Questions tagged [security]

Preventing a system from unauthorized access, modification, disruption, or destruction.

Filter by
Sorted by
Tagged with
61 votes
10 answers
6k views

Storing credit card details

I need to store credit card numbers for recurring billing through our 3rd party merchant. Are there any standards I need to adhere to regarding the storage of the details? We've been accepting credit ...
user avatar
42 votes
5 answers
8k views

What events caused mass migration to HTTPS?

For several years I see that Google, Facebook, etc start serving (and even redirect to) content via HTTPS. Serving sites that prompts passwords in insecure HTTP was wrong even in 1999 but it ...
35 votes
9 answers
3k views

Tools to check for common vulnerabilities?

Are there any good tools (desktop or online) which allow you to check whether your website has common vulnerabilities (e.g. SQL Injection, XSS)?
28 votes
2 answers
93k views

Can I skip the PEM pass phrase question when I restart the webserver?

After buying a multi-domain SSL certificate I have started testing it with the Nginx webserver (following documentation in their SSL wiki page). Everything is fine, it works and I get a green ...
user avatar
  • 1,483
25 votes
5 answers
6k views

How can I tell if my website visitors are using LastPass or other password managers?

I want to make sure visitors to my website have the best experience possible so I want them to be able to use LastPass and other Password Managers. Is there any way of identifying whether or not my ...
user avatar
  • 353
23 votes
5 answers
887 views

Force Using SSL on Site now?

I am starting to see a majority of websites starting to use SSL as a standard practice for viewing the website securely now thanks to the revelations of Edward Snowden about the NSA surveillance that ...
user avatar
18 votes
7 answers
7k views

Are "trustmarks" such as McAfee Secure worth the cost?

There are a number of services that will scan a website for vulnerabilities and allow the display of a trustmark image if the site passes their tests. This allegedly increases the level of trust a ...
user avatar
  • 1,734
17 votes
7 answers
5k views

Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?

One week ago Google sent me an email to go HTTPS. If I won't transfer HTTP to HTTPS then it will show my connection unsecured to all of my site visitors who will try to input text in my site. Without ...
user avatar
17 votes
6 answers
5k views

How Can I Secure A VPS Installation?

What are the basic steps to securing a VPS installation that I plan to install Webmin on to host my blogs and personal projects?
user avatar
  • 377
17 votes
2 answers
8k views

How to find domain registrar and DNS hosting with good DNSSEC support?

Simplified problem I want to buy a domain and make a website that is fully secured with DNSSEC. I want to make sure that only the one right SSL certificate could be validated by the browsers and all ...
user avatar
  • 421
16 votes
5 answers
48k views

HTTPS connection is "not safe" due to images

I am currently working on a website and I have successfully installed my SSL certificate. The GeoTrust SSL/TLS checker confirmed that the certificate chain (including CA) is properly installed. ...
user avatar
  • 163
16 votes
2 answers
615 views

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from?

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from? Are some SSL certificate vendors better than others? If so, why?
user avatar
  • 3,703
15 votes
1 answer
2k views

Could somebody hijack my Google Analytics for a site?

I track many websites in Google Analytics. Recently I accidentally added tracking code for site A to site B, which I noticed a couple of weeks later. By then, one website had two weeks of no visitors, ...
user avatar
  • 415
14 votes
4 answers
290 views

Prevent possible spammer from linking to my site

We own a website which, through google search results, we determined is either being linked to improperly or for spam purposes by another completely random source. They recently registered a domain ...
user avatar
  • 313
13 votes
1 answer
910 views

Is an externally-hosted subdomain a security risk?

A company I've been developing a web site for wants to keep their current domain, which is something like company.parentcompany.com. Because we wanted to use a different CMS, the parent company ...
user avatar
  • 143
12 votes
2 answers
4k views

Does the 'Server' header serve any purpose?

For example, when I dump the response header for my server I get: Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.5 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g Is this used for anything? Is ...
user avatar
12 votes
3 answers
7k views

Are there any disadvantages to Cloudflare’s “Flexible SSL”?

Cloudflare lets you serve your site over SSL without having to purchase and install a security certificate, a product they call “Flexible SSL”. (They act as a proxy and serve your site over SSL from ...
user avatar
  • 20.3k
11 votes
4 answers
1k views

Does SSL really matter for most websites?

I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL. I've read plenty of ...
user avatar
11 votes
3 answers
180 views

Is it sufficient to secure a order status page just by a random URL?

After a (corporate) customer bought some items in our online shop, we send an email with an overview what he has bought to him. We'd like to inform our customer about received payments, packet ...
user avatar
  • 111
10 votes
8 answers
2k views

How to find out the strength of the Wordpress (already stored) password?

I am responsible for security of lots of shared hosting server. Most of them are having WordPress websites. Each server is having at least 500 WordPress websites. In my expereince, the issue with ...
user avatar
  • 1,297
10 votes
4 answers
4k views

Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?

I'd like to submit my personal site into the Chrome HSTS preload list. The site there says: In order to be included on the HSTS preload list, your site must: Have a valid certificate. ...
user avatar
10 votes
2 answers
669 views

Forum Spam Question. Why are Chinese hackers posting tiny images on my forum

My forum is getting attacked by spammers with Chinese IP's. Replies are created to discussion topics, always short responses and along with the response an image is inserted using forum code which is ...
user avatar
  • 472
10 votes
3 answers
9k views

what is wwws.site.com

I know about https for securing important pages like login and such. But why would someone create a separate subdomain like wwws as well? for example https://wwws.site.com/login
user avatar
  • 201
10 votes
2 answers
6k views

Google Search Console alert: Harmful content - Uncommon Downloads

today Google Search Console show me some alert on my website click on link "Malware detected?" open a page with details: but the list "Sample URLs" is empty and also "Download all samples" download ...
user avatar
  • 463
10 votes
1 answer
1k views

Why chmod 777 is not secure?

chmod 777 file change the permissions of the file file to read, write, and execute for all. Ok, so the file can be manipulated in any way by any script on the server. But why is this not secure? ...
user avatar
  • 297
10 votes
5 answers
230 views

Is PCI compliance scrutinised?

After reading the very strongly worded recommendations regarding the storage of credit card details here, I've got to wonder - what happens if a non-PCI compliant company starts storing credit card ...
user avatar
10 votes
1 answer
741 views

How did Google manage to crawl my 403 pages?

I had a couple private files in a directory on my school folder. You could see that the files existed by going to myschool.edu/myusername/myfolder, but trying to access the files themselves via ...
user avatar
  • 201
9 votes
2 answers
3k views

How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?

I have forms on my in-development website which require the person to enter an e-mail address. I don't want to have to send them a "verification" e-mail with a URL containing a code, or ...
user avatar
  • 107
9 votes
4 answers
10k views

Does SSL require a client side certificate of any kind at all?

A friend insists it does, that both browser and server both need certificates. I say no, only the server requires one, with two keys. The question is whether the browser uses some sort of certificate (...
user avatar
  • 227
9 votes
1 answer
7k views

Why has Apache begun running a single process as root, and another as root and the wwwdata user?

I am running Apache Worker-MPM, PHP 5.3.2, and FCGID. Apache runs better than before, but I noticed that there is an apache process running as root and a second process that runs as both root and ...
user avatar
  • 91
8 votes
3 answers
6k views

Is a "Show Password" option on login form safe?

A website I use occasionally has had a recent overhaul and added a "Show" checkbox next to the password field on their login form. I understand why some ppl want these when they're actually typing ...
user avatar
  • 297
8 votes
8 answers
605 views

What are the reasons to have a two step login? (Username on one page, password on the second.)

So I've recently been encountering more two step login processes, where I'm required to enter my username on one page and my password on a second. I really don't like this pattern, as it requires an ...
user avatar
8 votes
2 answers
10k views

Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key

Is there a comparison between 4096 Bit RSA-Key and a 2048 Bit RSA-Key? I'd like to know what impact on performance it has, if I'm choosing a 4096-Bit key for ssl-encryption. Is there any info which ...
user avatar
  • 181
8 votes
3 answers
15k views

Do internal intranet websites need to be secure?

The question is in the title. Does an internal site need to have https security? For example we have an internal site that handles our client's license keys -- do we need for that to be secure since ...
user avatar
  • 185
8 votes
5 answers
246 views

What do I need to do to enable my site to accept credit cards?

I want to store my customers' credit card information in my database so that they can quickly check out again without having to re-enter their info. What do I need to know about security/https/etc to ...
user avatar
  • 2,158
8 votes
4 answers
265 views

How should a site respond to automated login attempts with phony usernames?

For the last couple weeks I've been seeing a consistent stream of 15-30 invalid login attempts per hours on my site. Many of them are non-sensical usernames that nobody would ever register for real, ...
user avatar
  • 183
8 votes
2 answers
4k views

How can I secure an installation of MediaWiki?

I want to run an installation of MediaWiki as a Internet-accessible personal wiki, running on wiki.mysite.com. However, I want to ensure that I am the only one who can read and write to this wiki. In ...
user avatar
8 votes
3 answers
2k views

Prevent spam using Honey Pots

I am really curious about how to prevent comment spam in a forum using a honey pot trap for spam bots. What if CSS and javascript is turned off in a browser? Do you see any other disadvantages in ...
user avatar
  • 233
8 votes
1 answer
192 views

Someone/something accessed a link in an email, but it was not who the email was sent to

Could anyone solve this mystery? We have an web application that is only available to invited users. Our admin create accounts for users, and then the application sends an activation email to that ...
user avatar
7 votes
5 answers
2k views

Are indexed Wordpress admin pages a security threat?

Because it was blocking Googlebot from accessing important files, I recently updated our /robots.txt file and removed most of it, including wp-admin. Now, the people on charge of hosting and SEO ...
user avatar
7 votes
5 answers
8k views

Disallow robots.txt from being accessed in a browser but still accessible by spiders?

We make use of the robots.txt file to prevent Google (and other search spiders) from crawling certain pages/directories in our domain. Some of these directories/files are secret, meaning they aren't ...
user avatar
7 votes
4 answers
13k views

How To Hide From BuiltWith?

Out of curiosity, does anyone know how builtwith.com works? How does it identify the platform or app a website is using? And most importantly does anyone know how to hide the details from it? Somehow ...
user avatar
  • 257
7 votes
5 answers
720 views

Better Spam Protection than reCAPTCHA?

I hope this is a valid question to ask here... but knows anyone a better spam protection than reCAPTCHA? We've now using reCAPTCHA for some time but got now the situation that obviously more and more ...
user avatar
  • 215
7 votes
3 answers
1k views

Important fields in HTTP header from security perspective

What are the Important fields in HTTP header from security perspective? I tried to google it but unable to find. Can anybody provide me a link to read about it? Thanks in advance.
user avatar
7 votes
3 answers
145 views

Found Odd File on Site: Should I Be Concerned?

I found a php file that was uploaded to our web server that had sneaked past our form validation. I did some searching and there was very little information regarding this file, however the small ...
user avatar
  • 357
7 votes
1 answer
172 views

Is there any good reason I would want my website to be framed?

I'm building a website that's not security-critical in any way at all, so having somebody put a page in an <iframe> is not particularly dangerous to its users. However, as my website doesn't ...
user avatar
  • 173
7 votes
1 answer
2k views

Security: Hide mysql connection details file

Ok, so I know this must be a very basic question, but my problem is the following: I have developed my first PHP mini-app (so I'm fairly new to this) and I am pretty sure that there are two files of ...
user avatar
7 votes
4 answers
298 views

Webhosting company able to unhash passwords?

Tonight I was using the cPanel of a web-site I host and when I went to change the password I received a warning that I couldn't change the password to my desired password because it was too similar to ...
user avatar
7 votes
3 answers
411 views

How to fix a site that Google tells you is infected

I work for a company that setup a website, this one thelinearshop.com (warning this site contains malware so don't go there if you are concerned), before I started working for them. The site uses ...
user avatar
  • 12.7k
7 votes
3 answers
323 views

Is website security accreditation worth having?

My site handles sensitive data, is there any website security accreditation that is well respected and worth having?
user avatar

1
2 3 4 5
12