Questions tagged [security]

Preventing a system from unauthorized access, modification, disruption, or destruction.

Filter by
Sorted by
Tagged with
4
votes
1answer
5k views

What does this htaccess file do in this configuration?

I've never seen this configuration in .htaccess. This comes from my site that currently reset. I have no SSL certificate installed, but I remember seeing these names on previous certs though. So does ...
2
votes
1answer
65 views

Can a URL that is not linked to from anywhere be discovered?

Let's say I have a URL that is not linked to from anywhere, and let's say the file portion is very long, so that it's unlikely it could be accidentally entered. Something like ...
1
vote
0answers
419 views

Self-hosting and Apache virtual host on a Synology NAS: any security risk?

I have a Synology NAS running an Apache web server with several Virtual Hosts. Currently, each vhost is associated with a different port, and my router is pointing on them individually. I also have a ...
1
vote
1answer
30 views

Are name=value style directories better for security and SEO than directories with values only specified by position?

Consider the following values for a link in my website's homepage: /portal=testportal/page=1/lang=fa /testportal/1/fa Is there any priority between above options? I'm asking from the security point ...
0
votes
1answer
35 views

Help! Bad Code showing on the top of my Website [closed]

The code "*/" is showing at the top of my website. I can't locate where this is coming from and would love to see if someone can assist!
1
vote
0answers
83 views

Receiving SEC_ERROR_UNKNOWN_ISSUER when Attempting To Access Google Analytics [closed]

Whenever I attempt to access Google Analyics, I receive an "Insecure Connection" message. In more detail: analytics.google.com uses an invalid security certificate. The certificate is not trusted ...
2
votes
1answer
677 views

How to restrict web site/intranet access to company network?

What is the best/most secure way to create a web site or intranet on an externally hosted server, but make it only accessible from within my company's network? I am trying to avoid running my own ...
4
votes
2answers
500 views

How do I get Google to mark my website as “safe” in the search results with a small green icon?

Some websites are marked as safe in the Google search results like shown in the image: My website and others are not. How do I get this safe mark for my website?
0
votes
1answer
45 views

Is it illegal to create a website that allow a user to upload a file and make it accessible and downloadable for others? [closed]

I am working on a website in which a user can sign in and upload a file and other users can search for it by name and download it. Those files will be catagorized as audio, video, apps(linux, windows, ...
4
votes
2answers
2k views

What to do about certificates being distrusted by Google Chrome?

Recently Google Chrome started issuing a warning on the console which says: The SSL certificate used to load resources from https://www.example.com will be distrusted in M70. Once distrusted, ...
1
vote
1answer
26 views

Keep order status private from search engines?

I searched hard before posting this question. I apologize if it is a duplicate or if this is not the correct forum. We have a homegrown shopping cart website. We do not require shoppers to register ...
1
vote
0answers
197 views

Odd Apache Request “GET /shell?echo+jaws+123456;cat+/proc/cpuinfo HTTP/1.1”

I've been looking into an issue with my servers, and while looking I found this weird request in the Apache Access Log GET /shell?echo+jaws+123456;cat+/proc/cpuinfo HTTP/1.1. This ended up returning ...
0
votes
1answer
103 views

HTTP webpage is showing “Not Secure” in Chrome

I've called GoDaddy a few different times and they said that it looks like it is a problem with my HTML file. Except, my HTML file is the basic outline of a webpage, nothing fancy at all. Chrome ...
6
votes
4answers
6k views

Does SSL require a client side certificate of any kind at all?

A friend insists it does, that both browser and server both need certificates. I say no, only the server requires one, with two keys. The question is whether the browser uses some sort of certificate (...
1
vote
1answer
69 views

Adding another domain SAN to a shared hosting server's multi-domain SSL certificate?

I am familiar with simple DV certificates, but not any of the other fancier stuff - like EV, wildcard and Multi-domain SSL certs. As the title suggests, I'd like to know what the process is for (and ...
1
vote
0answers
66 views

Are there security concerns with migrating a sub-sub domain to a new platform, leaving another in place, and abandoning a third?

I have been tasked with launching a website for my organization. It is a dept. within a parent organization. Parent Organization Administers domain.com Dept. Organization Administers sub.domain.com ...
9
votes
2answers
4k views

Google Search Console alert: Harmful content - Uncommon Downloads

today Google Search Console show me some alert on my website click on link "Malware detected?" open a page with details: but the list "Sample URLs" is empty and also "Download all samples" download ...
16
votes
7answers
5k views

Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?

One week ago Google sent me an email to go HTTPS. If I won't transfer HTTP to HTTPS then it will show my connection unsecured to all of my site visitors who will try to input text in my site. Without ...
1
vote
1answer
33 views

Can access to Google Analytics with historical data be recovered after losing administrator access?

I have lost my administrative accessibility to my website under User Management in Google Analytics. I have discussed this with my webmaster, but he does not claim responsibility for it nor is he ...
1
vote
2answers
268 views

COMODO SSL Analyzer Error -14

I have a hard time understanding Comodo's SSL Analyser error in some cases. If queried on smtp.tiscali.it:465,it returns the image below: However, if querying in OpenSSL: Or Digicert: It seems ...
1
vote
0answers
16 views

How could viruses/malware launch from websites in user environment? [closed]

I'm familiar with web frontend only superficially. However I'm wondering how is it possible to inject virus on the web site and cause it to run in the user environment (PC) only by visiting specific ...
0
votes
2answers
67 views

People can see my site but I can't, what can be wrong?

I can't see my own site, but other people can. I tried private settings and I don't see firewall. It is so frustrating, it keeps saying: Hmmm...can’t reach this page Try this Make ...
2
votes
1answer
3k views

What does “Require all granted” on Directory / (root) REALY means? (Apache 2.4 on CentOS7

im sure, this question looks really stupid first. but i need a "second opinion" on this, even i did some research on my own but i am still unsure about this. By default the Apache Configuration on ...
4
votes
1answer
78 views

Google wants sites to use SSL, but complains when compression is turned off to prevent BREACH hacks

Google has let it be known that they want websites to move to SSL, and they will start making it more and more clear that HTTP sites are 'insecure'. But then using their PageSpeed tool, they will mark ...
1
vote
1answer
33 views

Reach only one file through :80

I have an owncloud server which is using HTTPS (www/owncloud). I redirected all HTTP request to HTTPS. Now I need to reach one file using HTTP (www/other/directory/file.txt). How can I achive this ...
1
vote
3answers
96 views

Website getting lots of visits from this address?

As the title says one of my clients website getting lots of visit from this domain ? notify.discoverfinancial/notify-Legal_Notice_Splash_Page What this is all about ? Is there any security ...
3
votes
1answer
481 views

Where can I redirect exploit scanning bots?

I get a lot of those exploit scanning bots like the ones looking for a WordPress login (which I don't have) or guessing other exploitable URLs. Where is a sensible place to redirect them to via ....
1
vote
0answers
26 views

Customer's financials compromised - they think it was my site [closed]

Sorry for the title, this is a confusing problem and I wasn't sure how to make the title succinct. The background: I have a client's website which sell products. The purchasing is all done through ...
2
votes
1answer
59 views

Google searched links (to a site I administer) are redirecting users to fake websites

I'm quite stumped here as I am not an expert when it comes to scripts.. Some users, searching for a product which my website provides, get presented with genuine links such as "https://www.brewcraft....
3
votes
2answers
909 views

Is adding Disqus to website safe for user privacy?

Some guides (see gohugo.io or webmasters.stackexchange.com for examples) recommend Disqus as a commenting feature for static sites. Is adding Disqus to a website safe for user privacy? UPD Should I ...
1
vote
1answer
64 views

Wordpress security from bots

One of my clients website is getting massive traffic from China most of which are bots. These bots are hitting the site nonstop causing the VM to use very high cpu and memory. As a result it is ...
4
votes
1answer
93 views

Is it bad practice to change the “From” name when sending emails?

I have an email module that lets users send an email to their city councillor. As of now, the From address of every email sent is My Cool Website <info@mycoolwebsite.ca>. Is it considered ...
1
vote
2answers
66 views

What are the effects of having a “non-secure” warning displayed for our e-commerce site?

For the past couple weeks now we have seen a non-secure warning displayed on our site where the SSL/Security info for a website would normally be displayed (in Chrome). Along with this I have noticed ...
2
votes
1answer
202 views

Does cPanel overwrite passwd, shadow, and group files?

I had the need to use SSH to update the /etc/passwd, /etc/shadow, and /etc/group files in order to add multiple SFTP and SSH users for a single account, which is apparently not supported by cPanel. ...
2
votes
1answer
38 views

Web security features from host provider

I am working with a contractor to get a website built with text, video, facebook and twitter integration. No commercial transaction, just plain information sharing. I want to secure my website and ...
4
votes
1answer
205 views

what cipher suites should I consider on government website

I maintain a website for the government, which is http only. The target audience is all civilian, so the browser client may be very old down to IE6. Recently they request to upgrade the site to https....
1
vote
1answer
80 views

Browsers to accept a self-signed certificate

I have created a self signed certificate like this: #!/bin/bash EXPIRE=3650 if [ $# -gt 1 ]; then EXPIRE=$2 fi mkdir -p $1 cd $1 openssl genrsa 2048 > $1.key openssl req -new -x509 -...
40
votes
5answers
8k views

What events caused mass migration to HTTPS?

For several years I see that Google, Facebook, etc start serving (and even redirect to) content via HTTPS. Serving sites that prompts passwords in insecure HTTP was wrong even in 1999 but it ...
2
votes
0answers
53 views

Amazon EC2 and CA-signed certificate with LAMP stack

I have an EC2 server set up, using the free trial. I have installed my LAMP stack and the docs urge me to get SSL going. Using yum, I installed ssl with the mod24_ssl package. Currently I can put the ...
4
votes
3answers
226 views

My personal website was cloned in its entirety, is this a security concern?

I was googling my (real) name yesterday (which is the name of my site) on a lark and discovered a website that had copied my personal website and its content. Like a carbon copy including links to ...
2
votes
3answers
150 views

Weird new users in Joomla user group “Administrator”

I noticed today that 30 people or so registered to my Joomla site (I don't expose a registration/login form), most of them appear to be spammers/bots, somehow they must've found a way to register via ...
2
votes
1answer
398 views

Google reports URL injection - but the reported URL returns a 404 even when fetched as Google

Yesterday we found out that in Google Search, the website is reported as "This site may be hacked." It is a Joomla website. In webmasters tools there is a report for URL Injections. There is only ...
2
votes
3answers
2k views

What is the range of IPs that someone with a dynamic IP address can be assigned?

I am working on a security policy and I'm wondering about users who have a dynamic IP address. If their IP address changes frequently, will their ISP reassign them IPs from a limited pool of IPs? i.e....
4
votes
1answer
2k views

Why do many websites block requests from common HTTP libraries by user-agent?

Writing spiders, I have noticed that many sites will return a 403 error if I hit them from popular HTTP software libraries, unless I manually override the default User-Agent header used by the library....
5
votes
3answers
3k views

Is a “Show Password” option on login form safe?

A website I use occasionally has had a recent overhaul and added a "Show" checkbox next to the password field on their login form. I understand why some ppl want these when they're actually typing ...
0
votes
1answer
569 views

How to require user login using htpasswd within the htaccess file?

I'm trying to require users to login and would like to handle the request with htpasswd in the htaccess file: Any ideas on how I can do that?
4
votes
1answer
8k views

What is SymLinksIfOwnerMatch?

What is SymLinksIfOwnerMatch in .htaccess, in layman's terms? I have this option active. Do I need it? I have a plain HTML web site (though might go for Joomla one day). Some sites specify that it ...
2
votes
2answers
60 views

How do I exclude a WordPress site from search engines and make it accessible only via password?

The goal is to have a simple WordPress site for company employees to retrieve information that can be sensitive. The site is supposed to be online so it can be access by me from home, but needs to be ...
1
vote
1answer
64 views

Has my website got a virus?

Building a website for a customer and as I sent him a link on Skype to the new page, he said he got alerted of a trojan virus. He clicked on the link on Skype and it opened in IE, he sent me a ...
5
votes
2answers
111 views

What do I need to do before deleting a domain name?

I've owned a domain name including webhosting for a couple of years. No I don't need the domain anymore. Is there something I should do before deleting the account that includes the domain name, email ...