Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [shared-hosting]

A web hosting service where multiple independent websites are served by the same machine.

Filter by
Sorted by
Tagged with
0 votes
0 answers
49 views

Are these cPanel processes malicious? [duplicate]

I have previously asked a question There's an expect.php file in all the git repositories of my web server, is this malicious? and this question is a further continuation if it. After investigating ...
Syed M. Sannan's user avatar
1 vote
1 answer
119 views

DDoS might be very unlikely to happen to my website but in any case a CDN that should protect from it slows my website [closed]

I humbly assume that DDoS is very unlikely to happen to my website. A CDN that should protect from it slows my website according to my personal experience and tests (perhaps only because of the ...
recursiveWithStyle's user avatar
1 vote
1 answer
201 views

Found PHP script with erratic code, htaccess kept resetting even if I change it

When I browse on my hosting account, I found the index.php of my website has some code embedded to it, in the beginning there was really long line containing erratic code. There was also two more ...
howardy3's user avatar
1 vote
1 answer
165 views

Can we detect other websites of a user on a shared hosting?

I use a shared hosting plan which allows me to add multiple websites with one account/purchase. I have one website in the same plan for my work, and one for personal works. I can see both of them in ...
Moradnejad's user avatar
1 vote
1 answer
330 views

Ways to detect CVE-2017-12419 intrusion

I have a free infinityfree.net web server that was vulnerable to CVE-2017-12419 for quite a big window of time. After fixing the gap and changing the passwords, what are some ways to detect if the ...
Pacerier's user avatar
  • 3,313
1 vote
1 answer
411 views

Remote host identification has changed - How do I know if it's an attack or not?

When connecting using SSH to a shared hosting provider I'm regularly using, I got this message today: WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! IT IS POSSIBLE THAT SOMEONE IS DOING ...
Magnus's user avatar
  • 253
2 votes
2 answers
3k views

What is the best file permission for .user.ini in hosting folder?

My hoster placed a .user.ini in my public_html. What is the recommended file permission be? Now it's 644.
cilapo1541's user avatar
2 votes
1 answer
2k views

Employ fscrypt to securely protect, from data-at-rest exposure, all files+data installed after an initial Linux system build?

Our team's goal We want to protect our sensitive data from being potentially data-at-rest exposed after we relinquish a Linux VPS (see below) provided by a hosting service. We're exploring simple(r) ...
Johnny Utahh's user avatar
2 votes
3 answers
570 views

Multiple wp-login.php attack on shared hosting

I am hosting more than 20 WordPress website on a single server. The server has other cms based websites too. For better security, I have used CloudLinux CageFS which encapsulates each customer. Even ...
Prakash's user avatar
  • 322
0 votes
2 answers
228 views

Differences between compromised shared hosting and dedicated/virtual hosting

My webspace has been compromised as explained on this answered question. While looking for advice on other q&a it seems to me in the answers it is assumed the compromised system is a full ...
Jaume Mal's user avatar
  • 123
2 votes
1 answer
550 views

Paypal and PCI Compliance

I currently manage a few of my client's websites on a couple shared hosting providers "A2Hosting" and "Interserver". My client wants to make a simple webstore and accept payments from said webstore. I ...
JJWillMC's user avatar
1 vote
0 answers
206 views

Breach of HTTPS shared server URLs sent through secure email

I host some simple services for my own use on a commercial shared hosting server. These URLs are cryptic and not easily guessed, and the query strings tend to be long and cryptic. The web services are ...
pseudon's user avatar
  • 1,430
15 votes
2 answers
1k views

Dealing with spam scripts as a shared hosting operator, with users who host mail externally

Assume the following setup; A shared hosting server, sharing a single IP with many small websites. A subset of the set of websites is sending e-mails. Some of those e-mails may be to their own ...
aphid's user avatar
  • 263
-1 votes
1 answer
164 views

Security requirements for commingling systems

Are there federal regulations/requirements that prohibit such commingling of Private systems and CUI(CUI - Controlled Unclassified Information) storage systems? I am looking at CFR-2017 title32, vol6,...
AgapwIesu's user avatar
  • 107
2 votes
0 answers
883 views

Digital Ocean WordPress droplet security precautions

I'm a front-end and WordPress developer. A week ago a number of my sites got hacked on shared hosting. The sites were built to a high standard, from scratch, using Underscores. I only use a small ...
Sam's user avatar
  • 176
1 vote
0 answers
126 views

How to tell if my hosting data is valid or a fake copy

I'm investigating an issue where we have consistent performance issues with our company web host and bad statistcs data in our hosting console. Our hosting provider console says our IP address is one ...
user avatar
45 votes
3 answers
7k views

How do hosting providers prevent the compromise of one website from causing the compromise of another one?

Could one create a vulnerable website on purpose to attack a server of a hosting provider? So in the question above which I recently asked we came to the conclusion that preventing one vulnerable ...
Just van der Veeken's user avatar
7 votes
2 answers
743 views

Could one create a vulnerable website on purpose to attack a server of a hosting provider?

Is it possible for a vulnerability in one application to be exploited to attack another application on the same server? So according to the answer to the question above it is possible that when one ...
Just van der Veeken's user avatar
1 vote
2 answers
977 views

Identifying website attack type (Meuhy.php)

We have a few sites hosting on a Media Temple (MT) shared server. This morning, we noticed that some of our website were down. Upon investigation, we realized that they had been compromised. The ...
Kellen's user avatar
  • 111
13 votes
4 answers
5k views

Accessing multiple sites via HTTPS produces different, unrelated content (Peugeot club via HTTPS)

I've come across a random website Moodoo.cz. The interesting thing is that if you access it via the HTTPS: Moodoo.cz, the content completely changes. It is not that unusual - I guess server can serve ...
Jeyekomon's user avatar
  • 240
1 vote
1 answer
1k views

Host header attacks: Possible exploits

We have an API server hosted with amazon elb. The server has only one virtual host and hence it doesn't enforce Host header. But if we manually add a Host header along with the request with a valid ...
Anonymous Platypus's user avatar
3 votes
1 answer
3k views

Will disabling "symlink" in PHP.ini prevent attackers from attacking other websites?

I have a small shared server where couple of websites are hosted, so I'm not sure if this kind of protection will be enough to prevent attackers from executing symlink attack. I've added symlink to ...
user134969's user avatar
  • 1,338
1 vote
2 answers
798 views

Shared hosting is hacked [duplicate]

My shared hosting with GoDaddy was hacked by injecting a PHP file (deade6.php) that is recreated every time I delete it. I also tried to modify the .htaccess but it gets recreated as follows: <...
user135353's user avatar
6 votes
3 answers
1k views

Any threats from isolated subdomain (controlled by hacker)?

I have a domain and a subdomain (on the same hosting) with isolated, jailed directories (no ability to go from one to another) and separate user accounts, as if they were two different domains (has ...
T.Todua's user avatar
  • 2,727
28 votes
3 answers
5k views

Pentesting against own web service hosted on 3rd party platform

I want to pentest websites and services programmed by our company, which is fine as long as we test it on our own infrastructure. What are the (legal) implications when pentesting our services once ...
knipp's user avatar
  • 589
3 votes
0 answers
110 views

Which level of permission and type of encryption could be used on a NAS to be secure but usable? [closed]

I need to use a NAS to stock data (from personal git and other type of service). 7777 is very permissive but it seems that the 0640 actually in use is not enough to works correctly with the services. ...
aurelien's user avatar
  • 253
0 votes
3 answers
283 views

Shared hosting-- whose responsibility is dealing with known vulnerabilities?

I've deployed a few dozen Wordpress sites over the last 10 years across a variety of hosts. I have a single client on a particular host I've never used before whose Wordpress site has been hacked ...
Ivan's user avatar
  • 6,328
9 votes
5 answers
11k views

How can a PHP file be added over and over to my hacked site?

I'm on a shared hosting plan (I know, I know) on GoDaddy and all the files in it have been hacked. There are multiple sites in the plan, each of them has a folder. The folders and sub-folders of each ...
Victoria Ruiz's user avatar
8 votes
2 answers
4k views

Is it safe to use Memcached in a shared hosting environment?

The shared hosting I am using had Memcached enabled, I searched some forums that using Memcached in a shared hosting environment, can cause security problems like view the cache of the other user, ...
Da Heel's user avatar
  • 101
1 vote
1 answer
4k views

How to determine whether an SSL certificate is single-domain or multi-domain

First of all I know this sounds really stupid, but I am going to explain the situation. I created an SSL certificate for a website at StartSSL. I created a regular Class 1 SSL Certificate for a web ...
Mihail Minkov's user avatar
1 vote
0 answers
21 views

How to analyse a hacked server? [duplicate]

To be clear on of my server have been temporarily suspend because it was doing an DoS to another remote server. I was informed by the hosting company of the abnormal activity and I know what was the ...
Manuel Leduc's user avatar
143 votes
9 answers
34k views

Hosting company advised us to avoid PHP for security reasons. Are they right?

I'm doing a redesign for a client who's understandably concerned about security after having been hacked in the past. I had initially suggested using a simple PHP include for header and footer ...
Yumecosmos's user avatar
  • 1,373
0 votes
1 answer
100 views

Is there a way to guess a shared server's control panel's version?

I am performing research on the security of control panel software for shared hosting providers, and I am interested to know if there is a way to identify the version of the control panel software ...
UserYmY's user avatar
  • 193
1 vote
0 answers
67 views

Bizarre php file appeared in the image gallery folder of my website [duplicate]

Can anyone tell what this is or how it could possibly have made it to the image gallery folder of my website? It appears to be a bunch of variable definitions. Mind you that a period "." is the concat ...
Aunt Jemima's user avatar
0 votes
0 answers
312 views

shared hosted web server used as forward proxy

When setting up personal anonymous forward proxy server, different hosting can be chosen. In the case of shared hosting, web server, transformed into proxy server, shares it's IP with hundreds of ...
sanjihan's user avatar
  • 639
5 votes
3 answers
897 views

Recent hack appends to all javascript files

I have about 10 websites hosted on shared server by a2hosting, on apr 20 some of the js files for some of the websites were appended with a function that detects the device and if it is mobile it ...
Anton Kastritskiy's user avatar
12 votes
4 answers
2k views

Is it possible for a vulnerability in one application to be exploited to attack another application on the same server?

If for example I have Magento-eCommerce and WordPress installed on the same server. Both have a database each with a different database username/password and both have different login details to the ...
user avatar
2 votes
1 answer
141 views

Is letting users run lslogins on a shared host a security risk?

I have an account on a shared host from which I run several websites, and I noticed that lslogins is working: I get a list of the other users on the machine, their UIDs, GIDs, time of last login, ...
user88034's user avatar
2 votes
1 answer
560 views

Secure MySQL data on hosted 3rd part server

I have an application that stores sensitive PII and financial data, and is hosted on a 3rd party server (typical web host). Anything sensitive is encrypted as it goes into the database, and I have no ...
Hearth's user avatar
  • 365
18 votes
3 answers
3k views

Will my hosting provider be able to see my SSL private keys?

I'm trying to learn the best way to implement a secure web and e-mail server. Getting SSL certificates is a must, but what happens with the private keys? I've seen that you have to store them on the ...
Aquiles Carattino's user avatar
0 votes
1 answer
283 views

Securing communication over LAN in VPS provider [duplicate]

I'm curious about best practice when connecting from app to DB in a cloud provider. A quick rundown of our setup. We have 4 servers all on the same provider, in the same region running as VPS. Ngnix ...
Cyph's user avatar
  • 101
4 votes
1 answer
7k views

How much of a security problem is PHP's proc_open() on a shared host

My company is developing a PHP system that needs to interact with Git on the server, which can currently most conveniently be done by allowing external calls via proc_open(), system() and the likes. ...
Borek Bernard's user avatar
2 votes
1 answer
251 views

Folder Access restriction in Shared Hosting

In a shared hosting I use (where I don't have access to httpd.conf files) I want PHP files in "MyTargetFolder" to not have ability to access anything in upper directories. It needs some configuration ...
T.Todua's user avatar
  • 2,727
15 votes
4 answers
2k views

Server for School Coding Assignments

An introductory C++ course is offered every year in our university. In order for students to code in C++ and submit their assignments, we give them shell access to a Linux server. They use ssh to log ...
Soban's user avatar
  • 289
1 vote
2 answers
551 views

Using free subdomains to circumvent web filtering systems

(I was told that this was the place to ask this by someone from Webmasters, if I've got it wrong again please give me a chance!) I'm running a personal proxy service for the use of myself and some of ...
NinjaKrill's user avatar
2 votes
1 answer
2k views

Looking for advice on storing sensitive information - Rails, Postgres, https, pg_crypto, Digital Ocean

A potential contract requires the following sensitive information to be persisted in a postgres database: Bank Account type (Uk/Int) Bank Account Number Bank Sort Code Passport Number Passport ...
Ross Kinsella's user avatar
8 votes
3 answers
2k views

How private is RAM from other users on a VPS?

Can I safely assume that my RAM never can be accessed by another user on e.g. EC2 or Digital Ocean, if we suppose that I trust my provider and we don't consider possible bugs (such as Heartbleed) in ...
anonymous's user avatar
0 votes
0 answers
1k views

Someone or something tried to login to my Gmail using IP address of my shared hosting

My Gmail told me someone tried to login with the correct password. But Gmail blocked it because the IP address used is different from my IP address. When I looked up the IP address that tried to login ...
Siti S Amira's user avatar
1 vote
2 answers
196 views

Hosting multiple websites on the same server - Prevention from DoS

I have an server which contains around 4 instances hosted on it. I am aware that if a DoS attack happens on one of the instances it will take down all the other instances too. How to prevent such a ...
Anonymous Platypus's user avatar
1 vote
1 answer
244 views

Compromised Wordpress Admin account risk

I am wondering what are the risks of a compromised Wordpress Admin account. Can the Wordpress Admin user cause any risk to the platform running the wordpress? For example, can the admin gain access ...
Goli E's user avatar
  • 915