Questions tagged [security]
Preventing a system from unauthorized access, modification, disruption, or destruction.
585
questions
0
votes
0
answers
17
views
Cloudflare WAF Rule not working properly to block access to pages from specific countries
I have setup cloudflare to block access to WordPress back-end with following WAF rule. It somehow lets me access back-end from other countries other than countries other than Germany and UK.
It was ...
- 711
0
votes
0
answers
30
views
Blocking "malicious" VPN access
I run a small website that averages about 500 hits a day. About once a month I have a day where I see a spike of 5,000 in GA4. When looking closer, the traffic would appear to be a bot using a VPN ...
- 3,155
6
votes
1
answer
445
views
Chrome incorrectly marking our domain without a hyphen as deceptive when we own and use both versions
Chrome has a fairly new "lookalike URL" or "typo squatting" detection feature. The aim is to warn users if they are accidentally going to the wrong URL.
We own two sites (made up ...
10
votes
3
answers
12k
views
Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key
Is there a comparison between 4096 Bit RSA-Key and a 2048 Bit RSA-Key? I'd like to know what impact on performance it has, if I'm choosing a 4096-Bit key for ssl-encryption. Is there any info which ...
- 103
2
votes
1
answer
56
views
How to hide my username from the URL? [closed]
At my WordPress site, on every post (and comment) my DISPLAY NAME (author's name) appears, and it is fine. If a reader clicks that name then it shows the author page (blog page) with all the posts by ...
- 106
5
votes
1
answer
917
views
Unable to locate phishing URL in CPanel file manager
I received an email from Google that there may be phishing pages on my website. Below are example URLs on my site which may be part of a phishing attack: http://www.uooart.com/~impots/file/...
0
votes
1
answer
62
views
Antivirus software flags website with "Caution: This site may contain content that could affect your online security" in Google Search results
I'm a web developer. A local installation of the WebRoot antivirus software is flagging my client's construction website with the warning "Caution: This site may contain content that could affect ...
- 65
0
votes
1
answer
30
views
Problem to detect security script like X-Frame through .htaccess file in WordPress and how to trace and find the problem?
I transferred my WordPress website from a hosting company to a virtual machine. I want to add some security scripts like X-Frame, CSP, and HSTS. Before that, I edited the .htaccess file from the ...
- 1,792
4
votes
1
answer
2k
views
Delete Firefox JavaScript console history?
How do I the clear the command history of Firefox's JavaScript console? Clearing all history, cookies, cache, etc., doesn't clear the JavaScript console history.
- 103
0
votes
1
answer
250
views
"Deceptive site ahead" issue with my Laravel app
I developed a Laravel app using Laravel. After deployment, every time I try to access the app, it says "Deceptive site ahead".
I tried searching for fixes and doing almost everything that I ...
- 3
0
votes
0
answers
29
views
Website spoofing our site under different domain. How do I block it?
I've been trying to stop another domain operator from spoofing one of my client's websites and can't figure out how to do it.
Our site is https://autism-products.com and the site spoofing us is https:/...
- 2,241
4
votes
5
answers
8k
views
How to prevent Google from finding my admin index page?
I am running a website but for some days I have stopped it and put the site under-construction because the Index of admin page is visible to the outside world through the Google search.
One of my ...
- 98.4k
0
votes
0
answers
111
views
"GET / HTTP/1.1" requests getting 404 from malicious agents and bots?
I was checking my server logs and I see some requests simply for "GET / HTTP/1.1" are getting 404 error but only from seemingly malicious users and bots. I thought 404 was only server-side ...
- 143
1
vote
1
answer
218
views
Using dynamic content in Wordpress by decoding and using a JWT passed on the URL, without logging in any user
I have a Wordpress and I don't want to create users for the next functionality:
I need a page that has this behaviour:
URL1 = https://my-site.example.com/some-page/ => Renders some public content
...
- 265
4
votes
2
answers
2k
views
Website is under maintenance - how to restrict access?
Currently, my website is under maintenance. I want to be the only person who's able to access/view the website online until I finish maintenance. How to set restrictions to others? I hate stalkers.
- 42.7k
1
vote
0
answers
21
views
Will Website Security tests (Security Penetration) hurt my WordPress page? [closed]
I have a WP page.
I did a security checkup through the usual website auditing tools. I'd like to use a tool specialized for Security checks.
Will it hurt my website somehow?
What would you recommend, ...
- 65
1
vote
1
answer
64
views
What is page hijacking?
I tried to read here, for example, but I misunderstand what is Page Hijacking. I saw we don't have a session on this.
What is page hijacking?
- 13
3
votes
2
answers
1k
views
My website has been cloned without authorization. What can I do?
I have the following problem:
I operate an online service and about 2 months ago a Copy Cat clone appeared under a strange domain unknown to me. My portal is simply mirrored/redirected to another ...
2
votes
1
answer
136
views
Why the facebook pixel tests well in Chrome but not in Firefox?
I've a website with a facebook pixel via Tag Manager. I fire a "page view" FB event triggered on the "page view" tag manager event.
In chrome
I then open the pixel tester on Chrome ...
- 21
0
votes
1
answer
85
views
What is the real risk in not using an SSL certificate?
Note, I'm not asking whether or not I should use an SSL certificate, as I will always use one when possible. Better safe than sorry, but now I'm working on a group chat using a PHP web socket and ...
- 2,246
5
votes
2
answers
925
views
Should rel="noopener" be set on links to external sites even if I own the site?
We've had a policy to always set rel="noopener" for all external links.
However is that necessary if the external link is to a site in our own control?
Let's say we own both coffee.example....
CommunityBot
- 1
2
votes
3
answers
1k
views
Cloudflare WAF rule for blocking a path except from two countries instead block all traffic to the site
I want Cloudflare WAF to restrict admin section of WordPress site/wp-admin/ and allow access to WP admin section from only two countries India & UAE.
For some reason it block traffic from all ...
- 1,792
14
votes
1
answer
7k
views
Spike in Traffic from "Facebot Twitterbot" user agent
My website, which typically has very low volume, suddenly received a huge spike in traffic all from the same user agent. We were receiving about 3 requests per second for a sustained period of about ...
- 1
1
vote
0
answers
20
views
I change everything but again Instagram knows it's me [closed]
I change my device, my public dynamic IP address, account, username, password, email, browser, app, cookies and everything and again Instagram knows it's me, and my question was do you know that can ...
- 11
1
vote
0
answers
34
views
Unwanted ads so on websites seems to be ad malware
Google popup Ads randomly show on two of our websites which are hosted with same hosting provider and possible on same server as its shared hosting. We dont use and kind of ads on our websites
Ads ...
- 711
4
votes
1
answer
447
views
Should I worry about exposing my server's IP address?
I currently use Cloudflare for DNS, and they advertise that they will hide the IP address of my server if I proxy through them. Should I worry about this since the IP points to a dedicated server (not ...
- 1
2
votes
1
answer
192
views
Security headers set in .htaccess not taking effect on WordPress site with Cloudflare
We have a site on WPEngine that uses WP Rocket cache and Cloudflare where I have added security header directives in the .htaccess file,
<IfModule mod_headers.c>
# X-XSS-Protection
...
- 1,792
3
votes
2
answers
104
views
Rules in .htaccess only if the requested URL is /wp-admin
I want these lines from my .htaccess to execute only if the URL is not /wp-admin:
Header add Content-Security-Policy "default-src 'self';"
Header add Content-Security-Policy "script-src ...
- 31
3
votes
0
answers
75
views
Avoiding Microsoft Edge "isn't commonly downloaded" warning
I have shifted software downloads for our customers to download from our domain instead of Dropbox. Now Microsoft Edge raises the "isn't commonly downloaded" warning. I had this on Chrome ...
- 31
0
votes
0
answers
22
views
How to correct company website classification at the database level from companies like Sophos
A Corporate client using web blocker such as Sophos cannot access our company website. Blocker comes back and indicates our site is "Sex Education" however it is mental health education. I ...
0
votes
1
answer
30
views
Malicious activity on website using site's search bar
It started with a few but now the number has increased to more than a hundred. I am seeing strange urls getting hit as errors in my Google search console, not sure how is this being done but someone ...
- 1,792
2
votes
1
answer
242
views
Can I replace rua entry with ruf in DMARC record?
I currently have a DMARC record set up like this:
v=DMARC1; p=none; fo=1; rua=mailto:[email protected] but I am receiving a lot of reports everyday.
I would like to only receive failure reports (...
- 15.8k
0
votes
0
answers
22
views
Is single-word form submission a known attack?
I have one website that is consistently getting weird form submissions. It's a contact form that captures name, email, subject, and message. Five to ten times per day it gets a submission where all ...
- 131
1
vote
0
answers
999
views
.htaccess security headers for IONOS
I need to implement security headers for a website hosted by IONOS. I've used the following code, which works on sites hosted elsewhere, but not here.
<IfModule mod_headers.c>
Header set ...
- 98.4k
2
votes
1
answer
98
views
As a Webmaster, how are you handling the response to the war in Ukraine in regards to managing your site(s)?
This is a community wiki intended for our users to be able to share ideas as to how Webmasters are managing the response to the war in Ukraine for their site(s). There are no right or wrong answers, ...
dan♦
- 15.1k
3
votes
2
answers
124
views
Do I need a wildcard SSL certificate to secure my website and email subdomains through cPanel?
I have a website and emails through the same hosting provider which I manage through cpanel.
At the moment I am using zeroSSL to secure my website (www.example.com), however, this does not support my ...
- 98.4k
2
votes
3
answers
2k
views
How can I allow robots access to my sitemap, but prevent casual users from accessing it?
I am storing my sitemaps in my web folder. I want web crawlers (Googlebot etc) to be able to access the file, but I don't necessarily want all and sundry to have access to it.
For example, this site (...
- 86.2k
3
votes
2
answers
1k
views
Is there a way of listing files for a directory if it contains index.html?
On my server (over which I have little control), directories are listed by default, so for mysite.com/images I get:
Index of /images
Parent Directory
BirdsAreHere.png
CanYouSpot-AdBlank....
- 42.7k
3
votes
0
answers
38
views
'[0] appended to multiple URL parameters, is something scanning for vulnerabilities?
I use a WAF that monitors suspicious query string and form POST values. Typical script-kiddie stuff like common SQL injection strings, etc.
Over the last several months I've noticed a dramatic uptick ...
- 98.4k
3
votes
1
answer
212
views
Site reported as blacklisted by Norton Safe Web, with no reason given. How to resolve?
A WordPress website that I monitor using ManageWP (by running a daily security report) has been reported as blacklisted by Norton.
I visited the Norton website to investigate the reason (creating an ...
CommunityBot
- 1
1
vote
0
answers
17
views
Limiting what affiliate's Google Tag Manager can inject into my site
I am managing a website where we sell products. We have an affiliate program.
I want to facilitate the affiliates the tracking for them to optimize the campaigns.
Currently we display a different ...
- 265
0
votes
0
answers
311
views
How are credentials stored and encrypted in Nexus Repository Manager OSS 2.14?
How does Nexus Repository Manager OSS 2.14 store and encrypt it's user credentials?
I couldn’t finy anything in the documentation, knowledge base nor on the web on how credentials (local users) are ...
- 98.4k
10
votes
4
answers
5k
views
Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?
I'd like to submit my personal site into the Chrome HSTS preload list.
The site there says:
In order to be included on the HSTS preload list, your site must:
Have a valid certificate.
...
- 86.2k
3
votes
1
answer
379
views
How do I get my website unblocked in Pakistan?
TL;DR: My website is blocked in Pakistan, how do I get it unblocked?
I've had reports that my website QuranX.com is inaccessible from Pakistan. I've had a number of people confirm this.
It seems ...
- 1
2
votes
1
answer
32
views
Recording / Logging CSP Violations
I am in the process of implementing a CSP policy for a variety of domains and am looking for a method to record/log browser CSP violations encountered by any end user. I want to make sure I don't miss ...
- 588
4
votes
1
answer
129
views
How to promote the quality/security of your a website to your its customers?
Our organization is building a Drupal web platform that we aim at reselling as a cloud service. In order to provide our customers with maximum confidence in our solution, we're looking at ways of ...
- 15.8k
3
votes
2
answers
1k
views
Is adding Disqus to website safe for user privacy?
Some guides (see gohugo.io or webmasters.stackexchange.com for examples) recommend Disqus as a commenting feature for static sites.
Is adding Disqus to a website safe for user privacy?
UPD
Should I ...
CommunityBot
- 1
0
votes
1
answer
70
views
Restricting access to a website without using sessions or IP whitelisting? [duplicate]
I want to restrict access to a private website that needs to be accessible to multiple people.
In the event the website has public and private areas, a login to a user session is the usual solution.
...
- 8,325
3
votes
1
answer
517
views
Flood of GET requests for path /{GUID}/{GUID}/from?get&nocache={/\S{5}/}
This afternoon I got a flood of request (400+ within 10 minutes) to one of my web applications, from the same IP address, for non-existent URI.
All of the requests were GET with a path the matches the ...
- 6,221
1
vote
0
answers
40
views
Hosting web site with onion share [closed]
So, i don't use any kind of social media and i decided to make my web site instead of that. This idea is inspired by guy named Luke Smith from youtube and i want to make it to look smiliar to this: ...
- 11