I'm programmer and I have a website that allows users to upload their HTML websites to it.

The user will zip up a folder and then will upload it to my website where it will show up as sub-domain.

I don't allow PHP files or some other extension (only HTML and some stuff)

The problem I have now is that there are some bad users who are trying to upload some HTML file with social engineering contents (Facebook login , PayPal, etc)

Now Google is sending me notifications about these harmful links and asks me to find a solution and remove this content.

As a programmer the only solution that i have is checking the file by myself manually and it's so hard to do that.

Anyone have a solution for this problem? I found some free hosting that detects some social engineering contents immediately, so some workable solution must exist.

  • 1
    You could look at blocking certain words from content, or at the very least, marking them for manual review before being visible. It's probably going to be an ongoing battle though...
    – Matthew
    Dec 15, 2016 at 10:34
  • The solution Matthew said is nice... you can do some kind of script to automatize that task. Look for that special words using regexps and you can do what you want when hits one... alert to the user or to you... direct delete (I don't recommend this), etc Dec 15, 2016 at 11:08
  • You could also pass any links you find through something like Google's Safe Browsing API - developers.google.com/safe-browsing
    – iainpb
    Jun 15, 2017 at 7:59

3 Answers 3


As long as you

  • allow javascript
  • or allow forms
  • or allow storage

then you are providing an exploitable asset for phishers.

As for detecting such sites...there are various approaches you can apply to catch the low hanging fruit such as word checking and bayesian filtering. You should also be monitoring your hids to see when new content appears.

But if it were me, I would also inject a (smallish) floating banner with something like "hosted by badr" into the html pages.


Assuming you have the ability to run scripts on the server, I would do a number of things.

Firstly make sure you have an agreement with any users to alter and/or delete their content for the purposes of security. You do that through terms and conditions of use and/or a standard contract. Also make sure that you have rock-solid disclaimers about content - it is strongly advised to get some legal advice. In some countries, you will need to register your site so you aren't liable for the content - e.g. USA.

Then set up an approval process for any uploaded content. As you are unlikely to want to do that by hand, amend whatever upload script you are using to make some checks on the unpacked HTML.

  • Unless you really want to allow it, remove or at least restrict what JavaScript can be embedded in the HTML.
  • If you can, only allow simplified HTML, for example:

    • No script tags
    • No embed tags
    • No IFrames
    • No data: urls
    • Limit the amount of obfuscation allowed (where code is replaced by HTML entities to hide what it is doing)
  • Finally, create a function that auto-reviews any URL's (href, src attibutes) and filters out any like the ones you mention (PayPal, etc.)

That is just an example list, you may well want to adjust to your own requirements.

  • thank you , the user has the full opportunity to upload what they want completely (except php ) because if i did what you said no one will use the website :) .My last solution is to get a notification if the script detect any paypal and facebook login keywords and after that i will check the files manually , Dec 15, 2016 at 23:09
  • OK, yes, notification could work - then you could check manually and fix as needed. Don't forget to ensure your Ts&Cs/Contracts are watertight though so you don't get into trouble if you need to kick someone out or if someone else discovers bad content and tries to sue. Dec 15, 2016 at 23:26

So you are acting as a hosting service for plain HTML sites with enabled scripting. You should have 2 different défense lines here.

As explained by Julian, first is a legal point: you must include in the usage terms clauses explaining that you reserve a right to immediately remove a hosted site if it does not respect your fair use terms. You could find examples for those in many ISP contracts. And still on a legal point of view and dependant on your country, you should make clear for the authorities that you are not responsable for hosted content. Maybe consult a lawyer here.

The second point is technic. There is no way to automatically detect a bad site in a 100% reliable way. You can only setup a bayesian filter that will research patterns that you find in bad sites. You should then manually review those that are above a certain threshold.

But beware, you must be able to be pretty quick to process a request from Google or from local authorities to stop a bad site. Failure to do so could lead to a global unreferencing of all your sites by Google, and possible legal actions against you - last part being highly dependant on your country...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .