48

There are a lot of factors that went into it including: Browser and server technology for security with virtual hosts. You used to need a dedicated IP address per secure site, but that is not the case anymore using SNI. Lower cost and free security certificates. Let's Encrypt now issues about half of all certificates for free. Ten years ago I was ...


46

Is there any way of identifying whether or not my visitors are using one of these plugins and how best to support it? By far the best way to support password managers is to use normal <form> tags and a normal form. If you don't do anything clever, then the password manager will do its job.


41

is there any other way to make my connection secured ? Google isn't just complaining about "security" (which could include a number of different topics), it is specifically targeting encryption / HTTPS. With plain HTTP the connection between the client and server is unencrypted, allowing anyone to potentially see and intercept anything that is submitted. It ...


32

Your image tags must currently look like: <img src="http://example.com/images/image.jpg"> That http in there means that the image is NOT served securely. An attacker could change the image in transit and thereby change how your otherwise secure page looks to your users. Instead you could use any of the following to serve the images securely: Link ...


18

The answers thus far talk about various pull and push reasons as to why HTTPS is becoming more and more popular. However, there are 2 major wake-up calls from around 2010 and 2011 that showed how important HTTPS actually is: Firesheep allowing session hijacking, and the Tunisian government intercepting Facebook logins to steal credentials. Firesheep was a ...


13

Yes. Users can install LastPass as a browser plugin. Thus you can rely on client side scripting languages to check if LastPass is installed. For instance, using NavigatorPlugins.plugins allows you to get the a PluginArray object, listing the plugins installed in the application: function getLastPassVersion() { var lastpass = navigator.plugins['...


13

The typical case of certificates issued by a trusted party (Let's Encrypt etc) Server certificates are essential because the client needs to verify that it speaks with the expected server in order to detect man in the middle attacks. To authenticate itself against a client the server needs for this the certificate itself which is public and the private key ...


11

since it's easy to view the source of a site and its Google Analytics code, could somebody take that code and add it to their own site(s) and completely mess up my site's analytics data? Yes, Google Analytics code and Property ID's can be hijacked, as covered here. The motivation might be just that, to mess up your analytics data, or an attempt to get you ...


11

There was what became to be called Operation Aurora which (allegedly) was Chinese crackers breaking into USA computers like Google's. Google went public with Operation Aurora in 2010. Seems they decided to convert the loss into value by showing efforts of securing their products. So instead of losers they show up as leaders. They needed real efforts ...


10

It's not about emailing plain text passwords vs. a URL, it's about storing passwords in plain text vs. hashing them. Storing passwords in plain text is not considered secure because if the site (or server, or database...) is exploited, the hacker has access to the user's account on that site along with any other site on which they use the same username and ...


9

You can encode your code using ionCube and similar products. Your client won't be able to view, study or take it. However, everything can be reverse engineered meaning that, no matter how you encode your code, it can be decoded. For example, ionCube can be decoded with decry.pt. It works, I can confirm it. So you'll never be able to really secure your code ...


9

When a new bug is found, in this case in wordpress, the first thing hackers will do is try to find vulnerable sites that use wordpress. A good way of doing it is trying to find wp-admin pages on google. Maybe will even use automated tools to find-and-exploit sites based on that. Avoiding that would be the main security reason for doing it. If you have no ...


9

This looks like the output of a browser extension, which means only users with the extension installed will see the badge. For example, Mcafee SECURE Safe Browsing place a similar badge next to "safe" sites according to TrustedSite.com You can apply for such a badge at https://www.trustedsite.com/signup?re=addsite


8

First of all -- this really depends on your server configuration -- if such modifications are allowed to be performed on directory level (section is not locked on parent/server level). In order to disable execution of specific file extension yo need to know the handler name that is responsible for this. On each system this name can be different, especially ...


8

Some folks get a fair amount of traffic by allowing themselves to be framed by social network sharing sites like StumbleUpon - if your page is at all likely to be shared, I'd avoid doing this, and handle instances of framing in another way. Also, your site can already be sucked in and repurposed by benign services like Google Translate - and I believe an ...


8

From their suggestion page: The technology has to be discoverable in either the page body, cookies or server headers. In theory, this could also involve things like testing known locations, such as http://example.com/wp-admin/ Most applications let you hide various bits of such identifying information, but on the whole: get over it if not. Hiding what ...


8

You have implemented a Cross Site Scripting (XSS) vulnerability. This type of injection vulnerability can be used by an attacker to steal the credentials of your users, or make users perform actions on your site or against other sites without their knowledge. For more information about XSS see wikipedia: http://en.wikipedia.org/wiki/Cross-site_scripting ...


8

Without additional safety, no. Random URLs are crawled all the time. However, this is good when done with a sign-on page to authenticate the user. An intermediate solution is to make sure the status page contains no personal data, only general info. For example, 'PAID BY CC' rather than 'PAID by VISA 1234567891' and 'Shipped' instead of 'Shipped to John Doe,...


8

Security issue? Doubt it. It just makes your site more visible to people who likes to attack wordpress sites. Other than the visibility everything is the same, security through obscurity is not something you should rely on anyway. Useless? Definitely. There is no reason to allow indexing of your admin login in your site. You don't want your users finding a ...


8

Bruteforce hashes You could bruteforce the hash that is stored in the database. WordPress uses phpass for hashing. Per default, WordPress does not use blowfish or similar, but just md5 with an iteration count of 8192. If you just want to find really bad passwords, bruteforcing is certainly feasible. But I would consider this a rather big violation of ...


7

Here is a very relvant article about a survey conducted asking users about trust in trustmarks. They presented users with a variety of trust marks and they asked which one they trust most: Based on that and on other survey questions, they conclude: Trustmarks do matter. Only a handful are instantly recognizable. If your trustmarks aren't ...


7

This website: https://pointless.net/ Is dnssec signed and uses a TLSA record (RFC6698) to secure the SSL certificate (Which is also signed by CA CERT, a sort of open source web of trust CA). I run my own nameservers and use Easydns as my registrar - however Easydns doesn't support putting a DS record in the .net zone so I use the ISC Domain Lookaside ...


7

Without knowing more about your app or seeing some real code it is hard to give any detailed security advice. That being said here are some things that come to mind after reading your post: 1: Keep your config file with the database connect info and salt key outside the public directory and chmod it to 444 or 644. You can access one directory above your ...


7

Flexible SSL is NOT fully secure CloudFlare's Flexible SSL provides encryption from the user to CloudFlare's servers, but not from their servers to the website server. This avoids the hassle of installing (and renewing) a certificate on your web server, but does mean traffic gets sent plain text over the 2nd half of the journey. The benefits of this setup ...


7

I will not approach your questions head-on. Instead, I will explain a bit so that you will understand the whole Google SSL thing better. Here we go. A fair majority of all of the metrics that dictate performance in the SERPs are domain related- meaning that in the database, the metric is relationally linked to the domain and not to a page or other site ...


7

Use OpenSSL's speed command to benchmark the two types and compare results. Here's an example command to run on the server to compare only the key types and sizes you mention: openssl speed rsa2048 rsa4096 For reference, here are some benchmark results from a modest VPS: sign verify sign/s verify/s rsa 2048 bits 0.000685s 0.000032s ...


7

Google doesn't want to index non-content pages including admin pages and pages that ask you to login. Putting wp-admin in robots.txt is better for SEO because it will usually prevent the page from being indexed. It is possible that an attacker will do a Google for all sites that have wp-admin in the URL. Keeping that page on your site out of the Google ...


7

Google changes this around every now and then, and whenever they do I have to 're-find' where each of the settings are. So you're not alone! You're right that a browser key is essentially 'public' and should be limited by domain to protect it from being stolen. It's worth noting the worst that can happen if its stolen is that someone could use up your free ...


6

StartCom are in the Microsoft list of root certificate issuers. The process whereby the certificates get updated is described here. In brief - the certificates used by IE are recognised by the operating system, not on the browser version. If this IE6 is on XP, and the XP machine received Windows updates, then it could be that they weren't recognised in 2010, ...


6

If you don't trust him/her, create an FTP account in the domain that is being worked on for the uploads. Dev person should be able to create the database structure on their own machine and then dump it and give you a SQL file to recreate it on your server.


Only top voted, non community-wiki answers of a minimum length are eligible