML code like:
<span id="siteseal"><script async type="text/javascript" src="https://seal.godaddy.com/getSeal?sealID=...
1
vote
0answers
24 views
Does cPanel pass along security updates from installed software (Mediawiki, WordPress, etc) in a timely manner?
I have an account with a bare-bones cPanel based web-host and I'd like to run a CMS from this account. (MediaWiki or WordPress. I've not decided yet. I hope that doesn't matter for this question.)
...
1
vote
1answer
49 views
SSL Verification files can't be read
I have created an Asp.Net Razor site in Visual Studio 2017. Anyway I was given a series of steps by Winhost for getting free SSL certificate. I followed those steps using SSL for Free. I've used ...
2
votes
0answers
20 views
Assessing TLS capabilities by examining user agent strings from log files
I have a long list of browser user agent strings pulled from website access logs which I would like to analyze to determine the TLS capabilities of our site's visitors in order to get a ballpark ...
3
votes
0answers
41 views
Google Chrome anti-virus checks take too long for downloads from our site. Can it be bypassed or sped up?
I host a windows software website. I noticed that new version of Google Chrome checks downloaded files presumably for viruses and it takes about 10-20 seconds to complete.
Is there any way to white ...
1
vote
0answers
32 views
Identify a user agent consuming massive bandwidth downloading and uploading specific files but never sending a referrer
Blank HTTP_REFERER user agents are downloading and uploading a couple specific files to and from our server! This is causing HUGE bandwidth and CPU usage.
We blocked blank referers on our CDN and ...
1
vote
0answers
534 views
Append basic authentication header NGINX to existing authentication header of upstream application
Assume the following setup:
The NGINX reverse proxy is asking for basic authentication (which is a good habit when you expose things on the internet). Basic authentication uses the Authorization ...
3
votes
1answer
52 views
GDPR & Outdated Browsers
So as a web developer we are always asked to support the old browsers for the potential that someone may fire up a decade old computer and visit our sites.
However with GDPR now in place I wonder if ...
0
votes
1answer
30 views
What is the risk of giving a 3rd party read only access to Google Analytics?
An agency has asked for access to my Google Analytics. I don't really trust them, but I need them to be able to verify my web site stats. What are the risks associated with giving them read only ...
asked Aug 23 '18 at 23:08
1
vote
0answers
28 views
Why Using sha or likewise key in file or Image Urls? [closed]
As I'm new and do not have much insight about security what I have found while scraping websites using scrapy and such tools is that most of the websites like google while naming there image or other ...
1
vote
0answers
31 views
Can dbadmin be secured under nginx by using a rewrite rule to a 404?
I'm trying to redirect all 404 pages to a custom handler with NGINX.
I spent few hours to made the following rewrite in nginx but my question is: can it be a security breach?
location ~ ^/(?!(dbadmin)...
4
votes
1answer
149 views
Apache2: Require directive not working
I'm a tad confused after reading these docs:
https://httpd.apache.org/docs/2.4/sections.html
https://httpd.apache.org/docs/2.4/mod/mod_authz_core.html
I wrote this site definition:
$ cat /etc/...
1
vote
0answers
33 views
Deterministic hash function without storing secret keys
I am developing an application that allows users to post things anonymously yet comment on posts with their name and profile picture. I want to create a method of data storage that makes it impossible ...
1
vote
0answers
24 views
blocking website in my country where it has been copied a lot [closed]
I have an issue that my website has been copying in my country. i want to block in my country. does it impact on SEO?
4
votes
1answer
818 views
Is a PHP POST using cURL from HTTPS site to HTTP endpoint encrypted securely?
I have a website residing on a domain with a valid SSL certificate that is fully using HTTPS. If I take form data from this site that is secured with an SSL and send it to a non-secure HTTP endpoint ...
1
vote
1answer
32 views
Another url is indexed in google which has a link ending with rpid=5PO84Q269
My Website is indexed in google. When i was searching for the term in google for my website i found a url placing above my websites root URL which has same url as root URL but has a weird url ...
4
votes
1answer
4k views
What does this htaccess file do in this configuration?
I've never seen this configuration in .htaccess. This comes from my site that currently reset. I have no SSL certificate installed, but I remember seeing these names on previous certs though.
So does ...
2
votes
1answer
63 views
Can a URL that is not linked to from anywhere be discovered?
Let's say I have a URL that is not linked to from anywhere, and let's say the file portion is very long, so that it's unlikely it could be accidentally entered. Something like ...
1
vote
0answers
316 views
Self-hosting and Apache virtual host on a Synology NAS: any security risk?
I have a Synology NAS running an Apache web server with several Virtual Hosts. Currently, each vhost is associated with a different port, and my router is pointing on them individually. I also have a ...
1
vote
1answer
30 views
Are name=value style directories better for security and SEO than directories with values only specified by position?
Consider the following values for a link in my website's homepage:
/portal=testportal/page=1/lang=fa
/testportal/1/fa
Is there any priority between above options? I'm asking from the security point ...
0
votes
1answer
35 views
Help! Bad Code showing on the top of my Website [closed]
The code "*/" is showing at the top of my website. I can't locate where this is coming from and would love to see if someone can assist!
1
vote
0answers
65 views
Receiving SEC_ERROR_UNKNOWN_ISSUER when Attempting To Access Google Analytics [closed]
Whenever I attempt to access Google Analyics, I receive an "Insecure Connection" message.
In more detail:
analytics.google.com uses an invalid security certificate.
The certificate is not trusted ...
1
vote
1answer
432 views
How to restrict web site/intranet access to company network?
What is the best/most secure way to create a web site or intranet on an externally hosted server, but make it only accessible from within my company's network? I am trying to avoid running my own ...
4
votes
2answers
414 views
How do I get Google to mark my website as “safe” in the search results with a small green icon?
Some websites are marked as safe in the Google search results like shown in the image:
My website and others are not. How do I get this safe mark for my website?
0
votes
1answer
43 views
Is it illegal to create a website that allow a user to upload a file and make it accessible and downloadable for others? [closed]
I am working on a website in which a user can sign in and upload a file and other users can search for it by name and download it. Those files will be catagorized as audio, video, apps(linux, windows, ...
4
votes
2answers
2k views
What to do about certificates being distrusted by Google Chrome?
Recently Google Chrome started issuing a warning on the console which says:
The SSL certificate used to load resources from
https://www.example.com will be distrusted in M70. Once
distrusted, ...
1
vote
1answer
26 views
Keep order status private from search engines?
I searched hard before posting this question. I apologize if it is a duplicate or if this is not the correct forum.
We have a homegrown shopping cart website. We do not require shoppers to register ...
