6

This is not a good idea and no, you cannot trust these IP ranges. The IP addresses used by Google are not public. But some/most search engine crawlers can be identified by doing a reverse DNS lookup on the IP address. A googlebot example: 66.249.64.0 has a PTR record to crawl-66-249-64-0.googlebot.com, and any IP with a PTR record to a subdomain on ...


6

Although the question is 2 years old, I would like to keep on answering to it. The page linked by the accepted answer (https://www.nginx.com/resources/wiki/modules/auth_digest/) is 11 years old and states itself that "... (it) is in need of broader testing before it can be considered secure enough for use in production." A GitHub page (https://github.com/...


5

All browsers use heuristics for knowing when to save passwords. I'm familiar with Firefox and Chrome. The heuristic they use seems to be: The form must have a password field The text input just before the password field is assumed to be the user name Only those two input fields are saved. Firefox then prompts you that it can remember your changed ...


4

Maybe one of these is of use for you: opauth to interface with authentication providers or uLogin for adding secure login and authentication capabilities. You would be able to develop the specifics on your own (remember me ...) but make a great use of proven basics.


4

There is no simple solution to this problem. Static passwords may be shared among friends. Tracking mechanisms (IP-addresses, cookies) will turn up "false positives" (i.e. rejecting real paying members) - which is very bad for business. Using a OTP (One Time Password), as suggested by Steve, is probably not practical, as it does not allow casual use, and ...


4

This heavily depends on the target of the audience. For developers, I would offer a Login via Github. For all other matters, having a sign in via Facebook AND Twitter would not hurt. What my company tough observed was, that even tough we are offering the login via Twitter and Facebook, 95% of the Users just sign in via a regular new account.


4

Google's John Mueller says: HTTPS-only sites are fine, there's absolutely no need to shy away from that if you implement it properly. There's certainly no penalty involved with running your site on HTTPS-only when done right. A few of the things that come to mind are (definitely incomplete, just from the top of my head): don't forget the HTTP->...


4

While it may be a turn off in some regions (due to Credit Cards being mvoe popular among the clients), on some sites it does work: require valid credit card details for a free trial. Once the customer enters the details, mark the name on the card as "used" in your application. This will prevent same user subscribing multiple times with different credit cards ...


4

Along the same lines as the other answers... by requesting an item of personal information that is difficult to repeat (many times). What about a (mobile) phone number? A code is text'd to this number for the user to be able to authenticate the first time (or multiple times)?


4

You're on the right track with CURL. What you need to do is add code that reads the website as if it's a basic HTML file then process the file replacing certain HTML code. If some websites are basic with little to no javascript and contain a login box, then look for code containing something like: <input type="text" name="username"> and replace it (...


4

NGINX has a digest authentication module: https://www.nginx.com/resources/wiki/modules/auth_digest/ Unlike basic authentication, digest authentication does not send user names and passwords in plain text over the internet. If your site is SSL only, then basic authentication is probably fine. the SSL encrypts the entire session including the user names and ...


4

Google has a feature in webmaster tools where you can add login information if you want Google to crawl content behind a user login form. If you have provided Google this information in the past and have not changed the login information since then Google will have access to the content accessible to the login information you provided to it. Google does not ...


4

In short: it's very unlikely you'd see a negative SEO impact, but it still might not be a good idea. Google doesn't currently impose penalties, manual or algorithmic, for showing user details without authentication. The do punish "cloaking" (i.e. showing different content to Google than to a human user), but what you're proposing would not, in practice, be ...


4

In Google, you can have the best of both worlds by using First Click Free. In short, this means that: [the] article can be seen without subscribing, [and] any further clicks on the article page will prompt the user to log in or subscribe to the news site. […] It allows Googlebot to fully index your content, which can improve the likelihood of users ...


4

As an end user, the simple answer to this is "just don't allow the banner to run." The term "banner" suggests to me that the applet is nonessential, i.e. blocking it wouldn't prevent the page from working. As a webmaster, the obvious answer is to just accept that Flash is dead and remove the applet, as 90% of your users are not going to see it anyways ...


3

If you want to give Google access to restricted content, you can use First Click Free by Google. First Click Free is designed to protect your content while allowing you to include it Google's search index. To implement First Click Free, you must allow all users who find your page through Google search to see the full text of the document that the ...


3

change <input type="text" id="password" name="password"/> to <input type="password" id="password" name="password"/>


3

As of August 2014 Google has officially indicated that HTTPS will be used as a ranking signal. This means that even if your website is a completely static website, if you care about SEO you should at least consider setting up an SSL certificate. Of course HTTPS is just one ranking signal out of hundreds, so there are probably more important things you can ...


3

I do not have an opinion to pass along to you. Neither do I have any comment on performance. Obviously the products/service your looking at is in beta. Also note that some CMS have this built in or have extensions you can add for social login or sso. Here is some more info and providers: http://gigya.com/social-login/ http://janrain.com/products/engage/...


3

What you do is not a good idea and can be penalized as cloaking. Till 1st October 2017 the best practice was the First Click Free as mentioned in a previous answer. However since October 2017 this has changed. Now google uses Flexible Sampling for paywalled or otherwise not freely available content. Basically Google lets the publishers decide how much ...


3

Apache server has mod_auth-digest that implements it. It is more secure than basic authentication and can be used in place of it. From the documentation: Using MD5 Digest authentication is very simple. Simply set up authentication normally, using AuthType Digest and AuthDigestProvider instead of the normal AuthType Basic and AuthBasicProvider. Then ...


3

Facebook give you 2 options for verification. Verify via SMS or adding a credit card https://www.facebook.com/help/167551763306531 (The option 2 on that page gives a link where to add your card for verification) Failing both of them, you might be able to get a VOIP/virtual number which might forward the SMS/call to your own phone.


3

TL;DR On Client side: open configuration file /etc/ssh/ssh_config; here look for PreferredAuthentications; make sure password comes after publickey and not viceversa In my case password was written before publickey, so ssh would prompt me for password even though I had copied my pub_key onto server. This problem can be found out easily using verbose: ...


3

Tag your users, and tag them good. Make the sign-up for trials generate a simple link with a UUID or an actual high-entropy token to identify the source. That token should then attach itself as pervasively as possible. URLs, cookies, LocalStorage, you name it, that UUID should be there. It should be easier to click your magic link than to create a new ...


3

If you don't track the login page there would be no way to know the drop off rate from it. I'd imagine that a very important question for you would be what percentage of your visitors don't log in or sign up.


3

Keep the login page tracking, you can use it in multiple ways - You can look at how many people are dropping if their login fails You can setup a Register Now CTA and check how many folks sign-up from the login page Upon submitting the login details, you can mark which user is signing in and track user-wise activity tied to your registered users within GA (...


3

@Cragmuer If all you want to do is host two different directories with separate user authentication, just add another <location> directive to your site config. I will assume that you have your ports.conf file setup correctly but I'll include a sample anyway. An example configuration would look like something like this: /etc/apache2/sites-available &...


3

Use wgWhitelistRead in your LocalSettings.php configuration file.


3

No, it's not good practice to create a database user for every site user. The way you have things setup now is pretty standard. It shouldn't be possible for people to get access to passwords stored in your PHP code unless your server is compromised, and that's pretty much the worst case scenario. The only caveat is that if you are using some form of source ...


3

There are privileges which bureaucrats do not have by default, and it is possible to give those to them (or some other group or a specific user if you prefer), e.g. $wgGroupPermissions['bureaucrat'] += array_fill_keys( $wgAvailableRights, true ); See the manual for details. It won't help you, though. Submitting a page edit works the same way no matter ...


Only top voted, non community-wiki answers of a minimum length are eligible