10

Googlebot will be able to crawl your site fully because it never sends any cookies. There is, however, something else you need to do. Google expects sites to implement limits on the amount of content that users can view per month. Google has a policy about allowing sites in the search results even though they are limited. They call this policy flexible ...


9

The best description of an API key I can find comes from this article from Apipheny: When dealing with APIs, you may encounter something called an API key. They’re sort of like passwords which let APIs confirm your identity. Once an API knows you’re legitimate, you can get through and use the API’s full set of features. Example of an API key: 1f9ba190-c513-...


7

Although the question is 2 years old, I would like to keep on answering to it. The page linked by the accepted answer (https://www.nginx.com/resources/wiki/modules/auth_digest/) is 11 years old and states itself that "... (it) is in need of broader testing before it can be considered secure enough for use in production." A GitHub page (https://github.com/...


6

All browsers use heuristics for knowing when to save passwords. I'm familiar with Firefox and Chrome. The heuristic they use seems to be: The form must have a password field The text input just before the password field is assumed to be the user name Only those two input fields are saved. Firefox then prompts you that it can remember your changed ...


5

NGINX has a digest authentication module: https://www.nginx.com/resources/wiki/modules/auth_digest/ Unlike basic authentication, digest authentication does not send user names and passwords in plain text over the internet. If your site is SSL only, then basic authentication is probably fine. the SSL encrypts the entire session including the user names and ...


5

API keys are a lot like passwords: They are secrets that allow access. There are however a few differences: Passwords are for humans, API keys are for automated access with programs or scripts. Passwords are usually short and simple enough to be memorable. API keys are designed to be used by computers and as such are usually significantly longer, more ...


4

Along the same lines as the other answers... by requesting an item of personal information that is difficult to repeat (many times). What about a (mobile) phone number? A code is text'd to this number for the user to be able to authenticate the first time (or multiple times)?


4

While it may be a turn off in some regions (due to Credit Cards being mvoe popular among the clients), on some sites it does work: require valid credit card details for a free trial. Once the customer enters the details, mark the name on the card as "used" in your application. This will prevent same user subscribing multiple times with different credit cards ...


4

Google's John Mueller says: HTTPS-only sites are fine, there's absolutely no need to shy away from that if you implement it properly. There's certainly no penalty involved with running your site on HTTPS-only when done right. A few of the things that come to mind are (definitely incomplete, just from the top of my head): don't forget the HTTP->...


4

You're on the right track with CURL. What you need to do is add code that reads the website as if it's a basic HTML file then process the file replacing certain HTML code. If some websites are basic with little to no javascript and contain a login box, then look for code containing something like: <input type="text" name="username"> and replace it (...


4

Google has a feature in webmaster tools where you can add login information if you want Google to crawl content behind a user login form. If you have provided Google this information in the past and have not changed the login information since then Google will have access to the content accessible to the login information you provided to it. Google does not ...


4

In short: it's very unlikely you'd see a negative SEO impact, but it still might not be a good idea. Google doesn't currently impose penalties, manual or algorithmic, for showing user details without authentication. The do punish "cloaking" (i.e. showing different content to Google than to a human user), but what you're proposing would not, in practice, be ...


4

In Google, you can have the best of both worlds by using First Click Free. In short, this means that: [the] article can be seen without subscribing, [and] any further clicks on the article page will prompt the user to log in or subscribe to the news site. […] It allows Googlebot to fully index your content, which can improve the likelihood of users ...


4

As an end user, the simple answer to this is "just don't allow the banner to run." The term "banner" suggests to me that the applet is nonessential, i.e. blocking it wouldn't prevent the page from working. As a webmaster, the obvious answer is to just accept that Flash is dead and remove the applet, as 90% of your users are not going to see it anyways ...


4

I will use cookie to track this... If you are using cookies to track whether unsigned-in users have reached their page-view limit then there is nothing extra you need to do to allow Googlebot unrestricted access, since Googlebot does not send cookies.


4

The term "API key" is overloaded for two very different meanings. In your case, it's not entirely clear, but from when one website's API logins to another website's API automatically (emphasis mine) I gather that you're talking about logging in from the server side, in which case Maximillian's and Stephen's answers are right. However there's also ...


3

What you do is not a good idea and can be penalized as cloaking. Till 1st October 2017 the best practice was the First Click Free as mentioned in a previous answer. However since October 2017 this has changed. Now google uses Flexible Sampling for paywalled or otherwise not freely available content. Basically Google lets the publishers decide how much ...


3

If you want to give Google access to restricted content, you can use First Click Free by Google. First Click Free is designed to protect your content while allowing you to include it Google's search index. To implement First Click Free, you must allow all users who find your page through Google search to see the full text of the document that the ...


3

Facebook give you 2 options for verification. Verify via SMS or adding a credit card https://www.facebook.com/help/167551763306531 (The option 2 on that page gives a link where to add your card for verification) Failing both of them, you might be able to get a VOIP/virtual number which might forward the SMS/call to your own phone.


3

As of August 2014 Google has officially indicated that HTTPS will be used as a ranking signal. This means that even if your website is a completely static website, if you care about SEO you should at least consider setting up an SSL certificate. Of course HTTPS is just one ranking signal out of hundreds, so there are probably more important things you can ...


3

TL;DR On Client side: open configuration file /etc/ssh/ssh_config; here look for PreferredAuthentications; make sure password comes after publickey and not viceversa In my case password was written before publickey, so ssh would prompt me for password even though I had copied my pub_key onto server. This problem can be found out easily using verbose: ...


3

Keep the login page tracking, you can use it in multiple ways - You can look at how many people are dropping if their login fails You can setup a Register Now CTA and check how many folks sign-up from the login page Upon submitting the login details, you can mark which user is signing in and track user-wise activity tied to your registered users within GA (...


3

If you don't track the login page there would be no way to know the drop off rate from it. I'd imagine that a very important question for you would be what percentage of your visitors don't log in or sign up.


3

Tag your users, and tag them good. Make the sign-up for trials generate a simple link with a UUID or an actual high-entropy token to identify the source. That token should then attach itself as pervasively as possible. URLs, cookies, LocalStorage, you name it, that UUID should be there. It should be easier to click your magic link than to create a new ...


3

@Cragmuer If all you want to do is host two different directories with separate user authentication, just add another <location> directive to your site config. I will assume that you have your ports.conf file setup correctly but I'll include a sample anyway. An example configuration would look like something like this: /etc/apache2/sites-available &...


3

Use wgWhitelistRead in your LocalSettings.php configuration file.


3

No, it's not good practice to create a database user for every site user. The way you have things setup now is pretty standard. It shouldn't be possible for people to get access to passwords stored in your PHP code unless your server is compromised, and that's pretty much the worst case scenario. The only caveat is that if you are using some form of source ...


3

There are privileges which bureaucrats do not have by default, and it is possible to give those to them (or some other group or a specific user if you prefer), e.g. $wgGroupPermissions['bureaucrat'] += array_fill_keys( $wgAvailableRights, true ); See the manual for details. It won't help you, though. Submitting a page edit works the same way no matter ...


3

You need one additional thing to connect: the address of the server. It can be either an IP address or a host name. After you have the address you can log into the machine through secure shell (SSH). SSH gives you command line access to the machine. You could also use secure copy (SCP) to place your files on the machine. From a Windows machine you ...


2

You could force sign-ups via Facebook and then check how many friends they have from your application. If they have less than X do not give them a free trial. Of course if someone just doesn't have any friends they will be excluded. Just adding, this only makes it more work on the user's part to get a free trial. They could simply create a bunch of fake ...


Only top voted, non community-wiki answers of a minimum length are eligible