Questions tagged [security]

Preventing a system from unauthorized access, modification, disruption, or destruction.

Filter by
Sorted by
Tagged with
8 votes
3 answers
10k views

Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key

Is there a comparison between 4096 Bit RSA-Key and a 2048 Bit RSA-Key? I'd like to know what impact on performance it has, if I'm choosing a 4096-Bit key for ssl-encryption. Is there any info which ...
0 votes
0 answers
19 views

Is it legitimate to sell a service that claims to prevent hackers from stealing domain? [closed]

https://www.godaddy.com/domains/full-domain-privacy-and-protection Prevents hackers from stealing your domain or making any other unauthorized changes Requires your approval via 2-factor ...
1 vote
0 answers
16 views

I change everything but again Instagram knows it's me [closed]

I change my device, my public dynamic IP address, account, username, password, email, browser, app, cookies and everything and again Instagram knows it's me, and my question was do you know that can ...
1 vote
0 answers
21 views

Unwanted ads so on websites seems to be ad malware

Google popup Ads randomly show on two of our websites which are hosted with same hosting provider and possible on same server as its shared hosting. We dont use and kind of ads on our websites Ads ...
4 votes
1 answer
183 views

Should I worry about exposing my server's IP address?

I currently use Cloudflare for DNS, and they advertise that they will hide the IP address of my server if I proxy through them. Should I worry about this since the IP points to a dedicated server (not ...
2 votes
1 answer
39 views

Security headers set in .htaccess not taking effect on WordPress site with Cloudflare

We have a site on WPEngine that uses WP Rocket cache and Cloudflare where I have added security header directives in the .htaccess file, <IfModule mod_headers.c> # X-XSS-Protection ...
3 votes
2 answers
22 views

Rules in .htaccess only if the requested URL is /wp-admin

I want these lines from my .htaccess to execute only if the URL is not /wp-admin: Header add Content-Security-Policy "default-src 'self';" Header add Content-Security-Policy "script-src ...
2 votes
0 answers
33 views

Avoiding Microsoft Edge "isn't commonly downloaded" warning

I have shifted software downloads for our customers to download from our domain instead of Dropbox. Now Microsoft Edge raises the "isn't commonly downloaded" warning. I had this on Chrome ...
0 votes
0 answers
17 views

How to correct company website classification at the database level from companies like Sophos

A Corporate client using web blocker such as Sophos cannot access our company website. Blocker comes back and indicates our site is "Sex Education" however it is mental health education. I ...
0 votes
1 answer
27 views

Malicious activity on website using site's search bar

It started with a few but now the number has increased to more than a hundred. I am seeing strange urls getting hit as errors in my Google search console, not sure how is this being done but someone ...
2 votes
1 answer
30 views

Can I replace rua entry with ruf in DMARC record?

I currently have a DMARC record set up like this: v=DMARC1; p=none; fo=1; rua=mailto:hello@example.com but I am receiving a lot of reports everyday. I would like to only receive failure reports (...
0 votes
0 answers
19 views

Is single-word form submission a known attack?

I have one website that is consistently getting weird form submissions. It's a contact form that captures name, email, subject, and message. Five to ten times per day it gets a submission where all ...
6 votes
1 answer
1k views

Spike in Traffic from "Facebot Twitterbot" user agent

My website, which typically has very low volume, suddenly received a huge spike in traffic all from the same user agent. We were receiving about 3 requests per second for a sustained period of about ...
5 votes
0 answers
216 views

Chrome incorrectly marking our domain without a hyphen as deceptive when we own and use both versions

Chrome has a fairly new "lookalike URL" or "typo squatting" detection feature. The aim is to warn users if they are accidentally going to the wrong URL. We own two sites (made up ...
0 votes
0 answers
143 views

.htaccess security headers for IONOS

I need to implement security headers for a website hosted by IONOS. I've used the following code, which works on sites hosted elsewhere, but not here. <IfModule mod_headers.c> Header set ...
2 votes
1 answer
83 views

As a Webmaster, how are you handling the response to the war in Ukraine in regards to managing your site(s)?

This is a community wiki intended for our users to be able to share ideas as to how Webmasters are managing the response to the war in Ukraine for their site(s). There are no right or wrong answers, ...
2 votes
2 answers
54 views

Do I need a wildcard SSL certificate to secure my website and email subdomains through cPanel?

I have a website and emails through the same hosting provider which I manage through cpanel. At the moment I am using zeroSSL to secure my website (www.example.com), however, this does not support my ...
2 votes
3 answers
2k views

How can I allow robots access to my sitemap, but prevent casual users from accessing it?

I am storing my sitemaps in my web folder. I want web crawlers (Googlebot etc) to be able to access the file, but I don't necessarily want all and sundry to have access to it. For example, this site (...
3 votes
2 answers
291 views

Is there a way of listing files for a directory if it contains index.html?

On my server (over which I have little control), directories are listed by default, so for mysite.com/images I get: Index of /images Parent Directory BirdsAreHere.png CanYouSpot-AdBlank....
2 votes
0 answers
25 views

'[0] appended to multiple URL parameters, is something scanning for vulnerabilities?

I use a WAF that monitors suspicious query string and form POST values. Typical script-kiddie stuff like common SQL injection strings, etc. Over the last several months I've noticed a dramatic uptick ...
2 votes
2 answers
76 views

My website has been cloned without authorization. What can I do?

I have the following problem: I operate an online service and about 2 months ago a Copy Cat clone appeared under a strange domain unknown to me. My portal is simply mirrored/redirected to another ...
3 votes
1 answer
175 views

Site reported as blacklisted by Norton Safe Web, with no reason given. How to resolve?

A WordPress website that I monitor using ManageWP (by running a daily security report) has been reported as blacklisted by Norton. I visited the Norton website to investigate the reason (creating an ...
1 vote
0 answers
8 views

Limiting what affiliate's Google Tag Manager can inject into my site

I am managing a website where we sell products. We have an affiliate program. I want to facilitate the affiliates the tracking for them to optimize the campaigns. Currently we display a different ...
0 votes
0 answers
64 views

How are credentials stored and encrypted in Nexus Repository Manager OSS 2.14?

How does Nexus Repository Manager OSS 2.14 store and encrypt it's user credentials? I couldn’t finy anything in the documentation, knowledge base nor on the web on how credentials (local users) are ...
3 votes
2 answers
572 views

Should rel="noopener" be set on links to external sites even if I own the site?

We've had a policy to always set rel="noopener" for all external links. However is that necessary if the external link is to a site in our own control? Let's say we own both coffee.example....
10 votes
4 answers
4k views

Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?

I'd like to submit my personal site into the Chrome HSTS preload list. The site there says: In order to be included on the HSTS preload list, your site must: Have a valid certificate. ...
3 votes
1 answer
193 views

How do I get my website unblocked in Pakistan?

TL;DR: My website is blocked in Pakistan, how do I get it unblocked? I've had reports that my website QuranX.com is inaccessible from Pakistan. I've had a number of people confirm this. It seems ...
2 votes
1 answer
27 views

Recording / Logging CSP Violations

I am in the process of implementing a CSP policy for a variety of domains and am looking for a method to record/log browser CSP violations encountered by any end user. I want to make sure I don't miss ...
4 votes
1 answer
129 views

How to promote the quality/security of your a website to your its customers?

Our organization is building a Drupal web platform that we aim at reselling as a cloud service. In order to provide our customers with maximum confidence in our solution, we're looking at ways of ...
3 votes
2 answers
1k views

Is adding Disqus to website safe for user privacy?

Some guides (see gohugo.io or webmasters.stackexchange.com for examples) recommend Disqus as a commenting feature for static sites. Is adding Disqus to a website safe for user privacy? UPD Should I ...
0 votes
1 answer
35 views

Restricting access to a website without using sessions or IP whitelisting? [duplicate]

I want to restrict access to a private website that needs to be accessible to multiple people. In the event the website has public and private areas, a login to a user session is the usual solution. ...
3 votes
1 answer
199 views

Flood of GET requests for path /{GUID}/{GUID}/from?get&nocache={/\S{5}/}

This afternoon I got a flood of request (400+ within 10 minutes) to one of my web applications, from the same IP address, for non-existent URI. All of the requests were GET with a path the matches the ...
1 vote
0 answers
37 views

Hosting web site with onion share [closed]

So, i don't use any kind of social media and i decided to make my web site instead of that. This idea is inspired by guy named Luke Smith from youtube and i want to make it to look smiliar to this: ...
1 vote
1 answer
57 views

Is there a reason not to use HTTPS? [closed]

Edit: this question is more complete than mine. I sometimes login to a website that provides both HTTP and HTTPS, even for the login page. Although I use HTTPS to encrypt my credentials, it would be ...
4 votes
2 answers
95 views

Is there any way I can defend against automated file download bots?

My company offers a very specifically tailored Android application to supplement our other software. Since users must have an account in our other software in order to use the Android application, is ...
3 votes
2 answers
224 views

Is it possible for a hacker to point another domain at my domain?

Recently when I search my website on google, I find that another domain's description is identical to my domain. I'm terrified and try to understand the security breaches of my website as much as ...
1 vote
1 answer
30 views

How to securely share a link to a video on my server

I've created a web system for daycares on which the educators can upload videos of the kids, and then share those videos with the parents. Currently the way I'm doing this is very simple. My system ...
1 vote
1 answer
48 views

Making a domain more trustworthy to corporate networks so that it won't be blocked by their filters

I developed a web app for a customer which is made in basic PHP/MySQL, pretty normal site, lighter than WordPress, and when my customer went to his client to sell the app the domain was blocked by the ...
8 votes
3 answers
6k views

Is a "Show Password" option on login form safe?

A website I use occasionally has had a recent overhaul and added a "Show" checkbox next to the password field on their login form. I understand why some ppl want these when they're actually typing ...
7 votes
4 answers
13k views

How To Hide From BuiltWith?

Out of curiosity, does anyone know how builtwith.com works? How does it identify the platform or app a website is using? And most importantly does anyone know how to hide the details from it? Somehow ...
1 vote
0 answers
32 views

Gratis email boxes filter my contact form emails ; local email box doesn't ; but what if I want a domain registrar email box? [closed]

My domain registrar and my hosting provider are not the same company. On my shared hosting environment with CentOS, Bash, Apache, PHP and MySQL I host an all core MediaWiki website with a CMS-agnostic ...
3 votes
2 answers
1k views

Website is under maintenance - how to restrict access?

Currently, my website is under maintenance. I want to be the only person who's able to access/view the website online until I finish maintenance. How to set restrictions to others? I hate stalkers.
3 votes
0 answers
187 views

Cross origin resource policy violation for JS file when setting COEP, COOP and CORP headers

What is the best way to deal with the new security headers? Cross-Origin-Embedder-Policy (COEP) https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy Cross-Origin-...
1 vote
0 answers
32 views

What steps should you take to harden your website against censorship? [closed]

I am thinking about making a website for conservative crowdsourcing. Since AWS has shown they will ban customers, who spent who knows how much time building a platform on their infrastructure, I am ...
9 votes
2 answers
3k views

How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?

I have forms on my in-development website which require the person to enter an e-mail address. I don't want to have to send them a "verification" e-mail with a URL containing a code, or ...
6 votes
5 answers
26k views

What is deleteme.xxxxxxxx.php

I was going through page hit logs on awstats and I noticed the following two entries: /deleteme.lcivykmt.php /deleteme.nctqicjg.php I was wondering if anyone recognised them and whether I should ...
0 votes
1 answer
37 views

Hosting SQL on localhost or remote server?

Years ago I was advised to use two servers for hosting a basic Linux webserver, that it's best to have SQL hosted separately from NGINX or Apache. Personally I prefer MariaDB over MySQL, but I don't ...
3 votes
1 answer
229 views

Hourly connections to my WordPress site via XMLRPC block my IP on BlueHost because they see many email logins

I currently own a WordPress site in a hosting (BlueHost). On the other hand, I have an application in our offices in .Net. This application, updates WordPress via XMLRPC every 1 hour. The problem is ...
1 vote
1 answer
39 views

How does Google Chrome determine a safe and unsafe website?

Google chrome has a way of determining safe and unsafe websites. When it does find an unsafe one, it says that your connection isn't private and that attackers could be on the same website. However, ...
2 votes
5 answers
784 views

How to prevent iframe virus? What are all the measures can be taken once affected by it?

Suddenly, I see some of my blog files(wordpress) contains some <iframe> tags with links to some websites. How does it happen? What do I have to do to remove this virus and clean my website? I ...

1
2 3 4 5
12