Questions tagged [security]

Preventing a system from unauthorized access, modification, disruption, or destruction.

Filter by
Sorted by
Tagged with
0
votes
1answer
29 views

Can I securely allow users of my site to change their email address if they forgot their password and no longer have access to the old email address?

How do I securely allow users to change their emails if they lose access to the original email? Do I need 2 factor? It's a social media site coded in nodejs where I have their username, password, and ...
1
vote
0answers
6 views

Does the same site cookie policy potentially change anything for CORS

According to the new same-site cookie policy (once implemented across all browsers) , a third party call from another page would not send along the cookies by default, unless the third party ...
1
vote
1answer
73 views

Site reported as blacklisted by Norton Safe Web, with no reason given. How to resolve?

A WordPress website that I monitor using ManageWP (by running a daily security report) has been reported as blacklisted by Norton. I visited the Norton website to investigate the reason (creating an ...
3
votes
1answer
6k views

Fail2Ban & Port-Scanning

Is there any filter built into Fail2Ban to temporarily ban any IP addresses which attempt port scanning activities (provided that iptables logs these activities)?
1
vote
0answers
15 views

Can a reverse-proxied Facebook in an IFRAME access the other logged-in Facebook's in other windows and IFRAMEs?

We have set up a reverse proxy to Facebook. We wound up another subdomain on our server and pointed it at https://www.facebook.com using the following web.config. (Redacted slightly for security's ...
1
vote
0answers
36 views

Flood of GET requests for path /{GUID}/{GUID}/from?get&nocache={/\S{5}/}

This afternoon I got a flood of request (400+ within 10 minutes) to one of my web applications, from the same IP address, for non-existent URI. All of the requests were GET with a path the matches the ...
1
vote
1answer
446 views

Why is G Suite passing DMARC when alignment fails?

I have a G Suite account with a primary and secondary domains. I have successfully setup DMARC for my primary domain. Now I am trying to setup DMARC for my secondary domain. SPF is setup for my ...
4
votes
3answers
15k views

Suspicious Web Traffic from Amazon.com ISP

Just a few hours back I was checking my logs when I found a whole bunch of traffic from IP address 54.174.xx.xx and ISP Amazon.com (validated from Google analytics). It lasted for an hour and then ...
2
votes
7answers
2k views

WordPress keeps redirecting my users to install.php, Is it caused by an injection hack?

I don't really know how to express my problem, so bear with me. This is a bit hard to explain. I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the /wp-...
10
votes
2answers
6k views

Google Search Console alert: Harmful content - Uncommon Downloads

today Google Search Console show me some alert on my website click on link "Malware detected?" open a page with details: but the list "Sample URLs" is empty and also "Download all samples" download ...
1
vote
1answer
24 views

Separating web domain from email domain - sound security strategy?

A friend's website was recently hacked. (An outsourced project manager wasn't diligent in applying Wordpress security updates.) An unfortunate effect of the hacking is that ISP's are now flagging ...
3
votes
1answer
389 views

rel=“noreferrer noopener” in target=“_blank” external links

In numerous sites I have been reading, they say that you must use rel="noreferrer noopener" when using target="_blank" within external links. I can understand why you should use noopener as a ...
2
votes
1answer
67 views

How to disable .htaccess file using JavaScript?

By the way, the .htaccess was already enabled to my main directory. Is there any way to disable it using JavaScript? to my client-side? I was just curious about how my files are being secured. Thanks ...
0
votes
0answers
15 views

allow users to post url schems that not http/https?

i have a blog comment section where users write their website and a comment about it and it is shown like this <a href="https://example.com">Website</a> <br> <span>my website ...
2
votes
1answer
25 views

Can I see a history of site index from Bing?

I'm at a small internet company that has several apps. Our customers (all businesses) each have their own app-name/customer-name url. Currently, if you request a page preview from Bing's link preview ...
8
votes
4answers
255 views

How should a site respond to automated login attempts with phony usernames?

For the last couple weeks I've been seeing a consistent stream of 15-30 invalid login attempts per hours on my site. Many of them are non-sensical usernames that nobody would ever register for real, ...
0
votes
0answers
25 views

how to get rid of mailicious redirect

I'm in charge of a Wordpress site (currently offline) that's affected by a malicious redirect, i.e. going to that address redirects to a phishing site (curiously though it only happens when getting ...
3
votes
2answers
88 views

What are some things that Webmasters should be preparing for or doing in response to the COVID-19 pandemic?

This is a community wiki intended for our users to be able to share ideas as to what might be helpful to Webmasters during the COVID-19 pandemic. As many of you are aware, there's been a shift all ...
4
votes
3answers
110 views

How Do You Store Website Backups? [closed]

I'm not that great about backing up my site, which is something I want to improve on. Currently, I save backups of my site on my local computer and on an external thumb drive. I was thinking of ...
2
votes
0answers
40 views

Let spambots “successfully” submit form?

I'm about to set up my html forms so spam bots are being caught and rejected. I wonder.. Let's say a spambot submits the form in a way that is not accepted. Should I then let the page with the form ...
1
vote
0answers
25 views

Is it safe if I use the same Google Recaptcha site key and secret key on 2 different servers?

I have 2 servers, staging server and production server. Server staging is used for testing my website. While the production server is for live website Now I use the same site key and secret key for ...
4
votes
3answers
2k views

Making HTML5 videos stored on AWS S3 **difficult** to download (because I cant make it impossible)

I am building a website that hosts video's stored on AWS's S3 service. The videos are played thru a HTML5 player we have built. Ive just been asked to make sure "nobody can steal our video's". Now I ...
3
votes
0answers
24 views

NGINX configuration for the same folder protection rewrites in each of thousands of subdirectories

The following code allows me to protect a specific folder with the membership software we're using. The problem is if we have 1,000 folders we need to protect, we need to copy/paste this same code for ...
1
vote
2answers
83 views

Online Marketing company want me to share my Google Account login details? Is this normal practice?

We are a small business and use "Google Apps for Work" and my google apps account was used to set up the business's "Google My Business" and related Google+ pages We have now engaged an online ...
2
votes
1answer
82 views

New hostile web crawler from China throttling server

My server has been crashes several times the last 24 hours by a new extremely aggressive hostile distributed web crawler. It is hitting over 1000 pages per minute and seems to be crawling all content ...
0
votes
0answers
10 views

How to stop the IP of the server from redirecting to the domain if accessed directly?

So there is a site, that is behind Cloudflare so the IP is protected, but in addition to that, I want to make it so that if you have the IP and type it in the browser, it will not disclose the domain ...
3
votes
2answers
1k views

Is adding Disqus to website safe for user privacy?

Some guides (see gohugo.io or webmasters.stackexchange.com for examples) recommend Disqus as a commenting feature for static sites. Is adding Disqus to a website safe for user privacy? UPD Should I ...
4
votes
1answer
74 views

Does the presence of a flash banner on a site inherently create a vulnerability on the site?

Does the presence of a flash banner inherently open the site up to exploits, or is there a way to ensure the flash banner does not have "access" to anything important on the page. The page in ...
1
vote
0answers
32 views

What does this code do? [closed]

I've been looking at ways to make websites more secure and in particular WordPress site and found a blog post with a few suggestions. Most of them I was already using but found this one with no ...
1
vote
1answer
133 views

Changing name when a domain holder is a citizen of one country; possible problems

I am a citizen of Israel and I desire to generally cut all ties with it besides generally with family, friends and job. Currently I live in another state as a temporary resident. I consider changing ...
1
vote
0answers
290 views

Why are 300+ Huawei bots crawling my forum?

Since a few days ago, I've seen a huge increase in traffic to my forum by guest users, all use the same ip range which traces back to china, Huawei to be more specific. Is there any indication why ...
2
votes
1answer
35 views

Would two factor authentication on my web hosting account protect against email phishing targeting my site?

I was recently attacked on my Bluehost account after clicking on an email that looked like it was from Bluehost (never going to click on another Bluehost email again). While talking to the support ...
2
votes
1answer
85 views

How can I ban mediawiki logins from IPs that persistently fail?

I have a MediaWiki website and someone is trying to login as my WikiSysop user by guessing lots of passwords. What can I do to ban IPs if they exceed a threshold of failed login attempts? (Okay, no-...
42
votes
5answers
8k views

What events caused mass migration to HTTPS?

For several years I see that Google, Facebook, etc start serving (and even redirect to) content via HTTPS. Serving sites that prompts passwords in insecure HTTP was wrong even in 1999 but it ...
2
votes
1answer
66 views

Block/allow access to certain PHP pages

I have a number of PHP scripts that are meant to be included into other PHP scripts, but otherwise should not be directly accessible to anyone via a Web browser. How do I block people from accessing ...
2
votes
1answer
65 views

Best way to handle email address for use with domain registration?

I have registered a domain that I use exclusively for email. In addition to my main email address (foo@example.com), I have companyA@example.com, companyB@example.com, justforfriends@example.com, etc....
2
votes
1answer
119 views

Is it safe to BAN ASN from Hosting providers?

I have some bot problem, i found their ASN and it comes from web hosting providers. Not ISP's. For example: Hetzner: AS24940 Digital Ocean: AS14061 AMAZON-AES: AS14618 Is it safe to ban entire ASN's ...
61
votes
10answers
6k views

Storing credit card details

I need to store credit card numbers for recurring billing through our 3rd party merchant. Are there any standards I need to adhere to regarding the storage of the details? We've been accepting credit ...
2
votes
1answer
1k views

Delete Firefox JavaScript console history?

How do I the clear the command history of Firefox's JavaScript console? Clearing all history, cookies, cache, etc., doesn't clear the JavaScript console history.
3
votes
1answer
45 views

Standard or common way to secure a destination-email-address of a client-side contact-form

I have a website with a minimal, client-side HTML-CSS-JavaScript contact form but I desire to hide the destination email address of that form from the HTML source code so that form users would not be ...
2
votes
1answer
10k views

How to log username in Apache logs?

I need some help regarding how to log the user-name into apache logs. I'm building a use-case for Security Information Event Management. Is the method the same in case of IIS or just applicable to ...
2
votes
0answers
25 views

Impersonation in web contact forms [closed]

Many websites have contact us form usually requiring sender's name and email address. Now assume someone uses the contact form but fills in an email address (a valid address) which does not belong to ...
1
vote
0answers
18 views

few questions about running image hosting website [closed]

I'm about to launch a new image hosting website, nevertheless, few questions are still on my mind and i would love to know your take on them. Q1- how do i prevent users from uploading pornographic ...
4
votes
1answer
63 views

Google Chrome anti-virus checks take too long for downloads from our site. Can it be bypassed or sped up?

I host a windows software website. I noticed that new version of Google Chrome checks downloaded files presumably for viruses and it takes about 10-20 seconds to complete. Is there any way to white ...
1
vote
1answer
36 views

Unusual Web Traffic Submitting Extremely Long URLs

thanks in advance for the help. This isn't my usual job, but our website admin/full stack developer is on leave and my boss has asked me to look into it. Recently we've had a huge spike (talking tens ...
1
vote
3answers
2k views

How to trace origin of script injected in my webpage

I was looking through a static site I created on my local server, in my web browser, and found a curious call to an external script <script src="https://engowe.com/ad.php?u=...
0
votes
2answers
808 views

“only secured content is displayed”

I just had a SSL certificate installed on my drupal site using shared hosting and on the front page it now says "only secured content is displayed" in IE. How do I find which content is NOT secure ...
1
vote
1answer
51 views

Researching .htaccess Syntax

In my template .htaccess file I have been copying and pasteing alot of rules and researching .htaccess for around 2 weeks in an attempt to try and better understand the syntax, different modules & ...
7
votes
3answers
13k views

Do internal intranet websites need to be secure?

The question is in the title. Does an internal site need to have https security? For example we have an internal site that handles our client's license keys -- do we need for that to be secure since ...
1
vote
1answer
16 views

How to resolve a verified property not appearing in the security issues property dropdown?

I have several verified properties across Google Search Console / Google Analytics. Unfortunately, I've recently taken on a client that has been red flagged by Google as a Phishing site (which they ...

1
2 3 4 5
11