Questions tagged [security]

Preventing a system from unauthorized access, modification, disruption, or destruction.

Filter by
Sorted by
Tagged with
0
votes
3answers
2k views

How to trace origin of script injected in my webpage

I was looking through a static site I created on my local server, in my web browser, and found a curious call to an external script <script src="https://engowe.com/ad.php?u=...
0
votes
2answers
799 views

“only secured content is displayed”

I just had a SSL certificate installed on my drupal site using shared hosting and on the front page it now says "only secured content is displayed" in IE. How do I find which content is NOT secure ...
1
vote
1answer
44 views

Researching .htaccess Syntax

In my template .htaccess file I have been copying and pasteing alot of rules and researching .htaccess for around 2 weeks in an attempt to try and better understand the syntax, different modules & ...
1
vote
1answer
40 views

Best way to handle email address for use with domain registration?

I have registered a domain that I use exclusively for email. In addition to my main email address (foo@example.com), I have companyA@example.com, companyB@example.com, justforfriends@example.com, etc....
7
votes
3answers
10k views

Do internal intranet websites need to be secure?

The question is in the title. Does an internal site need to have https security? For example we have an internal site that handles our client's license keys -- do we need for that to be secure since ...
1
vote
1answer
11 views

How to resolve a verified property not appearing in the security issues property dropdown?

I have several verified properties across Google Search Console / Google Analytics. Unfortunately, I've recently taken on a client that has been red flagged by Google as a Phishing site (which they ...
2
votes
4answers
308 views

Secure way to share unfinished web-page with a customer?

What are the options to share unfinished web-page with a customer without allowing third-party to see the work in progress when developer has control over the web-server? I could come up with ...
4
votes
2answers
559 views

How to use the private and public keys?

I am new to ssl certificates, i wanted to learn about ssl certificates, and I generated private and public keys myself while logged into cpanel, I wonder how to use those and generate a secured ...
2
votes
1answer
63 views

Will adding a random letter to the end of the URL prevent content from being scraped and stolen while allowing SEO?

I have built a website which is a directory of venues / places in a country and client has asked me to make URLs more SEO friendly. There has been some misunderstanding in communication and I have ...
0
votes
2answers
60 views

Do browser developer tools expose your PHP code?

Browser "development tools" are a great way to learn from others, but are they a security risk? I'm working on a project using PHP. My understanding is that PHP code is hidden. So, someone calling for ...
1
vote
2answers
30 views

Can I restrict access to certain areas of my site using the user's access to restricted areas of another site?

I'd like to restrict access to certain areas of my site (site X) based on whether or not the user has access to certain restricted areas of another site (site Y), which is not under my control. To be ...
2
votes
0answers
78 views

rel=“noreferrer noopener” in target=“_blank” external links

In numerous sites I have been reading, they say that you must use rel="noreferrer noopener" when using target="_blank" within external links. I can understand why you should use noopener as a ...
2
votes
1answer
32 views

How can I ban mediawiki logins from IPs that persistently fail?

I have a MediaWiki website and someone is trying to login as my WikiSysop user by guessing lots of passwords. What can I do to ban IPs if they exceed a threshold of failed login attempts? (Okay, no-...
0
votes
2answers
31 views

Is using SiteGround CPanel over http secure?

I have a website hosted on SiteGround. Their CPanel can be served via http or https ( http://cpanel.us261.siteground.us/login/ ). In my case it is not working via https; the support says it's because ...
1
vote
2answers
47 views

Wordpress targeted by attacker, how to install in that situation?

I have my wordpress installed in my purchased hosting company. I see from my security plugin that the attacker changes IP and installs malware such as WP-vcd, and changing the themes such as wordpress ...
4
votes
5answers
12k views

prevent IIS from executing scripts in a specific directory

I have a php web application that allows file uploads to a specific directory. I would like to prevent the execution of any file that is uploaded into that directory whether it is ASP, PHP, or ...
0
votes
0answers
25 views

Invalid traffic coming from Sogou

I have not indexed my website in Sogou. I have only very less visitors. But i am getting traffic from Sogou daily. The search keyword is "site:mywebsitename" and is from China. Just visiting main page....
2
votes
1answer
43 views

Firebase and Godaddy: Hosting redirection to www doesn't work for https

I have a website whose domain name is example.com from GoDaddy and my SSL certificate and hosting is on firebase. Currently www.example.com forwards properly to https://www.example.com but https://...
1
vote
1answer
29 views

Is it insecure to have your Google Analytics tag visible publicly?

I just started adding Google Analytics to my GitHub Pages site, which calls for putting it in the _config.yml file. Is it insecure to keep the _config.yml file in my public GitHub repository, or is it ...
0
votes
1answer
29 views

What is page hijacking?

I tried to read here, for example, but I misunderstand what is Page Hijacking. I saw we don't have a session on this. What is page hijacking?
3
votes
1answer
115 views

Alexa-rank complaining about insecure generator meta-tag

The Alexa-rank auditing tool is complaining about a generator meta-tag that is according to the HTML5 standard: <meta name="generator" content="Company Name"> The Alexa Site Audit Report ...
1
vote
0answers
16 views

Best resources for learning how to prevent malicious usage? [closed]

I'd like to work on creating a public website, but I'm concerned about the potential for it to be the target of some attack. I'm aware of some of the more common attacks like XSS, query injection, ...
2
votes
1answer
16k views

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request

I have a joomla website installed and working good. i installed Qlue404 component which redirects 404 page to a custom page., sometimes when i try the symbols ' and some others the 404 page appears ...
2
votes
1answer
3k views

What does “Require all granted” on Directory / (root) REALY means? (Apache 2.4 on CentOS7

im sure, this question looks really stupid first. but i need a "second opinion" on this, even i did some research on my own but i am still unsure about this. By default the Apache Configuration on ...
0
votes
2answers
49 views

Block any other domains from using my server

Someone has set their domain to use my server. It's not a mirror, the database and everything works and updates with mine. He's basically stealing my content, and he's showing up on google instead of ...
6
votes
4answers
5k views

Does SSL require a client side certificate of any kind at all?

A friend insists it does, that both browser and server both need certificates. I say no, only the server requires one, with two keys. The question is whether the browser uses some sort of certificate (...
4
votes
3answers
10k views

Suspicious Web Traffic from Amazon.com ISP

Just a few hours back I was checking my logs when I found a whole bunch of traffic from IP address 54.174.xx.xx and ISP Amazon.com (validated from Google analytics). It lasted for an hour and then ...
8
votes
2answers
4k views

Google Search Console alert: Harmful content - Uncommon Downloads

today Google Search Console show me some alert on my website click on link "Malware detected?" open a page with details: but the list "Sample URLs" is empty and also "Download all samples" download ...
3
votes
1answer
47 views

How do I get my website unblocked in Pakistan?

TL;DR: My website is blocked in Pakistan, how do I get it unblocked? I've had reports that my website QuranX.com is inaccessible from Pakistan. I've had a number of people confirm this. It seems ...
2
votes
7answers
2k views

WordPress keeps redirecting my users to install.php, Is it caused by an injection hack?

I don't really know how to express my problem, so bear with me. This is a bit hard to explain. I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the /wp-...
0
votes
2answers
112 views

Unable to find cause why Joomla website blacklisted by Google (Deceptive site ahead)

We developed a new website for our company. The old website work on Joomla 2.5, for example https://www.company.com. Page www.company.com/administrator closed by password via .htaccess The new ...
0
votes
2answers
620 views

How can we obfuscate or hide our Struts2 web application code when it is hosted with another company?

I have a web application written in the Struts2 framework. I want to host the application with another company. Is there any way to hide the code which is hosted on the server? What I want is to ...
2
votes
5answers
5k views

How to prevent Google from finding my admin index page?

I am running a website but for some days i stopped it and put the under-construction page because the Index of admin page is visible to the outside world through the Google search. One of my friend ...
16
votes
7answers
5k views

Are “trustmarks” such as McAfee Secure worth the cost?

There are a number of services that will scan a website for vulnerabilities and allow the display of a trustmark image if the site passes their tests. This allegedly increases the level of trust a ...
6
votes
1answer
534 views

What's the point of cross-origin resource sharing if there's a bunch of CORS proxies running?

I never really liked the direction CORS (cross-origin resource sharing) is taking. I think there's a misconception how client-server communication should work. The general concept is: User: Hello ...
4
votes
1answer
1k views

Why do many websites block requests from common HTTP libraries by user-agent?

Writing spiders, I have noticed that many sites will return a 403 error if I hit them from popular HTTP software libraries, unless I manually override the default User-Agent header used by the library....
1
vote
0answers
84 views

Are Google API Key Application Restrictions Secure?

I believe an IP address or HTTP referrer can be spoofed, so can I trust that IP address or HTTP referrer application restrictions (configured via the Google API console) will prevent unauthorised ...
14
votes
5answers
26k views

HTTPS connection is “not safe” due to images

I am currently working on a website and I have successfully installed my SSL certificate. The GeoTrust SSL/TLS checker confirmed that the certificate chain (including CA) is properly installed. ...
3
votes
0answers
44 views

Google Chrome anti-virus checks take too long for downloads from our site. Can it be bypassed or sped up?

I host a windows software website. I noticed that new version of Google Chrome checks downloaded files presumably for viruses and it takes about 10-20 seconds to complete. Is there any way to white ...
0
votes
1answer
126 views

Is it safe to use JavaScript to insert GoDaddy site seal <script> into an HTML page?

The site seal provided by GoDaddy uses HTML code like: <span id="siteseal"><script async type="text/javascript" src="https://seal.godaddy.com/getSeal?sealID=...
2
votes
0answers
39 views

Can many single page hits from a variety user agents from the same VPN with the same screen resolution be hurting my search rankings?

I am trying to clarify what is happening with the traffic on my site. Lately I am being flooded with many strange hits, mostly from US and they seem to only open 1 page or visit for few seconds. The ...
3
votes
1answer
109 views

Hourly connections to my WordPress site via XMLRPC block my IP on BlueHost because they see many email logins

I currently own a WordPress site in a hosting (BlueHost). On the other hand, I have an application in our offices in .Net. This application, updates WordPress via XMLRPC every 1 hour. The problem is ...
5
votes
5answers
14k views

What is deleteme.xxxxxxxx.php

I was going through page hit logs on awstats and I noticed the following two entries: /deleteme.lcivykmt.php /deleteme.nctqicjg.php I was wondering if anyone recognised them and whether I should ...
1
vote
0answers
24 views

Does cPanel pass along security updates from installed software (Mediawiki, WordPress, etc) in a timely manner?

I have an account with a bare-bones cPanel based web-host and I'd like to run a CMS from this account. (MediaWiki or WordPress. I've not decided yet. I hope that doesn't matter for this question.) ...
3
votes
1answer
3k views

How to improve WOT score of a site?

I don't understand why my site Trustworthiness and Vendor Reliability are considered bad by WOT. I do not have ADS, I never spammed my site around, I do not have links that point to untrusted sites. ...
1
vote
1answer
49 views

SSL Verification files can't be read

I have created an Asp.Net Razor site in Visual Studio 2017. Anyway I was given a series of steps by Winhost for getting free SSL certificate. I followed those steps using SSL for Free. I've used ...
2
votes
0answers
20 views

Assessing TLS capabilities by examining user agent strings from log files

I have a long list of browser user agent strings pulled from website access logs which I would like to analyze to determine the TLS capabilities of our site's visitors in order to get a ballpark ...
1
vote
2answers
61 views

What are the effects of having a “non-secure” warning displayed for our e-commerce site?

For the past couple weeks now we have seen a non-secure warning displayed on our site where the SSL/Security info for a website would normally be displayed (in Chrome). Along with this I have noticed ...
1
vote
0answers
32 views

Identify a user agent consuming massive bandwidth downloading and uploading specific files but never sending a referrer

Blank HTTP_REFERER user agents are downloading and uploading a couple specific files to and from our server! This is causing HUGE bandwidth and CPU usage. We blocked blank referers on our CDN and ...
1
vote
0answers
558 views

Append basic authentication header NGINX to existing authentication header of upstream application

Assume the following setup: The NGINX reverse proxy is asking for basic authentication (which is a good habit when you expose things on the internet). Basic authentication uses the Authorization ...