Hot answers tagged

47 votes

How can I tell if my website visitors are using LastPass or other password managers?

Is there any way of identifying whether or not my visitors are using one of these plugins and how best to support it? By far the best way to support password managers is to use normal <form> ...
user avatar
41 votes

Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?

is there any other way to make my connection secured ? Google isn't just complaining about "security" (which could include a number of different topics), it is specifically targeting encryption / ...
user avatar
  • 4,267
33 votes

How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?

At its root, this is a problem about verifying ownership of an email address, and as far as I know there are only two ways to practically verify ownership of an email address: Send a verification ...
user avatar
18 votes
Accepted

Should I replace fillable PDFs?

Normally, I recommend replacing fillable PDFs with regular web forms I think overall, yes, that would be the ideal solution, but you noted some of the the issues with this, which includes how to ...
user avatar
  • 329
13 votes
Accepted

How can I tell if my website visitors are using LastPass or other password managers?

Yes. Users can install LastPass as a browser plugin. Thus you can rely on client side scripting languages to check if LastPass is installed. For instance, using NavigatorPlugins.plugins allows you ...
user avatar
10 votes

Should I replace fillable PDFs?

You could try to force downloading of the PDF, so that it opens in the default application for viewing PDF files instead of the browser. See this question: How do I force files to open in the browser ...
user avatar
  • 209
8 votes

How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?

There is not much you can do to avoid verification mails (in case you actually need to store and verify mails at all, of course): if you display it to users or sent mails to that address, you better ...
user avatar
  • 209
7 votes
Accepted

Prevent form resubmit after Browser Back button click

One way to prevent this is to use the POST/Redirect/GET pattern. Instead of directly sending a 200 after receiving the POST request, the server sends a 303 (or 302) redirect instead. The client ...
user avatar
  • 21.4k
7 votes

Is a "Show Password" option on login form safe?

Apart from the obvious security issue of someone else being able to physically see what password you are typing - which the user would be aware of anyway - there are a few security "concerns" that ...
user avatar
  • 40.9k
6 votes

Is it valid to have multiple form input elements with the same name?

HTML5 The non-normative section 4.10.1.3 Configuring a form to communicate with a server explicitly says that it is valid: Multiple controls can have the same name; for example, here we give all ...
user avatar
5 votes

Is a "Show Password" option on login form safe?

If we are ignoring everything else you mention, (i.e. shared computer, firefox saved passwords, etc.) the "show" password feature is, by itself, not a security risk. It is for convenience and the "...
user avatar
  • 151
5 votes
Accepted

Is it considered spam to set "From: " header to the user's email in a contact form?

Using the user's email address as the 'from' address in a form notification email is not a good idea because it will trigger many spam filters due to a "spoofed" sender. There are two systems which ...
user avatar
5 votes

Should I replace fillable PDFs?

There is no standard practise. You'll have to re-think your process: Why do your customers have to fill out PDFs in the first place? Do you just need structured data from the customer? Who needs the ...
user avatar
4 votes
Accepted

Are search-based sites bad for SEO, and should I link to all posts instead?

Yes. Although Google can submit some forms they generally do not do so. So any content that is only available via a form submission should be assumed to be hidden from search engines. Yes. This is ...
user avatar
  • 85.8k
4 votes

406 Not Acceptable response

Your request body is very large. If I'm correct, your request body is at least 10.4 KB in size because of all those fields that begin with chk and that have a value of at least 5 characters. That ...
user avatar
4 votes

How do I automatically log my users into other websites after they have given me their passwords?

You're on the right track with CURL. What you need to do is add code that reads the website as if it's a basic HTML file then process the file replacing certain HTML code. If some websites are basic ...
user avatar
4 votes

Do Search Engine Spider's submit POST forms?

Bing absolutely does. Before I told it not to it would continually submit both a contact form and a survey form. I knew it was Bingbot because I included $_SERVER['HTTP_USER_AGENT'] in the $_POST ...
user avatar
  • 449
4 votes
Accepted

Is a "Show Password" option on login form safe?

There is no inherent security issue with unmasking the password field per-sey. In the functional working of a site any method that can access form fields (such as server side posts or javascript) will ...
user avatar
4 votes

Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?

I don't recommend, but you can bypass this message, by not using the original input text fields. You can create your own input fields, using regular div that have onkeypress event. Or you can create a ...
user avatar
4 votes

Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?

If you're just serving static files or can put a proxy in front you could use a server like caddy server which handles all of this for you by using lets encrypt, this takes the pain out of ...
user avatar
4 votes

Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?

nobody else seems to have mentioned, if you own every machine that connects to your site eg "this is probably not what you want" , like a corporate setting, you can create a certificate ...
user avatar
4 votes

Why is Facebook Pixel firing the gtm.formSubmit event?

I just tried setting up the default form submission trigger in a client's GMB container and was having the same problem. After a little digging around in Preview mode, I came up with the following ...
user avatar
  • 41
3 votes

How can I tell if my website visitors are using LastPass or other password managers?

Most of these password managers are browser plugin based and work by populating the form fields and triggering a form submission as if the ueer pressed the submit button, to the server it appears as a ...
user avatar
3 votes

Do Search Engine Spider's submit POST forms?

They can and do. I've got a simple email collection form on the front of a site I'm about ready to launch. I just received a submission from that form from IP 66.249.73.214, which is a GoogleBot IP.
user avatar
  • 31
3 votes

How to protect a form from spam?

By far my favorite technique is called a 'honeypot'. Here is how it works... Say your form asks for a name. Put the following two fields on the page: <span class='hp'> <label for='...
user avatar
3 votes

Google Business Email Will Not Receive Online Web Form Sent Mail

This is a common problem when sending mail from a site on a shared hosting account that has its mail hosted offsite. What your host needs to do is disable local mail delivery for your domain name. ...
user avatar
  • 1,231
3 votes
Accepted

Schema.org type for mobile carrier support

You could make use of the ContactPoint type to represent the support chat. For the contactType property, Schema.org doesn’t define any values. Google, for their Corporate Contacts feature, recognizes ...
user avatar
  • 21.4k
3 votes

How can I determine where a login form is submitted?

You're right that the form will be submitted to https://squareup.com/mp/login, and that when you just put that URL into a browser, you get a 404. That's because when you type web addresses into a ...
user avatar
3 votes

Does a contact form need to ask the user for explicit permission to be GDPR compliant?

I have a contrary opinion on this. I don't believe your checkbox collects any additional consent from the user that just submitting the form does, so I believe the checkbox can be removed because it ...
user avatar
3 votes
Accepted

Form submission tag not fired

Based on the information from the preview function, the event is not being sent at all as the conditions for the trigger are not met. In the first, the form is submitted but the page path does not ...
user avatar
  • 1,784

Only top scored, non community-wiki answers of a minimum length are eligible