50 votes

What events caused mass migration to HTTPS?

There are a lot of factors that went into it including: Browser and server technology for security with virtual hosts. You used to need a dedicated IP address per secure site, but that is not the ...
47 votes

How can I tell if my website visitors are using LastPass or other password managers?

Is there any way of identifying whether or not my visitors are using one of these plugins and how best to support it? By far the best way to support password managers is to use normal <form> ...
dotancohen's user avatar
41 votes

Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?

is there any other way to make my connection secured ? Google isn't just complaining about "security" (which could include a number of different topics), it is specifically targeting encryption / ...
DocRoot's user avatar
  • 4,297
36 votes
Accepted

HTTPS connection is "not safe" due to images

Your image tags must currently look like: <img src="http://example.com/images/image.jpg"> That http in there means that the image is NOT served securely. An attacker could change the image ...
Stephen Ostermiller's user avatar
33 votes

How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?

At its root, this is a problem about verifying ownership of an email address, and as far as I know there are only two ways to practically verify ownership of an email address: Send a verification ...
Maximillian Laumeister's user avatar
19 votes

What events caused mass migration to HTTPS?

The answers thus far talk about various pull and push reasons as to why HTTPS is becoming more and more popular. However, there are 2 major wake-up calls from around 2010 and 2011 that showed how ...
14 votes

Does SSL require a client side certificate of any kind at all?

The typical case of certificates issued by a trusted party (Let's Encrypt etc) Server certificates are essential because the client needs to verify that it speaks with the expected server in order to ...
Steffen Ullrich's user avatar
13 votes
Accepted

How can I tell if my website visitors are using LastPass or other password managers?

Yes. Users can install LastPass as a browser plugin. Thus you can rely on client side scripting languages to check if LastPass is installed. For instance, using NavigatorPlugins.plugins allows you ...
Billal Begueradj's user avatar
12 votes

What events caused mass migration to HTTPS?

There was what became to be called Operation Aurora which (allegedly) was Chinese crackers breaking into USA computers like Google's. Google went public with Operation Aurora in 2010. Seems they ...
12 votes
Accepted

Spike in Traffic from "Facebot Twitterbot" user agent

This is the iMessages app's crawler (from the users phone itself, not a Apple server). Apple has chosen to use this useragent in their iMessages app to ensure the unfurling of the URL and the rich ...
GuidedHacking's user avatar
9 votes

Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key

Use OpenSSL's speed command to benchmark the two types and compare results. Here's an example command to run on the server to compare only the key types and sizes you mention: openssl speed rsa2048 ...
Tom Brossman's user avatar
  • 2,281
9 votes

Are indexed Wordpress admin pages a security threat?

When a new bug is found, in this case in wordpress, the first thing hackers will do is try to find vulnerable sites that use wordpress. A good way of doing it is trying to find wp-admin pages on ...
CristianTM's user avatar
9 votes
Accepted

Does SSL require a client side certificate of any kind at all?

Your friend is correct. The browser has to have the root certification authority certificate, so that it can verify that the server certificate has been signed by a legitimate certification authority.
Mike Scott's user avatar
  • 2,251
9 votes

How do I get Google to mark my website as "safe" in the search results with a small green icon?

This looks like the output of a browser extension, which means only users with the extension installed will see the badge. For example, Mcafee SECURE Safe Browsing place a similar badge next to "safe"...
Nat Taylor's user avatar
8 votes

Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?

Do all subdomains need to use HTTPS? Technically, to be included only the root domain needs to be using HTTPS, but once you get included then any sites under the root domain need to use HTTPS, ...
jrtapsell's user avatar
  • 687
8 votes

Are indexed Wordpress admin pages a security threat?

Security issue? Doubt it. It just makes your site more visible to people who likes to attack wordpress sites. Other than the visibility everything is the same, security through obscurity is not ...
cdvv7788's user avatar
  • 189
8 votes

How to find out the strength of the Wordpress (already stored) password?

Bruteforce hashes You could bruteforce the hash that is stored in the database. WordPress uses phpass for hashing. Per default, WordPress does not use blowfish or similar, but just md5 with an ...
tim's user avatar
  • 331
8 votes
Accepted

restricting Google Maps js API keys to just my domain

Google changes this around every now and then, and whenever they do I have to 're-find' where each of the settings are. So you're not alone! You're right that a browser key is essentially 'public' ...
Tim Malone's user avatar
  • 1,266
8 votes

Is a "Show Password" option on login form safe?

Apart from the obvious security issue of someone else being able to physically see what password you are typing - which the user would be aware of anyway - there are a few security "concerns" that ...
MrWhite's user avatar
  • 42.7k
8 votes

How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?

There is not much you can do to avoid verification mails (in case you actually need to store and verify mails at all, of course): if you display it to users or sent mails to that address, you better ...
eckes's user avatar
  • 209
7 votes

Are indexed Wordpress admin pages a security threat?

Google doesn't want to index non-content pages including admin pages and pages that ask you to login. Putting wp-admin in robots.txt is better for SEO because it will usually prevent the page from ...
Stephen Ostermiller's user avatar
7 votes
Accepted

Can a URL that is not linked to from anywhere be discovered?

There are many ways that secret URLs may be discovered: Anybody with access to the URL has the option of sharing the URL or linking to it. Web servers are often configured to create listings of all ...
Stephen Ostermiller's user avatar
7 votes
Accepted

Should rel="noopener" be set on links to external sites even if I own the site?

Is it necessary? No. Is it best practice to do it anyway? Yes. Here are a few reasons: Ownership and management of external sites can change, leaving them in less trusted hands. You would need to ...
Maximillian Laumeister's user avatar
6 votes

What is deleteme.xxxxxxxx.php

These appear on my Wordpress installation every time the cPanel Installatron script runs to autoupdate. They come from the cPanel Installatron script. If you installed Wordpress via a cPanel script ...
rev's user avatar
  • 161
6 votes

HTTPS connection is "not safe" due to images

The issue is that your page is serving links from a http location as opposed to https. This is due to using absolute http links to reference resources such as images. There are two better methods ...
garth's user avatar
  • 1,079
6 votes
Accepted

What is SymLinksIfOwnerMatch?

From the Apache docs SymLinksIfOwnerMatch The server will only follow symbolic links for which the target file or directory is owned by the same user id as the link. So, enabling this option (as ...
MrWhite's user avatar
  • 42.7k
6 votes
Accepted

Google Search Console alert: Harmful content - Uncommon Downloads

After the review, the problem is disappear/fixed. I raised a "review request" stating: The malicious content report doesn't contain any specific link affected by malicious content and I believe, ...
ar099968's user avatar
  • 473
6 votes
Accepted

HTTP webpage is showing "Not Secure" in Chrome

This is a move to make the web more secure. Additionally, it protects all visitors to your site. The long-term solution is to implement SSL on your website(s), as all websites will eventually need to ...
Josh Salganik's user avatar
6 votes
Accepted

Is a PHP POST using cURL from HTTPS site to HTTP endpoint encrypted securely?

Short answer: no, it is not encrypted. The only thing that matters is the URL you are using to send content, what happened before is irrelevant. If you are sending your content to an HTTP URL then ...
Patrick Mevzek's user avatar
6 votes

Secure way to share unfinished web-page with a customer?

If you know your customer IP Address, the safer way to share unfinished web-page is to deny access to everyone but you and it in a .htaccess file at the root of your working directory. order deny,...
gael's user avatar
  • 1,050

Only top scored, non community-wiki answers of a minimum length are eligible