49 votes

What events caused mass migration to HTTPS?

There are a lot of factors that went into it including: Browser and server technology for security with virtual hosts. You used to need a dedicated IP address per secure site, but that is not the ...
47 votes

How can I tell if my website visitors are using LastPass or other password managers?

Is there any way of identifying whether or not my visitors are using one of these plugins and how best to support it? By far the best way to support password managers is to use normal <form> ...
user avatar
41 votes

Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?

is there any other way to make my connection secured ? Google isn't just complaining about "security" (which could include a number of different topics), it is specifically targeting encryption / ...
user avatar
  • 4,267
35 votes
Accepted

HTTPS connection is "not safe" due to images

Your image tags must currently look like: <img src="http://example.com/images/image.jpg"> That http in there means that the image is NOT served securely. An attacker could change the image ...
user avatar
33 votes

How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?

At its root, this is a problem about verifying ownership of an email address, and as far as I know there are only two ways to practically verify ownership of an email address: Send a verification ...
user avatar
19 votes

What events caused mass migration to HTTPS?

The answers thus far talk about various pull and push reasons as to why HTTPS is becoming more and more popular. However, there are 2 major wake-up calls from around 2010 and 2011 that showed how ...
14 votes

Does SSL require a client side certificate of any kind at all?

The typical case of certificates issued by a trusted party (Let's Encrypt etc) Server certificates are essential because the client needs to verify that it speaks with the expected server in order to ...
user avatar
13 votes
Accepted

How can I tell if my website visitors are using LastPass or other password managers?

Yes. Users can install LastPass as a browser plugin. Thus you can rely on client side scripting languages to check if LastPass is installed. For instance, using NavigatorPlugins.plugins allows you ...
user avatar
12 votes

What events caused mass migration to HTTPS?

There was what became to be called Operation Aurora which (allegedly) was Chinese crackers breaking into USA computers like Google's. Google went public with Operation Aurora in 2010. Seems they ...
10 votes

What are the Pros and Cons for password recovery change links in email?

It's not about emailing plain text passwords vs. a URL, it's about storing passwords in plain text vs. hashing them. Storing passwords in plain text is not considered secure because if the site (or ...
user avatar
  • 4,334
9 votes
Accepted

How can I protect my PHP source code from a client when installed on a client's server?

You can encode your code using ionCube and similar products. Your client won't be able to view, study or take it. However, everything can be reverse engineered meaning that, no matter how you encode ...
user avatar
  • 2,343
9 votes

Are indexed Wordpress admin pages a security threat?

When a new bug is found, in this case in wordpress, the first thing hackers will do is try to find vulnerable sites that use wordpress. A good way of doing it is trying to find wp-admin pages on ...
user avatar
9 votes
Accepted

Does SSL require a client side certificate of any kind at all?

Your friend is correct. The browser has to have the root certification authority certificate, so that it can verify that the server certificate has been signed by a legitimate certification authority.
user avatar
  • 2,211
9 votes

How do I get Google to mark my website as "safe" in the search results with a small green icon?

This looks like the output of a browser extension, which means only users with the extension installed will see the badge. For example, Mcafee SECURE Safe Browsing place a similar badge next to "safe"...
user avatar
8 votes

Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?

Do all subdomains need to use HTTPS? Technically, to be included only the root domain needs to be using HTTPS, but once you get included then any sites under the root domain need to use HTTPS, ...
user avatar
  • 677
8 votes

Are indexed Wordpress admin pages a security threat?

Security issue? Doubt it. It just makes your site more visible to people who likes to attack wordpress sites. Other than the visibility everything is the same, security through obscurity is not ...
user avatar
  • 189
8 votes

How to find out the strength of the Wordpress (already stored) password?

Bruteforce hashes You could bruteforce the hash that is stored in the database. WordPress uses phpass for hashing. Per default, WordPress does not use blowfish or similar, but just md5 with an ...
user avatar
  • 321
8 votes
Accepted

restricting Google Maps js API keys to just my domain

Google changes this around every now and then, and whenever they do I have to 're-find' where each of the settings are. So you're not alone! You're right that a browser key is essentially 'public' ...
user avatar
  • 1,231
8 votes

How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?

There is not much you can do to avoid verification mails (in case you actually need to store and verify mails at all, of course): if you display it to users or sent mails to that address, you better ...
user avatar
  • 209
7 votes

Are "trustmarks" such as McAfee Secure worth the cost?

Here is a very relvant article about a survey conducted asking users about trust in trustmarks. They presented users with a variety of trust marks and they asked which one they trust most: Based on ...
user avatar
7 votes
Accepted

Are there any disadvantages to Cloudflare’s “Flexible SSL”?

Flexible SSL is NOT fully secure CloudFlare's Flexible SSL provides encryption from the user to CloudFlare's servers, but not from their servers to the website server. This avoids the hassle of ...
user avatar
7 votes
Accepted

Google's point of view to SSL - Do I need to force HTTPS protocol for all pages on website

I will not approach your questions head-on. Instead, I will explain a bit so that you will understand the whole Google SSL thing better. Here we go. A fair majority of all of the metrics that dictate ...
user avatar
  • 32.5k
7 votes

Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key

Use OpenSSL's speed command to benchmark the two types and compare results. Here's an example command to run on the server to compare only the key types and sizes you mention: openssl speed rsa2048 ...
user avatar
  • 2,241
7 votes

Are indexed Wordpress admin pages a security threat?

Google doesn't want to index non-content pages including admin pages and pages that ask you to login. Putting wp-admin in robots.txt is better for SEO because it will usually prevent the page from ...
user avatar
7 votes

Is a "Show Password" option on login form safe?

Apart from the obvious security issue of someone else being able to physically see what password you are typing - which the user would be aware of anyway - there are a few security "concerns" that ...
user avatar
  • 40.9k
6 votes

Force Using SSL on Site now?

HTTPS can achieve three things: Authenticity. Making sure that you are communicating with the real domain owner. Confidentiality. Making sure that only this domain owner and you can read the ...
user avatar
  • 21.4k
6 votes

How to hide existence of a private blog?

1. Serverside - block Search Engines Create a robots.txt file in your root directory and add this text to it: User-agent: * Disallow: / Theoretically, This should block all search engines (the ones ...
user avatar
  • 669
6 votes
Accepted

What are the Pros and Cons for password recovery change links in email?

If you're emailed your password and three months later someone gets access to your email, they can get into your account (unless you've changed the password, which is unlikely). If you're emailed a ...
user avatar
  • 2,211
6 votes

Parallel website running a copy of my original website

Not all countries have strong copyright laws. This is unfortunate. In the U.S. and Europe, there are legal actions you can take. In India (I may be assuming too much here), I have no idea. I suggest ...
user avatar
  • 32.5k
6 votes
Accepted

What is SymLinksIfOwnerMatch?

From the Apache docs SymLinksIfOwnerMatch The server will only follow symbolic links for which the target file or directory is owned by the same user id as the link. So, enabling this option (as ...
user avatar
  • 40.9k

Only top scored, non community-wiki answers of a minimum length are eligible