Questions tagged [security]

Preventing a system from unauthorized access, modification, disruption, or destruction.

Filter by
Sorted by
Tagged with
2
votes
3answers
152 views

Weird new users in Joomla user group “Administrator”

I noticed today that 30 people or so registered to my Joomla site (I don't expose a registration/login form), most of them appear to be spammers/bots, somehow they must've found a way to register via ...
2
votes
1answer
427 views

Google reports URL injection - but the reported URL returns a 404 even when fetched as Google

Yesterday we found out that in Google Search, the website is reported as "This site may be hacked." It is a Joomla website. In webmasters tools there is a report for URL Injections. There is only ...
2
votes
3answers
2k views

What is the range of IPs that someone with a dynamic IP address can be assigned?

I am working on a security policy and I'm wondering about users who have a dynamic IP address. If their IP address changes frequently, will their ISP reassign them IPs from a limited pool of IPs? i.e....
4
votes
1answer
2k views

Why do many websites block requests from common HTTP libraries by user-agent?

Writing spiders, I have noticed that many sites will return a 403 error if I hit them from popular HTTP software libraries, unless I manually override the default User-Agent header used by the library....
5
votes
3answers
3k views

Is a “Show Password” option on login form safe?

A website I use occasionally has had a recent overhaul and added a "Show" checkbox next to the password field on their login form. I understand why some ppl want these when they're actually typing ...
0
votes
1answer
626 views

How to require user login using htpasswd within the htaccess file?

I'm trying to require users to login and would like to handle the request with htpasswd in the htaccess file: Any ideas on how I can do that?
5
votes
1answer
10k views

What is SymLinksIfOwnerMatch?

What is SymLinksIfOwnerMatch in .htaccess, in layman's terms? I have this option active. Do I need it? I have a plain HTML web site (though might go for Joomla one day). Some sites specify that it ...
2
votes
2answers
60 views

How do I exclude a WordPress site from search engines and make it accessible only via password?

The goal is to have a simple WordPress site for company employees to retrieve information that can be sensitive. The site is supposed to be online so it can be access by me from home, but needs to be ...
1
vote
1answer
64 views

Has my website got a virus?

Building a website for a customer and as I sent him a link on Skype to the new page, he said he got alerted of a trojan virus. He clicked on the link on Skype and it opened in IE, he sent me a ...
5
votes
2answers
113 views

What do I need to do before deleting a domain name?

I've owned a domain name including webhosting for a couple of years. No I don't need the domain anymore. Is there something I should do before deleting the account that includes the domain name, email ...
0
votes
1answer
79 views

WIll a HTTPS page with video player & a video served off HTTP become insecure? [duplicate]

A page is on HTTPS and all content on it is served from HTTPS, however, this page contains a video player, and once user hits a PLAY button in it, it starts playing a video, that is served from HTTP. ...
4
votes
3answers
274 views

Someone trying to attack my Joomla website with many different IP's

I have a serious issue here. Someone is trying Brute force login into my site. I already have plugins to nullify that attack. I give only 3 attempts for login and then it blocks that IP. Problem here ...
2
votes
1answer
124 views

My website URLs have fake search term query strings that are appering in Google search

A few days ago I was informed that my website appears when searching some random terms with a URL that, as far as I know, does not belong to it. My domain: example.com Search terms: "olympic" Result ...
3
votes
1answer
51 views

How can I give my users the proof that their data are encrypted?

I want to implement a feature on my website that will hold private client data. I want to promote this feature, but how can I give my clients a guarantee or proof that their data are encrypted and ...
6
votes
1answer
14k views

restricting Google Maps js API keys to just my domain

My site uses the Google Maps javascript API, so I'm using a "Browser key", which is plainly visible in my javascript to anyone who does "View Source". Google's documentation on Browser keys in ...
1
vote
1answer
891 views

Collect personal data in europe using google forms

Since there have been issues regarding web service providers that store personal/confidential data of users outside of the European Union, I am somewhat precarious. Am I allowed to collect personal ...
1
vote
1answer
16 views

Can browser vulnerabilities effect wesbite security?

Can browser vulnerabilities lead to problems with a website Security? Let's say that I have a website that is globally accessed. Can an old browser having vulnerabilities be trouble for my website ...
0
votes
1answer
130 views

Separate server for images?

Should I be using a separate server for hosting images that are created on a website? For example, my application creates images and currently stores them on the same server. I have around 200k+ ...
5
votes
2answers
111 views

creating an archive/snapshot of a wordpress site — how?

I help to run a 15 year old site which is powered by wordpress (along with various kinds of legacy static content). The site has probably 20,000 wordpress posts. The main site administrator wants to ...
6
votes
1answer
586 views

Block IP requesting xmlrpc.php

We have a firewall with modsecurity installed. I would like to write a rule to block any IP address for 24 hours if that IP requests xmlrpc.php. Please note that we do not use WordPress on our ...
1
vote
0answers
381 views

Is it able to disable secure attribute for Cookie on SSL connection?

There are HTTP and HTTPS page on our site on Apache. So We need to convert from HTTPS to HTTP or from HTTP to HTTPS to prevent from login session cookie fired. I already know that it does not make ...
2
votes
1answer
183 views

Cannot get Content-Security-Policy to work

I'm trying to implement CSP, but cannot make the script-src work correctly. I strongly want to avoid unsafe-inline, but all attempts to circumvent this by using sha256 hashes seem to fail. This is ...
2
votes
1answer
31 views

How to find the folder in a host server with its name starts with a “~”?

For example: http://my-domain/~service In this case, I couldn't find a "~service" folder or file in the server but the url does work, which is very weird.
0
votes
1answer
13 views

how do you handle input sanitization on forms? [closed]

how do you handle input sanitization on forms? do you use javascrpt or just client?
8
votes
1answer
166 views

Someone/something accessed a link in an email, but it was not who the email was sent to

Could anyone solve this mystery? We have an web application that is only available to invited users. Our admin create accounts for users, and then the application sends an activation email to that ...
21
votes
5answers
6k views

How can I tell if my website visitors are using LastPass or other password managers?

I want to make sure visitors to my website have the best experience possible so I want them to be able to use LastPass and other Password Managers. Is there any way of identifying whether or not my ...
4
votes
3answers
103 views

When setting up LAMP for testing at a local machine, how do I make sure it's not remote accessible?

I'm setting up a LAMP stack on my local machine for testing. How do I make sure the web server is not remote accessible?
3
votes
2answers
844 views

How can I avoid being hacked? [closed]

I have a website built on Joomla/PHP and it was going well until I found a RewriteCond directive in my .htaccess file to a website with porn content. RewriteEngine On RewriteCond %{HTTP_ACCEPT} "text/...
2
votes
3answers
392 views

Does using the same mail and web server increases risk of DDos due to IP exposure?

I use the same server for sending my emails and web hosting.I send user registration and support forum mails from my server and occasional marketing mails or newsletters. I read on a cloudflare blog ...
3
votes
2answers
1k views

How to Secure Wordpress website using .htaccess , allowing only index.php execution access

I am responsible for security of lots of shared hosting server. We have at least 500 wordpress website in each server. Some of the website owners keep a weak password for WP admin or use vulnerable ...
0
votes
1answer
62 views

How can I find out if my website is being scraped? And how do I stop it? [duplicate]

Is there a way to identify that someone is scraping my website?
10
votes
8answers
1k views

How to find out the strength of the Wordpress (already stored) password?

I am responsible for security of lots of shared hosting server. Most of them are having WordPress websites. Each server is having at least 500 WordPress websites. In my expereince, the issue with ...
1
vote
2answers
176 views

How to list all URLs in the source code files of a website with command line tools?

I have folder that contains the source code files of a website (tons of html, css and php files). I would like to find an automatic method (preferably with command line tools) to scan this folder ...
4
votes
3answers
4k views

How to determine if a user agent string has proper syntax or might be a hacking attempt?

I was checking my server via awstats to see who was visiting my site and I have a user-agent of the following value: }__test|O:21:\ Some research has lead me to believe that someone was trying to ...
3
votes
1answer
24 views

How to monitor a website's networking activity towards 3rd party servers?

I have a Wordpress site with some plug-ins installed. I would like to check if my site tries to access any 3rd party servers in the background. I'm aware of that I can open any php file on my server ...
6
votes
2answers
722 views

What are the benefits of requiring HTTPS between AWS CloudFront and the origin server?

I am hosting a website on Amazon CloudFront and we've recently updated the distribution to require HTTPS between CloudFront and viewers. With the introduction of AWS Certificate Manager and the ...
7
votes
5answers
1k views

Are indexed Wordpress admin pages a security threat?

Because it was blocking Googlebot from accessing important files, I recently updated our /robots.txt file and removed most of it, including wp-admin. Now, the people on charge of hosting and SEO ...
5
votes
3answers
2k views

How to detect if file with a .png extension contains code or an image?

I was in a trouble last few days since my web host was hacked for POST on PHP files. I've been dealing with files with .png extension that have PHP code inside. I can't even try to edit one-by-one to ...
0
votes
1answer
60 views

Malicious links to our site on Google's SERP redirecting to shady pages

Our website is being attacked in a curious way: on the Search Results Page, Google is showing links that look as if they were to pages on our site but they direct to some shady viagra-selling sites. ...
1
vote
1answer
49 views

.CA Domain registratrs for DNSSEC

We have a .ca (CIRA) domain that currently uses DNSSEC through the ISC DLV registry service. We are aware that DLV is shutting down by 2017. We have communicated with CIRA respecting .ca registrars ...
4
votes
1answer
209 views

Someone else set up a trial Google Apps account on my domain. How can I get Google to disable it?

I own my domain (say, mydomain.com) and administer it through my hosting provider. A couple of days ago, I started receiving mail from Google Apps addressed to jyotioffsetjsm01@mydomain.com. There's ...
1
vote
1answer
514 views

AWS EBS Tomcat instance being hacked [closed]

I'm using AWS EBS instances with tomcat for my java web application. But somehow some guy manages to hack into my instances and all I can see are these processes being ran by tomcat: tomcat 26988 ...
2
votes
1answer
85 views

Allow third party to use domain subdirectory without risk to your server

If you have a live site on example.com, is it possible to allow third-parties to set up their own site at example.com/project1, example.com/project2 etc without subjecting your server to risk? I ...
2
votes
3answers
1k views

Using .htaccess deny returning 302 and not 403 forbidden

I'm in the process of adding yet another layer of security to some of my WordPress installs, since some of my customers sites use shared hosting, and generally they do not ban users for brute force ...
6
votes
3answers
152 views

Will data be encrypted if an HTTP page POSTs to a HTTPS handler that redirects back to HTTP?

My host gave me a subdomain of their domain that has HTTPS: https://mysite.example.com My own domain name has no SSL installed, so the only way I can take advantage of encryption is by using the ...
14
votes
5answers
34k views

HTTPS connection is “not safe” due to images

I am currently working on a website and I have successfully installed my SSL certificate. The GeoTrust SSL/TLS checker confirmed that the certificate chain (including CA) is properly installed. ...
4
votes
3answers
13k views

Suspicious Web Traffic from Amazon.com ISP

Just a few hours back I was checking my logs when I found a whole bunch of traffic from IP address 54.174.xx.xx and ISP Amazon.com (validated from Google analytics). It lasted for an hour and then ...
2
votes
1answer
156 views

What file permissions should I set before I give website project folder to hosting service?

I am using a CMS called Jekyll to build a website. My understanding of jekyll at this point is that it helps me to generate static web pages by providing me a simple boilerplate for a website and ...
4
votes
1answer
160 views

Are Commercial SSL Certificates (key file, and certificate file) portable when migrating between a new and old Apache2 server?

We have an SSL Certificate that's currently on our Apache2 server for transferring traffic over the https protocol. We are migrating away from this server to at another data center with a different ...
1
vote
0answers
37 views

What is infecting these networks between 10/25/15 and 11/1/15?

Just noticed a fancy new graphical threat dashboard in the Google malware scan systems. There seems to be a cleanup then subsequent spike in infected sites across various [less-than-high-quality] ...

1 2
3
4 5
11