Questions tagged [security]

Preventing a system from unauthorized access, modification, disruption, or destruction.

Filter by
Sorted by
Tagged with
1
vote
0answers
192 views

Odd Apache Request “GET /shell?echo+jaws+123456;cat+/proc/cpuinfo HTTP/1.1”

I've been looking into an issue with my servers, and while looking I found this weird request in the Apache Access Log GET /shell?echo+jaws+123456;cat+/proc/cpuinfo HTTP/1.1. This ended up returning ...
0
votes
1answer
95 views

HTTP webpage is showing “Not Secure” in Chrome

I've called GoDaddy a few different times and they said that it looks like it is a problem with my HTML file. Except, my HTML file is the basic outline of a webpage, nothing fancy at all. Chrome ...
6
votes
4answers
5k views

Does SSL require a client side certificate of any kind at all?

A friend insists it does, that both browser and server both need certificates. I say no, only the server requires one, with two keys. The question is whether the browser uses some sort of certificate (...
1
vote
1answer
67 views

Adding another domain SAN to a shared hosting server's multi-domain SSL certificate?

I am familiar with simple DV certificates, but not any of the other fancier stuff - like EV, wildcard and Multi-domain SSL certs. As the title suggests, I'd like to know what the process is for (and ...
1
vote
0answers
66 views

Are there security concerns with migrating a sub-sub domain to a new platform, leaving another in place, and abandoning a third?

I have been tasked with launching a website for my organization. It is a dept. within a parent organization. Parent Organization Administers domain.com Dept. Organization Administers sub.domain.com ...
8
votes
2answers
4k views

Google Search Console alert: Harmful content - Uncommon Downloads

today Google Search Console show me some alert on my website click on link "Malware detected?" open a page with details: but the list "Sample URLs" is empty and also "Download all samples" download ...
16
votes
7answers
5k views

Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?

One week ago Google sent me an email to go HTTPS. If I won't transfer HTTP to HTTPS then it will show my connection unsecured to all of my site visitors who will try to input text in my site. Without ...
1
vote
1answer
32 views

Can access to Google Analytics with historical data be recovered after losing administrator access?

I have lost my administrative accessibility to my website under User Management in Google Analytics. I have discussed this with my webmaster, but he does not claim responsibility for it nor is he ...
1
vote
2answers
230 views

COMODO SSL Analyzer Error -14

I have a hard time understanding Comodo's SSL Analyser error in some cases. If queried on smtp.tiscali.it:465,it returns the image below: However, if querying in OpenSSL: Or Digicert: It seems ...
1
vote
0answers
16 views

How could viruses/malware launch from websites in user environment? [closed]

I'm familiar with web frontend only superficially. However I'm wondering how is it possible to inject virus on the web site and cause it to run in the user environment (PC) only by visiting specific ...
0
votes
2answers
67 views

People can see my site but I can't, what can be wrong?

I can't see my own site, but other people can. I tried private settings and I don't see firewall. It is so frustrating, it keeps saying: Hmmm...can’t reach this page Try this Make ...
2
votes
1answer
3k views

What does “Require all granted” on Directory / (root) REALY means? (Apache 2.4 on CentOS7

im sure, this question looks really stupid first. but i need a "second opinion" on this, even i did some research on my own but i am still unsure about this. By default the Apache Configuration on ...
4
votes
1answer
76 views

Google wants sites to use SSL, but complains when compression is turned off to prevent BREACH hacks

Google has let it be known that they want websites to move to SSL, and they will start making it more and more clear that HTTP sites are 'insecure'. But then using their PageSpeed tool, they will mark ...
1
vote
1answer
33 views

Reach only one file through :80

I have an owncloud server which is using HTTPS (www/owncloud). I redirected all HTTP request to HTTPS. Now I need to reach one file using HTTP (www/other/directory/file.txt). How can I achive this ...
1
vote
3answers
96 views

Website getting lots of visits from this address?

As the title says one of my clients website getting lots of visit from this domain ? notify.discoverfinancial/notify-Legal_Notice_Splash_Page What this is all about ? Is there any security ...
2
votes
1answer
438 views

Where can I redirect exploit scanning bots?

I get a lot of those exploit scanning bots like the ones looking for a WordPress login (which I don't have) or guessing other exploitable URLs. Where is a sensible place to redirect them to via ....
1
vote
0answers
26 views

Customer's financials compromised - they think it was my site [closed]

Sorry for the title, this is a confusing problem and I wasn't sure how to make the title succinct. The background: I have a client's website which sell products. The purchasing is all done through ...
2
votes
1answer
56 views

Google searched links (to a site I administer) are redirecting users to fake websites

I'm quite stumped here as I am not an expert when it comes to scripts.. Some users, searching for a product which my website provides, get presented with genuine links such as "https://www.brewcraft....
3
votes
2answers
860 views

Is adding Disqus to website safe for user privacy?

Some guides (see gohugo.io or webmasters.stackexchange.com for examples) recommend Disqus as a commenting feature for static sites. Is adding Disqus to a website safe for user privacy? UPD Should I ...
1
vote
1answer
64 views

Wordpress security from bots

One of my clients website is getting massive traffic from China most of which are bots. These bots are hitting the site nonstop causing the VM to use very high cpu and memory. As a result it is ...
4
votes
1answer
91 views

Is it bad practice to change the “From” name when sending emails?

I have an email module that lets users send an email to their city councillor. As of now, the From address of every email sent is My Cool Website <info@mycoolwebsite.ca>. Is it considered ...
1
vote
2answers
61 views

What are the effects of having a “non-secure” warning displayed for our e-commerce site?

For the past couple weeks now we have seen a non-secure warning displayed on our site where the SSL/Security info for a website would normally be displayed (in Chrome). Along with this I have noticed ...
2
votes
1answer
178 views

Does cPanel overwrite passwd, shadow, and group files?

I had the need to use SSH to update the /etc/passwd, /etc/shadow, and /etc/group files in order to add multiple SFTP and SSH users for a single account, which is apparently not supported by cPanel. ...
2
votes
1answer
37 views

Web security features from host provider

I am working with a contractor to get a website built with text, video, facebook and twitter integration. No commercial transaction, just plain information sharing. I want to secure my website and ...
4
votes
1answer
205 views

what cipher suites should I consider on government website

I maintain a website for the government, which is http only. The target audience is all civilian, so the browser client may be very old down to IE6. Recently they request to upgrade the site to https....
1
vote
1answer
79 views

Browsers to accept a self-signed certificate

I have created a self signed certificate like this: #!/bin/bash EXPIRE=3650 if [ $# -gt 1 ]; then EXPIRE=$2 fi mkdir -p $1 cd $1 openssl genrsa 2048 > $1.key openssl req -new -x509 -...
40
votes
5answers
8k views

What events caused mass migration to HTTPS?

For several years I see that Google, Facebook, etc start serving (and even redirect to) content via HTTPS. Serving sites that prompts passwords in insecure HTTP was wrong even in 1999 but it ...
2
votes
0answers
53 views

Amazon EC2 and CA-signed certificate with LAMP stack

I have an EC2 server set up, using the free trial. I have installed my LAMP stack and the docs urge me to get SSL going. Using yum, I installed ssl with the mod24_ssl package. Currently I can put the ...
4
votes
3answers
224 views

My personal website was cloned in its entirety, is this a security concern?

I was googling my (real) name yesterday (which is the name of my site) on a lark and discovered a website that had copied my personal website and its content. Like a carbon copy including links to ...
2
votes
3answers
145 views

Weird new users in Joomla user group “Administrator”

I noticed today that 30 people or so registered to my Joomla site (I don't expose a registration/login form), most of them appear to be spammers/bots, somehow they must've found a way to register via ...
2
votes
1answer
381 views

Google reports URL injection - but the reported URL returns a 404 even when fetched as Google

Yesterday we found out that in Google Search, the website is reported as "This site may be hacked." It is a Joomla website. In webmasters tools there is a report for URL Injections. There is only ...
2
votes
3answers
2k views

What is the range of IPs that someone with a dynamic IP address can be assigned?

I am working on a security policy and I'm wondering about users who have a dynamic IP address. If their IP address changes frequently, will their ISP reassign them IPs from a limited pool of IPs? i.e....
4
votes
1answer
1k views

Why do many websites block requests from common HTTP libraries by user-agent?

Writing spiders, I have noticed that many sites will return a 403 error if I hit them from popular HTTP software libraries, unless I manually override the default User-Agent header used by the library....
5
votes
3answers
3k views

Is a “Show Password” option on login form safe?

A website I use occasionally has had a recent overhaul and added a "Show" checkbox next to the password field on their login form. I understand why some ppl want these when they're actually typing ...
0
votes
1answer
508 views

How to require user login using htpasswd within the htaccess file?

I'm trying to require users to login and would like to handle the request with htpasswd in the htaccess file: Any ideas on how I can do that?
4
votes
1answer
8k views

What is SymLinksIfOwnerMatch?

What is SymLinksIfOwnerMatch in .htaccess, in layman's terms? I have this option active. Do I need it? I have a plain HTML web site (though might go for Joomla one day). Some sites specify that it ...
2
votes
2answers
59 views

How do I exclude a WordPress site from search engines and make it accessible only via password?

The goal is to have a simple WordPress site for company employees to retrieve information that can be sensitive. The site is supposed to be online so it can be access by me from home, but needs to be ...
1
vote
1answer
60 views

Has my website got a virus?

Building a website for a customer and as I sent him a link on Skype to the new page, he said he got alerted of a trojan virus. He clicked on the link on Skype and it opened in IE, he sent me a ...
5
votes
2answers
108 views

What do I need to do before deleting a domain name?

I've owned a domain name including webhosting for a couple of years. No I don't need the domain anymore. Is there something I should do before deleting the account that includes the domain name, email ...
0
votes
1answer
78 views

WIll a HTTPS page with video player & a video served off HTTP become insecure? [duplicate]

A page is on HTTPS and all content on it is served from HTTPS, however, this page contains a video player, and once user hits a PLAY button in it, it starts playing a video, that is served from HTTP. ...
4
votes
3answers
268 views

Someone trying to attack my Joomla website with many different IP's

I have a serious issue here. Someone is trying Brute force login into my site. I already have plugins to nullify that attack. I give only 3 attempts for login and then it blocks that IP. Problem here ...
2
votes
1answer
109 views

My website URLs have fake search term query strings that are appering in Google search

A few days ago I was informed that my website appears when searching some random terms with a URL that, as far as I know, does not belong to it. My domain: example.com Search terms: "olympic" Result ...
3
votes
1answer
51 views

How can I give my users the proof that their data are encrypted?

I want to implement a feature on my website that will hold private client data. I want to promote this feature, but how can I give my clients a guarantee or proof that their data are encrypted and ...
6
votes
1answer
12k views

restricting Google Maps js API keys to just my domain

My site uses the Google Maps javascript API, so I'm using a "Browser key", which is plainly visible in my javascript to anyone who does "View Source". Google's documentation on Browser keys in ...
1
vote
1answer
753 views

Collect personal data in europe using google forms

Since there have been issues regarding web service providers that store personal/confidential data of users outside of the European Union, I am somewhat precarious. Am I allowed to collect personal ...
1
vote
1answer
16 views

Can browser vulnerabilities effect wesbite security?

Can browser vulnerabilities lead to problems with a website Security? Let's say that I have a website that is globally accessed. Can an old browser having vulnerabilities be trouble for my website ...
0
votes
1answer
81 views

Separate server for images?

Should I be using a separate server for hosting images that are created on a website? For example, my application creates images and currently stores them on the same server. I have around 200k+ ...
5
votes
2answers
107 views

creating an archive/snapshot of a wordpress site — how?

I help to run a 15 year old site which is powered by wordpress (along with various kinds of legacy static content). The site has probably 20,000 wordpress posts. The main site administrator wants to ...
6
votes
1answer
464 views

Block IP requesting xmlrpc.php

We have a firewall with modsecurity installed. I would like to write a rule to block any IP address for 24 hours if that IP requests xmlrpc.php. Please note that we do not use WordPress on our ...
1
vote
0answers
328 views

Is it able to disable secure attribute for Cookie on SSL connection?

There are HTTP and HTTPS page on our site on Apache. So We need to convert from HTTPS to HTTP or from HTTP to HTTPS to prevent from login session cookie fired. I already know that it does not make ...