Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [shared-hosting]

A web hosting service where multiple independent websites are served by the same machine.

1
vote
0answers
54 views

Breach of HTTPS shared server URLs sent through secure email

I host some simple services for my own use on a commercial shared hosting server. These URLs are cryptic and not easily guessed, and the query strings tend to be long and cryptic. The web services are ...
0
votes
0answers
25 views

How to remove malware from entire shared hosting account

My shared hosting account was infiltrated and all files infected. Is there any way to disinfect the entire account?
16
votes
2answers
1k views

Dealing with spam scripts as a shared hosting operator, with users who host mail externally

Assume the following setup; A shared hosting server, sharing a single IP with many small websites. A subset of the set of websites is sending e-mails. Some of those e-mails may be to their own ...
0
votes
1answer
55 views

Security requirements for commingling systems

Are there federal regulations/requirements that prohibit such commingling of Private systems and CUI(CUI - Controlled Unclassified Information) storage systems? I am looking at CFR-2017 title32, vol6,...
2
votes
0answers
96 views

Digital Ocean WordPress droplet security precautions

I'm a front-end and WordPress developer. A week ago a number of my sites got hacked on shared hosting. The sites were built to a high standard, from scratch, using Underscores. I only use a small ...
1
vote
0answers
47 views

How to tell if my hosting data is valid or a fake copy

I'm investigating an issue where we have consistent performance issues with our company web host and bad statistcs data in our hosting console. Our hosting provider console says our IP address is one ...
44
votes
3answers
6k views

How do hosting providers prevent the compromise of one website from causing the compromise of another one?

Could one create a vulnerable website on purpose to attack a server of a hosting provider? So in the question above which I recently asked we came to the conclusion that preventing one vulnerable ...
7
votes
2answers
491 views

Could one create a vulnerable website on purpose to attack a server of a hosting provider?

Is it possible for a vulnerability in one application to be exploited to attack another application on the same server? So according to the answer to the question above it is possible that when one ...
1
vote
2answers
388 views

Identifying website attack type (Meuhy.php)

We have a few sites hosting on a Media Temple (MT) shared server. This morning, we noticed that some of our website were down. Upon investigation, we realized that they had been compromised. The ...
0
votes
0answers
97 views

How to stop autogenerating PHP malware on GoDaddy shared hosting?(signature-index.html.bak.bak favicon_**.ico) [duplicate]

I have a GoDaddy shared hosting that has been infected by PHP malware. Every day it autogenerates and renames my index.html to index.html.bak.bak and creates a index.php with the following code: <?...
13
votes
4answers
5k views

Accessing multiple sites via HTTPS produces different, unrelated content (Peugeot club via HTTPS)

I've come across a random website Moodoo.cz. The interesting thing is that if you access it via the HTTPS: Moodoo.cz, the content completely changes. It is not that unusual - I guess server can serve ...
0
votes
0answers
320 views

How to permanently remove malware from a website

i'm really tired of some malware on my shared hosting sites. Most of the websites are based on wordpress and the files are always getting modifies with codes like the following: x47\x4c\x4fB\x41\x4c\...
1
vote
1answer
524 views

Host header attacks: Possible exploits

We have an API server hosted with amazon elb. The server has only one virtual host and hence it doesn't enforce Host header. But if we manually add a Host header along with the request with a valid ...
3
votes
1answer
608 views

Will disabling “symlink” in PHP.ini prevent attackers from attacking other websites?

I have a small shared server where couple of websites are hosted, so I'm not sure if this kind of protection will be enough to prevent attackers from executing symlink attack. I've added symlink to ...
1
vote
2answers
564 views

Shared hosting is hacked [duplicate]

My shared hosting with GoDaddy was hacked by injecting a PHP file (deade6.php) that is recreated every time I delete it. I also tried to modify the .htaccess but it gets recreated as follows: <...
6
votes
3answers
1k views

Any threats from isolated subdomain (controlled by hacker)?

I have a domain and a subdomain (on the same hosting) with isolated, jailed directories (no ability to go from one to another) and separate user accounts, as if they were two different domains (has ...
28
votes
3answers
3k views

Pentesting against own web service hosted on 3rd party platform

I want to pentest websites and services programmed by our company, which is fine as long as we test it on our own infrastructure. What are the (legal) implications when pentesting our services once ...
4
votes
0answers
52 views

Which level of permission and type of encryption could be used on a NAS to be secure but usable? [closed]

I need to use a NAS to stock data (from personal git and other type of service). 7777 is very permissive but it seems that the 0640 actually in use is not enough to works correctly with the services. ...
0
votes
3answers
149 views

Shared hosting— whose responsibility is dealing with known vulnerabilities?

I've deployed a few dozen Wordpress sites over the last 10 years across a variety of hosts. I have a single client on a particular host I've never used before whose Wordpress site has been hacked ...
8
votes
5answers
4k views

How can a PHP file be added over and over to my hacked site?

I'm on a shared hosting plan (I know, I know) on GoDaddy and all the files in it have been hacked. There are multiple sites in the plan, each of them has a folder. The folders and sub-folders of each ...
4
votes
2answers
1k views

Is it safe to use Memcached in a shared hosting environment?

The shared hosting I am using had Memcached enabled, I searched some forums that using Memcached in a shared hosting environment, can cause security problems like view the cache of the other user, ...
1
vote
1answer
1k views

How to determine whether an SSL certificate is single-domain or multi-domain

First of all I know this sounds really stupid, but I am going to explain the situation. I created an SSL certificate for a website at StartSSL. I created a regular Class 1 SSL Certificate for a web ...
1
vote
0answers
21 views

How to analyse a hacked server? [duplicate]

To be clear on of my server have been temporarily suspend because it was doing an DoS to another remote server. I was informed by the hosting company of the abnormal activity and I know what was the ...
137
votes
9answers
27k views

Hosting company advised us to avoid PHP for security reasons. Are they right?

I'm doing a redesign for a client who's understandably concerned about security after having been hacked in the past. I had initially suggested using a simple PHP include for header and footer ...
0
votes
1answer
39 views

Is there a way to guess a shared server's control panel's version?

I am performing research on the security of control panel software for shared hosting providers, and I am interested to know if there is a way to identify the version of the control panel software ...
1
vote
0answers
58 views

Bizarre php file appeared in the image gallery folder of my website [duplicate]

Can anyone tell what this is or how it could possibly have made it to the image gallery folder of my website? It appears to be a bunch of variable definitions. Mind you that a period "." is the concat ...
0
votes
0answers
128 views

shared hosted web server used as forward proxy

When setting up personal anonymous forward proxy server, different hosting can be chosen. In the case of shared hosting, web server, transformed into proxy server, shares it's IP with hundreds of ...
0
votes
0answers
69 views

How to block ftp password guessers in shared hosting?

Is this also possible for shared hosting to: 1.use a web software to block password guessing attempts 2.change ftp port 3.locking down access to specific source IP addresses If none of above is ...
5
votes
3answers
507 views

Recent hack appends to all javascript files

I have about 10 websites hosted on shared server by a2hosting, on apr 20 some of the js files for some of the websites were appended with a function that detects the device and if it is mobile it ...
12
votes
4answers
2k views

Is it possible for a vulnerability in one application to be exploited to attack another application on the same server?

If for example I have Magento-eCommerce and WordPress installed on the same server. Both have a database each with a different database username/password and both have different login details to the ...
2
votes
1answer
59 views

Is letting users run lslogins on a shared host a security risk?

I have an account on a shared host from which I run several websites, and I noticed that lslogins is working: I get a list of the other users on the machine, their UIDs, GIDs, time of last login, ...
2
votes
1answer
392 views

Secure MySQL data on hosted 3rd part server

I have an application that stores sensitive PII and financial data, and is hosted on a 3rd party server (typical web host). Anything sensitive is encrypted as it goes into the database, and I have no ...
18
votes
3answers
3k views

Will my hosting provider be able to see my SSL private keys?

I'm trying to learn the best way to implement a secure web and e-mail server. Getting SSL certificates is a must, but what happens with the private keys? I've seen that you have to store them on the ...
0
votes
1answer
189 views

Securing communication over LAN in VPS provider [duplicate]

I'm curious about best practice when connecting from app to DB in a cloud provider. A quick rundown of our setup. We have 4 servers all on the same provider, in the same region running as VPS. Ngnix ...
3
votes
1answer
2k views

How much of a security problem is PHP's proc_open() on a shared host

My company is developing a PHP system that needs to interact with Git on the server, which can currently most conveniently be done by allowing external calls via proc_open(), system() and the likes. ...
2
votes
1answer
83 views

Folder Access restriction in Shared Hosting

In shared hosting (where I don't have access to httpd.conf files) I want PHP files in "MyTargetFolder" to not have ability to access anything in upper directories. It needs some configuration like ...
17
votes
4answers
2k views

Server for School Coding Assignments

An introductory C++ course is offered every year in our university. In order for students to code in C++ and submit their assignments, we give them shell access to a Linux server. They use ssh to log ...
1
vote
2answers
335 views

Using free subdomains to circumvent web filtering systems

(I was told that this was the place to ask this by someone from Webmasters, if I've got it wrong again please give me a chance!) I'm running a personal proxy service for the use of myself and some of ...
2
votes
1answer
1k views

Looking for advice on storing sensitive information - Rails, Postgres, https, pg_crypto, Digital Ocean

A potential contract requires the following sensitive information to be persisted in a postgres database: Bank Account type (Uk/Int) Bank Account Number Bank Sort Code Passport Number Passport ...
8
votes
3answers
844 views

How private is RAM from other users on a VPS?

Can I safely assume that my RAM never can be accessed by another user on e.g. EC2 or Digital Ocean, if we suppose that I trust my provider and we don't consider possible bugs (such as Heartbleed) in ...
0
votes
0answers
825 views

Someone or something tried to login to my Gmail using IP address of my shared hosting

My Gmail told me someone tried to login with the correct password. But Gmail blocked it because the IP address used is different from my IP address. When I looked up the IP address that tried to login ...
1
vote
2answers
102 views

Hosting multiple websites on the same server - Prevention from DoS

I have an server which contains around 4 instances hosted on it. I am aware that if a DoS attack happens on one of the instances it will take down all the other instances too. How to prevent such a ...
1
vote
1answer
149 views

Compromised Wordpress Admin account risk

I am wondering what are the risks of a compromised Wordpress Admin account. Can the Wordpress Admin user cause any risk to the platform running the wordpress? For example, can the admin gain access ...
2
votes
2answers
395 views

Is there any security concern to host Wordpress on the main web server?

We have been hosting our Wordpress blog on a Linux virtual box, and our main web application on an IIS server. Our website is www.mainsite.com and the wordpress is on www.blog.mainsite.com. Now there ...
5
votes
2answers
776 views

SAQ A-EP Requirements for VPS Hosting

We are hosting a site on a self-managed Digital Ocean VPS ("Droplet") that will be taking payments via Stripe using their stripe.js API. According to PCI, we have determined that we fall under the SAQ ...
-1
votes
3answers
5k views

How to identify if my site is vulnerable to DOS/DDOS attacks? [closed]

I am hosting a site on a hosting server. How to identify whether my site is vulnerable to DOS/DDOS attacks?
3
votes
2answers
791 views

Shared hosting hacked. Should I report this to someone?

A malware file appeared on a friend's server as described in this question. It's a file called "images.php" that is designed to look like nothing important, whose sole function is to wait for an ...
-1
votes
1answer
4k views

Open ports and SSH Tunneling to shared hosting

I know your time is valuable so I'm not waiting for specific answers to my situation. I don't mind reading documentation, so pointers to something that converges would be greatly appreciated. I don't ...
3
votes
1answer
2k views

Visitors logs show \x80w\x01\x03\x01 the HNAP1

Can anyone tell me what this means? I'm on Bluehost with a shared server. [ip]71.63.199.72 [url]HNAP1 [size] 134 [status] 401 [method]GET [protocol] HTTP/1.1 [referring url] My server address [ip]71....
6
votes
5answers
1k views

Is storing plaintext passwords for email accounts any less bad? [duplicate]

I recently found out that the company I use for shared hosting stores passwords for email accounts in plaintext (they mentioned this to me incidentally, while troubleshooting another issue). They're a ...