Questions tagged [security]

Preventing a system from unauthorized access, modification, disruption, or destruction.

Filter by
Sorted by
Tagged with
2
votes
1answer
78 views

Suspicious script loads ONLY when navigating to site via search engines

I cannot find anywhere on our site where this code is referenced. More importantly it does not appear when navigating directly to our URL, it only appears when coming from a search engine (including ...
5
votes
1answer
853 views

Google's point of view to SSL - Do I need to force HTTPS protocol for all pages on website

Well now that google clearly declared that SSL would positively affect seo I want to know in which of the following conditions I fully benfit from ssl: 1.If I server https connection for all pages of ...
2
votes
1answer
288 views

How to setup an implicit FTPS encryption on cPanel server?

Currently my server is configured to use TLS encryption for FTP. It is explicit since it uses FTPES and on port 21. How can I switch to implicit FTPS that works on port 990? I'm using Pure_FTPd. I ...
1
vote
0answers
22 views

Secure Badges on Site? [duplicate]

I have a new client whose site I will be re-building. I noticed on his site he has a badge from McAfee saying the site is secure. Below is an example: I have seen similar type badges by other ...
1
vote
0answers
47 views

Security and Apache Methods

I occasionally get annoying POST requests but one lately caused a 500 error. Not a biggie really, but it got me thinking. My site does not have but one form. Outside of this, POST should not exist ...
0
votes
0answers
14 views

WordPress site hacked, recovered but Google still has hacked page description [duplicate]

My website got hacked recently and recovered it. It was populating casino ads on my website. There were virtually made URLs where casino pages were displayed. I suspected the code came through a ...
0
votes
1answer
150 views

Site speed when using ddos protection by cloudflare

I've recently noticed an increase of sites using ddos protection by cloudflare and wondering the effects on both user experience and SEO. I've notice these redirect messages last from anywhere from 2 ...
2
votes
1answer
508 views

Malicious copy of site

After seeing an increase of shady organic keyword results appearing in Google Analytics we identified the referring Hostname. After adding the exit page to hostname we discovered someone cloned our ...
3
votes
1answer
74 views

White labelling with frames and IE

I have a SaaS application that offers some basic white-labelling functionality related to CSS, company logos etc. However, one client now wants to white-label the application with their own URL so ...
1
vote
1answer
1k views

What might happen if I use FTP client without TLS?

For some reason connecting to server using FTP client (eg. filezilla) is not working with TLS encryption enabled. I had to disable it to use FTP. So wondering why is TLS needed in the first place and ...
2
votes
0answers
105 views

mod_ident not to be trusted? [closed]

I'm looking at Apache's mod_ident: http://httpd.apache.org/docs/2.2/mod/mod_ident.html However, on this page it has the following disclaimer: The information should not be trusted in any way except ...
3
votes
1answer
152 views

How can I figure out how a search engine is finding hidden pages?

We have a system hosting many websites for our customers, and inside that system there is a method that non-live customers can view their sites before we turn them on. Say the link is something like ...
1
vote
1answer
162 views

Can hiding site content until JavaScript determines that the site is not framed cause lower Google rankings?

This is the javacript code that I use to prevent clickjacking in my current project. <style id="antiClickjack">body{display:none !important;}</style> <script type="text/javascript">...
3
votes
1answer
262 views

Unknown subdomains pointing to my domain name

About 6 months ago I purchased the domain name example.net. Today I was trying to go to my control panel at example.net/cpanel but accidentally went to cpanel.example.net. I found a completely ...
1
vote
1answer
22 views

Security issues around giving directory link

I have a directory under my public directory that I use for file transfer purposes. I put songs I'm working on here and then send the link to other band members, etc. It's the simplest way I've found ...
3
votes
1answer
457 views

How do I get Windows Server 2012 to prompt me for credentials when I go to a restricted subfolder of my site?

The "Users" group has read access to my entire website so the public can browse my site. Now, I have created an "admin" subfolder which I do not want the public to have access to. So in the ...
3
votes
1answer
112 views

How do I grant security to my site users to be able to upload files in Windows Server 2012

Using Windows Server 2012 and IIS 8, I want my site users to be able to upload pictures and generate eft files and export files etc. All of these tasks require my users to have write permission to ...
0
votes
1answer
55 views

SSL issue with firefox

My website is hosted on hostgator and i have purchased their ssl service. Now when i open my website in chrome then it works fine but when i open it in firefox it gives me error like The ...
0
votes
1answer
47 views

Securing Linux Servers [closed]

I recently started hosting business and have several cPanel VPS and Dedicated Servers. Recently one of my cPanel Server root password was hacked and got back control after lots of trouble. Can any ...
2
votes
2answers
161 views

Incorrect Referring URLs - What can be the cause?

I am running a website with affiliate links . When the visitors of mydomain.com/page.php click on such an affiliate link, they are being sent to a link on a domain owned by the affilate network (...
0
votes
3answers
137 views

Does uploading index.php protect the other files that would normally be visible in that directory?

PHP is a mystery for me. In the FTP main directory of my website, I uploaded 2 files: a.txt and b.txt. If I enter my website address in my browser I can view both a.txt and b.txt. However when I ...
1
vote
1answer
64 views

Is it safe to let anyone add my site in Google Webmaster Tools?

Google Webmaster Tools allows people to verify site ownership through an existence of a special file. What if I were to create a catch-all rule, and let anyone add my site in their Google Webmaster ...
3
votes
2answers
2k views

Website is being targeted by mail bots

have a small website. When I perform a netstat is shows a lot of traffic from .p.mail. I think this is some kind of mail bot, trying to harvest email addresses from my website. How can I prevent this?...
4
votes
2answers
130 views

URL hijacked for spam [closed]

I'm the Webmaster and administrator for a site, built on Drupal 7. I've updated Drupal to the latest version. My issue is that it seems as if someone or somebot is using our url. Has my legitimate ...
0
votes
1answer
34 views

What changes are coming that would reduce the problems assosciated with HTTPS compared to HTTP? [closed]

I have a web site under development. It is used for surveys but there's an advertising component. As it is very new I have used almost all the latest technologies. AngularJS, ASP.NET WebAPI 2 etc. ...
6
votes
1answer
534 views

What's the point of cross-origin resource sharing if there's a bunch of CORS proxies running?

I never really liked the direction CORS (cross-origin resource sharing) is taking. I think there's a misconception how client-server communication should work. The general concept is: User: Hello ...
0
votes
2answers
72 views

Do I need any special permission to have a form that requests a credit card number? Just request, not storing in a database

I'm using PayPal REST API to make calls using credit card numbers. So I have a form that requests credit card number to the users of the site. I could sell or use those credit card numbers that people ...
1
vote
2answers
711 views

What are spiders trying to achieve on my site by fetching lots of non-existant urls such as various versions of phpMyAdmin?

I've recently set up a build server that compiles Java source on Github webhooks. I created a public page for downloading latest .jars with a top level domain and I'm logging requests to it. What are ...
1
vote
2answers
304 views

Private folders which are not indexable

I have a requirement where I need to distribute about 400 copies of a pdf document (about 6 MB) and .pub files, that are personalized for each user. Every user must have access to only his/her set of ...
5
votes
1answer
1k views

How can I protect my PHP source code from a client when installed on a client's server?

I have done a PHP web application and my client request to host it at their server. How can I protect my PHP code so that it will not be viewed, study, or take it for any other usage by my client?
3
votes
1answer
648 views

Why do some Nginx configurations block download agents using Wget?

I noticed that some Nginx configurations block download agents using Wget like this: if ($http_user_agent ~* LWP::Simple|wget) { return 403; } Why block Wget? If I use the above code in my Nginx ...
2
votes
2answers
1k views

How can I prevent Facebook from considering Google drive links unsafe on my website?

On my small website I've recently began using Google Drive as content delivery network. This is to solve resource usage issues with my provider. This worked well, but I'm confused because Facebook ...
1
vote
2answers
477 views

Is there any risk to a network if it allows FTP access to third party websites? [closed]

I was not able to FTP access to my website on my college's network. (The college has a cyberoam-firewalled newtork). It would fail at point when directory listing would show up othewise. I later ...
8
votes
4answers
2k views

Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?

I'd like to submit my personal site into the Chrome HSTS preload list. The site there says: In order to be included on the HSTS preload list, your site must: Have a valid certificate. ...
2
votes
0answers
22 views

Monitor and alert when events have ended [closed]

So I work for a private school, and we have only three I.T. Techs that take care of the entire campus/buildings, as well as the security systems and website. After trying to search google, I haven't ...
1
vote
1answer
115 views

Apache block all requests but my IP using the config file

I'm looking to upload the website that I've developed locally to my remote web server. However, so that I can test that the upload has gone fine and that all the basic security is in place, I want to ...
1
vote
1answer
291 views

Restrict Plesk user for external developer access

We are commissioning an external developer to develop part of our site and he will also need access to a MySQL database attached to the domain but I can't figure out how to create a user that has the ...
1
vote
1answer
96 views

How to set permissions for DooPHP?

I have downloaded and installed DooPHP according the Installation instructions. However, there is no statement on how to set permissions. Also not in INSTALL.TXT which comes with the product. The ...
0
votes
1answer
104 views

Can anyone buy my registered domain?

Is it possible for anyone to buy a domain that I have already registered? I registered a domain through Moniker and it has not expired yet. But it is displaying available through who.is I can not ...
2
votes
1answer
67 views

How risky is putting sensitive files up on webroot?

I understand that having anything sensitive under webroot is not smart; someone may be able to access it via url. However, I do not have a choice with my web host (iPage) as they limit my server space ...
1
vote
3answers
2k views

WordPress XML-RPC attack

Yesterday I suffered a DDoS attack on a WordPress site. I had 21,443 hits with HTTP Status code 404 and a Bandwidth of 711.85 MB. Also, CPU usage went to 100%. Logs show a lot of this entries: ... ...
2
votes
0answers
49 views

I would like to share how I configured my Web server for educational reasons. What are the security risks? [closed]

I just finished setting up a server to run a python pyramid application, and while I did not find any guidance on the Internet that helped me, I feel like I could contribute one myself. I'm ...
1
vote
1answer
211 views

Server flooded with Wordpress login requests. Need advice [closed]

Recently I was looking at the nginx access logs and found on 2 ocassions a large ammount of requests pointed towards my WP login page. There were over 50.000 requests coming from 2 different IP ...
0
votes
1answer
81 views

Does referrer header checking offer any real world security improvement?

At work we use a central portal that provides basic SSO functionality to other applications. In addition to verifying the SSO data sent, all of our existing in-house applications (used by the public) ...
3
votes
3answers
65 views

Web user authentication methods

Is there any method besides using a DB with username and password for authenticating a user?
2
votes
1answer
5k views

Why do I see requests from BOT/0.1 (BOT for JCE) in my server access log and what should I do about them?

My server keeps getting requests with user agent identified as BOT/0.1 (BOT for JCE). The first one arrived 2013-09-14 22:13:17 CEST, the last one yet about three days ago, 2014-08-12 06:05:39 CEST. ...
1
vote
1answer
555 views

My shared hosting account is sending spam emails

My webhost has deactivated my shared hosting account, since it was sending spam emails through my domain. I have all unrouted mail such as mailto:aasdasd@domain.com set to be forwarded to a specific ...
11
votes
3answers
5k views

Are there any disadvantages to Cloudflare’s “Flexible SSL”?

Cloudflare lets you serve your site over SSL without having to purchase and install a security certificate, a product they call “Flexible SSL”. (They act as a proxy and serve your site over SSL from ...
1
vote
1answer
82 views

How much text does the average person generate per day?

I'm figuring out how to do comment rate limiting, and have decided that I'll keep track of the number of bytes each user (defined as IP address + port) generates on my drive (so, each comment adds a ...
1
vote
2answers
842 views

How do I prevent access to SPAM URLs and remove them from Google's index?

When I started managing my friends' website, I had found a folder in it with a bunch of garbage HTML files with names such as: free-nasscamd-server-31day, gorilla-quentin-trollip-pdf, etc... Assuming ...