50
votes
What events caused mass migration to HTTPS?
There are a lot of factors that went into it including:
Browser and server technology for security with virtual hosts. You used to need a dedicated IP address per secure site, but that is not the ...
47
votes
How can I tell if my website visitors are using LastPass or other password managers?
Is there any way of identifying whether or not my visitors are using one of these plugins and how best to support it?
By far the best way to support password managers is to use normal <form> ...
- 559
41
votes
Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?
is there any other way to make my connection secured ?
Google isn't just complaining about "security" (which could include a number of different topics), it is specifically targeting encryption / ...
- 4,297
36
votes
Accepted
HTTPS connection is "not safe" due to images
Your image tags must currently look like:
<img src="http://example.com/images/image.jpg">
That http in there means that the image is NOT served securely. An attacker could change the image ...
- 97.7k
33
votes
How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?
At its root, this is a problem about verifying ownership of an email address, and as far as I know there are only two ways to practically verify ownership of an email address:
Send a verification ...
- 15.6k
19
votes
What events caused mass migration to HTTPS?
The answers thus far talk about various pull and push reasons as to why HTTPS is becoming more and more popular.
However, there are 2 major wake-up calls from around 2010 and 2011 that showed how ...
14
votes
Does SSL require a client side certificate of any kind at all?
The typical case of certificates issued by a trusted party (Let's Encrypt etc)
Server certificates are essential because the client needs to verify that it speaks with the expected server in order to ...
- 651
13
votes
Accepted
How can I tell if my website visitors are using LastPass or other password managers?
Yes.
Users can install LastPass as a browser plugin. Thus you can rely on client side scripting languages to check if LastPass is installed.
For instance, using NavigatorPlugins.plugins allows you ...
- 374
12
votes
What events caused mass migration to HTTPS?
There was what became to be called Operation Aurora which (allegedly) was Chinese crackers breaking into USA computers like Google's.
Google went public with Operation Aurora in 2010. Seems they ...
11
votes
Accepted
Spike in Traffic from "Facebot Twitterbot" user agent
This is the iMessages app's crawler (from the users phone itself, not a Apple server).
Apple has chosen to use this useragent in their iMessages app to ensure the unfurling of the URL and the rich ...
- 226
9
votes
Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key
Use OpenSSL's speed command to benchmark the two types and compare results. Here's an example command to run on the server to compare only the key types and sizes you mention:
openssl speed rsa2048 ...
- 2,271
9
votes
Are indexed Wordpress admin pages a security threat?
When a new bug is found, in this case in wordpress, the first thing hackers will do is try to find vulnerable sites that use wordpress. A good way of doing it is trying to find wp-admin pages on ...
- 189
9
votes
Accepted
Does SSL require a client side certificate of any kind at all?
Your friend is correct. The browser has to have the root certification authority certificate, so that it can verify that the server certificate has been signed by a legitimate certification authority.
- 2,251
9
votes
How do I get Google to mark my website as "safe" in the search results with a small green icon?
This looks like the output of a browser extension, which means only users with the extension installed will see the badge.
For example, Mcafee SECURE Safe Browsing place a similar badge next to "safe"...
- 191
8
votes
Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?
Do all subdomains need to use HTTPS?
Technically, to be included only the root domain needs to be using HTTPS, but once you get included then any sites under the root domain need to use HTTPS, ...
- 687
8
votes
Are indexed Wordpress admin pages a security threat?
Security issue? Doubt it. It just makes your site more visible to people who likes to attack wordpress sites. Other than the visibility everything is the same, security through obscurity is not ...
- 189
8
votes
How to find out the strength of the Wordpress (already stored) password?
Bruteforce hashes
You could bruteforce the hash that is stored in the database.
WordPress uses phpass for hashing. Per default, WordPress does not use blowfish or similar, but just md5 with an ...
- 331
8
votes
Accepted
restricting Google Maps js API keys to just my domain
Google changes this around every now and then, and whenever they do I have to 're-find' where each of the settings are.
So you're not alone!
You're right that a browser key is essentially 'public' ...
- 1,266
8
votes
Is a "Show Password" option on login form safe?
Apart from the obvious security issue of someone else being able to physically see what password you are typing - which the user would be aware of anyway - there are a few security "concerns" that ...
- 42.6k
8
votes
How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?
There is not much you can do to avoid verification mails (in case you actually need to store and verify mails at all, of course): if you display it to users or sent mails to that address, you better ...
- 209
7
votes
Are indexed Wordpress admin pages a security threat?
Google doesn't want to index non-content pages including admin pages and pages that ask you to login. Putting wp-admin in robots.txt is better for SEO because it will usually prevent the page from ...
- 97.7k
7
votes
Accepted
Can a URL that is not linked to from anywhere be discovered?
There are many ways that secret URLs may be discovered:
Anybody with access to the URL has the option of sharing the URL or linking to it.
Web servers are often configured to create listings of all ...
- 97.7k
7
votes
Accepted
Should rel="noopener" be set on links to external sites even if I own the site?
Is it necessary? No. Is it best practice to do it anyway? Yes.
Here are a few reasons:
Ownership and management of external sites can change, leaving them in less trusted hands. You would need to ...
- 15.6k
6
votes
What is deleteme.xxxxxxxx.php
These appear on my Wordpress installation every time the cPanel Installatron script runs to autoupdate. They come from the cPanel Installatron script. If you installed Wordpress via a cPanel script ...
- 161
6
votes
HTTPS connection is "not safe" due to images
The issue is that your page is serving links from a http location as opposed to https. This is due to using absolute http links to reference resources such as images. There are two better methods ...
- 1,079
6
votes
Accepted
What is SymLinksIfOwnerMatch?
From the Apache docs
SymLinksIfOwnerMatch
The server will only follow symbolic links for which the target file or directory is owned by the same user id as the link.
So, enabling this option (as ...
- 42.6k
6
votes
Accepted
Google Search Console alert: Harmful content - Uncommon Downloads
After the review, the problem is disappear/fixed. I raised a "review request" stating:
The malicious content report doesn't contain any specific link
affected by malicious content and I believe, ...
- 473
6
votes
Accepted
HTTP webpage is showing "Not Secure" in Chrome
This is a move to make the web more secure. Additionally, it protects all visitors to your site. The long-term solution is to implement SSL on your website(s), as all websites will eventually need to ...
- 1,254
6
votes
Accepted
Is a PHP POST using cURL from HTTPS site to HTTP endpoint encrypted securely?
Short answer: no, it is not encrypted.
The only thing that matters is the URL you are using to send content, what happened before is irrelevant.
If you are sending your content to an HTTP URL then ...
- 8,317
6
votes
Secure way to share unfinished web-page with a customer?
If you know your customer IP Address, the safer way to share unfinished web-page is to deny access to everyone but you and it in a .htaccess file at the root of your working directory.
order deny,...
- 1,050
Only top scored, non community-wiki answers of a minimum length are eligible