New answers tagged apache
6
BEAST attack Vulnerable INSECURE (more info)
RC4 Yes PROBLEMATIC (more info)
These warnings are not directly related to your certificate. They're more about your SSL configuration. When a client connects to your server over SSL, the client and server will negotiate which protocols they want to use to exchange keys and encrypt data.
BEAST is a ...
4
You can see the same effect on https://www.comodo.com/
They have an EV certificate signed by themselves. Firefox trusts it:
but Chrome doesn't.
Chrome works fine with Verisign:
The problem here is likely that your browser doesn't trust your SSL certificate vendor. It's possible that you have messed up the configuration somewhere (chain ...
7
Generally, configuring PHP to execute all files (as your title says) is a bad idea, especially if your website has an upload functionality. Someone could simply upload a PHP file with the extension .jpg then execute it on your server, and your server is gone.
However, in your case, if users can't upload .html or .htm files (or .php, of course) then there's ...
4
According to the Apache manual "there are two reasons" why .htaccess files should not be used: Server Performance and Server Security. (I've not copied their extensive explanations here for brevity.) See: When (not) to use .htaccess files
In general, you should never use .htaccess files unless you don't have
access to the main server configuration ...
6
Disabling .htaccess doesn't in itself provide any additional security benefit to your website. As @Xander mentioned the primary reason I've seen .htaccess disabled is performance (although I would suspect the performance improvement is negligible in many cases).
However from the hosts perspective it could provide some security benefit, in that it may help ...
1
Disabling .htaccess does provide some protections. If an attacker can somehow modify .htaccess files in the web root, they can modify the server configuration, for example adding a handler so that .txt files are processed by PHP. If your server allows them to upload .txt files but not .php files, boom, they've just found a way to bootstrap themselves into ...
Top 50 recent answers are included
