Skip to main content
50 votes

What events caused mass migration to HTTPS?

There are a lot of factors that went into it including: Browser and server technology for security with virtual hosts. You used to need a dedicated IP address per secure site, but that is not the ...
46 votes

How can I tell if my website visitors are using LastPass or other password managers?

Is there any way of identifying whether or not my visitors are using one of these plugins and how best to support it? By far the best way to support password managers is to use normal <form> ...
dotancohen's user avatar
41 votes

Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?

is there any other way to make my connection secured ? Google isn't just complaining about "security" (which could include a number of different topics), it is specifically targeting encryption / ...
DocRoot's user avatar
  • 4,297
33 votes

How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?

At its root, this is a problem about verifying ownership of an email address, and as far as I know there are only two ways to practically verify ownership of an email address: Send a verification ...
Maximillian Laumeister's user avatar
19 votes

What events caused mass migration to HTTPS?

The answers thus far talk about various pull and push reasons as to why HTTPS is becoming more and more popular. However, there are 2 major wake-up calls from around 2010 and 2011 that showed how ...
14 votes

Does SSL require a client side certificate of any kind at all?

The typical case of certificates issued by a trusted party (Let's Encrypt etc) Server certificates are essential because the client needs to verify that it speaks with the expected server in order to ...
Steffen Ullrich's user avatar
13 votes
Accepted

How can I tell if my website visitors are using LastPass or other password managers?

Yes. Users can install LastPass as a browser plugin. Thus you can rely on client side scripting languages to check if LastPass is installed. For instance, using NavigatorPlugins.plugins allows you ...
Billal Begueradj's user avatar
12 votes

What events caused mass migration to HTTPS?

There was what became to be called Operation Aurora which (allegedly) was Chinese crackers breaking into USA computers like Google's. Google went public with Operation Aurora in 2010. Seems they ...
12 votes
Accepted

Spike in Traffic from "Facebot Twitterbot" user agent

This is the iMessages app's crawler (from the users phone itself, not a Apple server). Apple has chosen to use this useragent in their iMessages app to ensure the unfurling of the URL and the rich ...
GuidedHacking's user avatar
9 votes

Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key

Use OpenSSL's speed command to benchmark the two types and compare results. Here's an example command to run on the server to compare only the key types and sizes you mention: openssl speed rsa2048 ...
Tom Brossman's user avatar
  • 2,291
9 votes
Accepted

Does SSL require a client side certificate of any kind at all?

Your friend is correct. The browser has to have the root certification authority certificate, so that it can verify that the server certificate has been signed by a legitimate certification authority.
Mike Scott's user avatar
  • 2,291
9 votes

How do I get Google to mark my website as "safe" in the search results with a small green icon?

This looks like the output of a browser extension, which means only users with the extension installed will see the badge. For example, Mcafee SECURE Safe Browsing place a similar badge next to "safe"...
Nat Taylor's user avatar
8 votes

Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?

Do all subdomains need to use HTTPS? Technically, to be included only the root domain needs to be using HTTPS, but once you get included then any sites under the root domain need to use HTTPS, ...
jrtapsell's user avatar
  • 687
8 votes
Accepted

restricting Google Maps js API keys to just my domain

Google changes this around every now and then, and whenever they do I have to 're-find' where each of the settings are. So you're not alone! You're right that a browser key is essentially 'public' ...
Tim Malone's user avatar
  • 1,256
8 votes

Is a "Show Password" option on login form safe?

Apart from the obvious security issue of someone else being able to physically see what password you are typing - which the user would be aware of anyway - there are a few security "concerns" that ...
MrWhite's user avatar
  • 42.9k
8 votes

How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?

There is not much you can do to avoid verification mails (in case you actually need to store and verify mails at all, of course): if you display it to users or sent mails to that address, you better ...
eckes's user avatar
  • 209
7 votes
Accepted

What is SymLinksIfOwnerMatch?

From the Apache docs SymLinksIfOwnerMatch The server will only follow symbolic links for which the target file or directory is owned by the same user id as the link. So, enabling this option (as ...
MrWhite's user avatar
  • 42.9k
7 votes
Accepted

Can a URL that is not linked to from anywhere be discovered?

There are many ways that secret URLs may be discovered: Anybody with access to the URL has the option of sharing the URL or linking to it. Web servers are often configured to create listings of all ...
Stephen Ostermiller's user avatar
7 votes
Accepted

Should rel="noopener" be set on links to external sites even if I own the site?

Is it necessary? No. Is it best practice to do it anyway? Yes. Here are a few reasons: Ownership and management of external sites can change, leaving them in less trusted hands. You would need to ...
Maximillian Laumeister's user avatar
6 votes

What is deleteme.xxxxxxxx.php

These appear on my Wordpress installation every time the cPanel Installatron script runs to autoupdate. They come from the cPanel Installatron script. If you installed Wordpress via a cPanel script ...
rev's user avatar
  • 161
6 votes
Accepted

Google Search Console alert: Harmful content - Uncommon Downloads

After the review, the problem is disappear/fixed. I raised a "review request" stating: The malicious content report doesn't contain any specific link affected by malicious content and I believe, ...
ar099968's user avatar
  • 473
6 votes
Accepted

HTTP webpage is showing "Not Secure" in Chrome

This is a move to make the web more secure. Additionally, it protects all visitors to your site. The long-term solution is to implement SSL on your website(s), as all websites will eventually need to ...
Josh Salganik's user avatar
6 votes
Accepted

Is a PHP POST using cURL from HTTPS site to HTTP endpoint encrypted securely?

Short answer: no, it is not encrypted. The only thing that matters is the URL you are using to send content, what happened before is irrelevant. If you are sending your content to an HTTP URL then ...
Patrick Mevzek's user avatar
6 votes

Secure way to share unfinished web-page with a customer?

If you know your customer IP Address, the safer way to share unfinished web-page is to deny access to everyone but you and it in a .htaccess file at the root of your working directory. order deny,...
gael's user avatar
  • 1,050
5 votes

Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key

I decided to run openssl speed with three key sizes: 1024, 2048 and 4096 bits. Here are the results on my home PC, which is decent but far from exceptional as far as number-crunching power goes: ...
user's user avatar
  • 351
5 votes
Accepted

creating an archive/snapshot of a wordpress site -- how?

Your third option is definitely the way to go - leave all the bloat behind and go static. I recommend Jekyll for managing the static site since it has the largest number of users, which makes finding ...
Tom Brossman's user avatar
  • 2,291
5 votes

Is a "Show Password" option on login form safe?

If we are ignoring everything else you mention, (i.e. shared computer, firefox saved passwords, etc.) the "show" password feature is, by itself, not a security risk. It is for convenience and the "...
Auzi's user avatar
  • 151
5 votes

What events caused mass migration to HTTPS?

Encrypting transmissions over the internet is more secure against nefarious agents intercepting or scanning this data and inserting themselves in the middle, faking you into thinking they are the real ...
5 votes

what cipher suites should I consider on government website

Given some inherent security issues with SSL it tends to be best to disable SSLv3 and lower and stick to TLS 1.0+ however if there is a high chance of substantially old browsers connecting that only ...
Chris Rutherfurd's user avatar
5 votes

Google Search Console alert: Harmful content - Uncommon Downloads

My suggestion is that you install an ssl certificate on your website - though you blocked off your domain name, I noticed that you are using http://____, which in and of itself can trigger Google ...
Josh Salganik's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible