Questions tagged [security]

Preventing a system from unauthorized access, modification, disruption, or destruction.

Filter by
Sorted by
Tagged with
0
votes
0answers
13 views

How much is obfuscated when using a web proxy? [closed]

Wben using an online proxy like Kproxy.com, is anything besides one's IP changed -- browser, add-ons, OS, etc.?
1
vote
1answer
114 views

Changing name when a domain holder is a citizen of one country; possible problems

I am a citizen of Israel and I desire to generally cut all ties with it besides generally with family, friends and job. Currently I live in another state as a temporary resident. I consider changing ...
2
votes
1answer
23 views

Would two factor authentication on my web hosting account protect against email phishing targeting my site?

I was recently attacked on my Bluehost account after clicking on an email that looked like it was from Bluehost (never going to click on another Bluehost email again). While talking to the support ...
2
votes
7answers
2k views

WordPress keeps redirecting my users to install.php, Is it caused by an injection hack?

I don't really know how to express my problem, so bear with me. This is a bit hard to explain. I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the /wp-...
2
votes
1answer
43 views

How can I ban mediawiki logins from IPs that persistently fail?

I have a MediaWiki website and someone is trying to login as my WikiSysop user by guessing lots of passwords. What can I do to ban IPs if they exceed a threshold of failed login attempts? (Okay, no-...
40
votes
5answers
8k views

What events caused mass migration to HTTPS?

For several years I see that Google, Facebook, etc start serving (and even redirect to) content via HTTPS. Serving sites that prompts passwords in insecure HTTP was wrong even in 1999 but it ...
2
votes
1answer
56 views

Block/allow access to certain PHP pages

I have a number of PHP scripts that are meant to be included into other PHP scripts, but otherwise should not be directly accessible to anyone via a Web browser. How do I block people from accessing ...
2
votes
1answer
47 views

Best way to handle email address for use with domain registration?

I have registered a domain that I use exclusively for email. In addition to my main email address (foo@example.com), I have companyA@example.com, companyB@example.com, justforfriends@example.com, etc....
2
votes
1answer
26 views

Is it safe to BAN ASN from Hosting providers?

I have some bot problem, i found their ASN and it comes from web hosting providers. Not ISP's. For example: Hetzner: AS24940 Digital Ocean: AS14061 AMAZON-AES: AS14618 Is it safe to ban entire ASN's ...
60
votes
10answers
6k views

Storing credit card details

I need to store credit card numbers for recurring billing through our 3rd party merchant. Are there any standards I need to adhere to regarding the storage of the details? We've been accepting credit ...
1
vote
1answer
31 views

Delete Firefox JavaScript console history?

How do I the clear the command history of Firefox's JavaScript console? Clearing all history, cookies, cache, etc., doesn't clear the JavaScript console history.
3
votes
1answer
45 views

Standard or common way to secure a destination-email-address of a client-side contact-form

I have a website with a minimal, client-side HTML-CSS-JavaScript contact form but I desire to hide the destination email address of that form from the HTML source code so that form users would not be ...
2
votes
1answer
9k views

How to log username in Apache logs?

I need some help regarding how to log the user-name into apache logs. I'm building a use-case for Security Information Event Management. Is the method the same in case of IIS or just applicable to ...
1
vote
0answers
43 views

Why are 300+ Huawei bots crawling my forum?

Since a few days ago, I've seen a huge increase in traffic to my forum by guest users, all use the same ip range which traces back to china, Huawei to be more specific. Is there any indication why ...
2
votes
0answers
24 views

Impersonation in web contact forms [closed]

Many websites have contact us form usually requiring sender's name and email address. Now assume someone uses the contact form but fills in an email address (a valid address) which does not belong to ...
1
vote
0answers
18 views

few questions about running image hosting website [closed]

I'm about to launch a new image hosting website, nevertheless, few questions are still on my mind and i would love to know your take on them. Q1- how do i prevent users from uploading pornographic ...
4
votes
1answer
49 views

Google Chrome anti-virus checks take too long for downloads from our site. Can it be bypassed or sped up?

I host a windows software website. I noticed that new version of Google Chrome checks downloaded files presumably for viruses and it takes about 10-20 seconds to complete. Is there any way to white ...
1
vote
1answer
31 views

Unusual Web Traffic Submitting Extremely Long URLs

thanks in advance for the help. This isn't my usual job, but our website admin/full stack developer is on leave and my boss has asked me to look into it. Recently we've had a huge spike (talking tens ...
0
votes
3answers
2k views

How to trace origin of script injected in my webpage

I was looking through a static site I created on my local server, in my web browser, and found a curious call to an external script <script src="https://engowe.com/ad.php?u=...
0
votes
2answers
801 views

“only secured content is displayed”

I just had a SSL certificate installed on my drupal site using shared hosting and on the front page it now says "only secured content is displayed" in IE. How do I find which content is NOT secure ...
1
vote
1answer
46 views

Researching .htaccess Syntax

In my template .htaccess file I have been copying and pasteing alot of rules and researching .htaccess for around 2 weeks in an attempt to try and better understand the syntax, different modules & ...
7
votes
3answers
11k views

Do internal intranet websites need to be secure?

The question is in the title. Does an internal site need to have https security? For example we have an internal site that handles our client's license keys -- do we need for that to be secure since ...
1
vote
1answer
16 views

How to resolve a verified property not appearing in the security issues property dropdown?

I have several verified properties across Google Search Console / Google Analytics. Unfortunately, I've recently taken on a client that has been red flagged by Google as a Phishing site (which they ...
2
votes
4answers
312 views

Secure way to share unfinished web-page with a customer?

What are the options to share unfinished web-page with a customer without allowing third-party to see the work in progress when developer has control over the web-server? I could come up with ...
4
votes
2answers
559 views

How to use the private and public keys?

I am new to ssl certificates, i wanted to learn about ssl certificates, and I generated private and public keys myself while logged into cpanel, I wonder how to use those and generate a secured ...
2
votes
1answer
68 views

Will adding a random letter to the end of the URL prevent content from being scraped and stolen while allowing SEO?

I have built a website which is a directory of venues / places in a country and client has asked me to make URLs more SEO friendly. There has been some misunderstanding in communication and I have ...
0
votes
2answers
63 views

Do browser developer tools expose your PHP code?

Browser "development tools" are a great way to learn from others, but are they a security risk? I'm working on a project using PHP. My understanding is that PHP code is hidden. So, someone calling for ...
1
vote
2answers
34 views

Can I restrict access to certain areas of my site using the user's access to restricted areas of another site?

I'd like to restrict access to certain areas of my site (site X) based on whether or not the user has access to certain restricted areas of another site (site Y), which is not under my control. To be ...
2
votes
0answers
127 views

rel=“noreferrer noopener” in target=“_blank” external links

In numerous sites I have been reading, they say that you must use rel="noreferrer noopener" when using target="_blank" within external links. I can understand why you should use noopener as a ...
0
votes
2answers
37 views

Is using SiteGround CPanel over http secure?

I have a website hosted on SiteGround. Their CPanel can be served via http or https ( http://cpanel.us261.siteground.us/login/ ). In my case it is not working via https; the support says it's because ...
1
vote
2answers
50 views

Wordpress targeted by attacker, how to install in that situation?

I have my wordpress installed in my purchased hosting company. I see from my security plugin that the attacker changes IP and installs malware such as WP-vcd, and changing the themes such as wordpress ...
5
votes
5answers
12k views

prevent IIS from executing scripts in a specific directory

I have a php web application that allows file uploads to a specific directory. I would like to prevent the execution of any file that is uploaded into that directory whether it is ASP, PHP, or ...
0
votes
0answers
39 views

Invalid traffic coming from Sogou

I have not indexed my website in Sogou. I have only very less visitors. But i am getting traffic from Sogou daily. The search keyword is "site:mywebsitename" and is from China. Just visiting main page....
2
votes
1answer
156 views

Firebase and Godaddy: Hosting redirection to www doesn't work for https

I have a website whose domain name is example.com from GoDaddy and my SSL certificate and hosting is on firebase. Currently www.example.com forwards properly to https://www.example.com but https://...
1
vote
1answer
33 views

Is it insecure to have your Google Analytics tag visible publicly?

I just started adding Google Analytics to my GitHub Pages site, which calls for putting it in the _config.yml file. Is it insecure to keep the _config.yml file in my public GitHub repository, or is it ...
0
votes
1answer
29 views

What is page hijacking?

I tried to read here, for example, but I misunderstand what is Page Hijacking. I saw we don't have a session on this. What is page hijacking?
3
votes
1answer
132 views

Alexa-rank complaining about insecure generator meta-tag

The Alexa-rank auditing tool is complaining about a generator meta-tag that is according to the HTML5 standard: <meta name="generator" content="Company Name"> The Alexa Site Audit Report ...
1
vote
0answers
16 views

Best resources for learning how to prevent malicious usage? [closed]

I'd like to work on creating a public website, but I'm concerned about the potential for it to be the target of some attack. I'm aware of some of the more common attacks like XSS, query injection, ...
2
votes
1answer
16k views

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request

I have a joomla website installed and working good. i installed Qlue404 component which redirects 404 page to a custom page., sometimes when i try the symbols ' and some others the 404 page appears ...
2
votes
1answer
3k views

What does “Require all granted” on Directory / (root) REALY means? (Apache 2.4 on CentOS7

im sure, this question looks really stupid first. but i need a "second opinion" on this, even i did some research on my own but i am still unsure about this. By default the Apache Configuration on ...
1
vote
2answers
53 views

Block any other domains from using my server

Someone has set their domain to use my server. It's not a mirror, the database and everything works and updates with mine. He's basically stealing my content, and he's showing up on google instead of ...
6
votes
4answers
6k views

Does SSL require a client side certificate of any kind at all?

A friend insists it does, that both browser and server both need certificates. I say no, only the server requires one, with two keys. The question is whether the browser uses some sort of certificate (...
4
votes
3answers
12k views

Suspicious Web Traffic from Amazon.com ISP

Just a few hours back I was checking my logs when I found a whole bunch of traffic from IP address 54.174.xx.xx and ISP Amazon.com (validated from Google analytics). It lasted for an hour and then ...
9
votes
2answers
4k views

Google Search Console alert: Harmful content - Uncommon Downloads

today Google Search Console show me some alert on my website click on link "Malware detected?" open a page with details: but the list "Sample URLs" is empty and also "Download all samples" download ...
3
votes
1answer
48 views

How do I get my website unblocked in Pakistan?

TL;DR: My website is blocked in Pakistan, how do I get it unblocked? I've had reports that my website QuranX.com is inaccessible from Pakistan. I've had a number of people confirm this. It seems ...
0
votes
2answers
131 views

Unable to find cause why Joomla website blacklisted by Google (Deceptive site ahead)

We developed a new website for our company. The old website work on Joomla 2.5, for example https://www.company.com. Page www.company.com/administrator closed by password via .htaccess The new ...
0
votes
2answers
621 views

How can we obfuscate or hide our Struts2 web application code when it is hosted with another company?

I have a web application written in the Struts2 framework. I want to host the application with another company. Is there any way to hide the code which is hosted on the server? What I want is to ...
2
votes
5answers
6k views

How to prevent Google from finding my admin index page?

I am running a website but for some days i stopped it and put the under-construction page because the Index of admin page is visible to the outside world through the Google search. One of my friend ...
16
votes
7answers
6k views

Are “trustmarks” such as McAfee Secure worth the cost?

There are a number of services that will scan a website for vulnerabilities and allow the display of a trustmark image if the site passes their tests. This allegedly increases the level of trust a ...
6
votes
1answer
568 views

What's the point of cross-origin resource sharing if there's a bunch of CORS proxies running?

I never really liked the direction CORS (cross-origin resource sharing) is taking. I think there's a misconception how client-server communication should work. The general concept is: User: Hello ...