Questions tagged [web-hosting]
A type of service that allows a website to be made accessible via the internet. Web hosting can consist of storage space plus access to a website running a variety of technologies all the way up to fully dedicated servers provided by a third party.
125
questions
132
votes
3
answers
15k
views
Is HostGator storing my password in plaintext?
I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.
I asked a customer care representative to help me add an SSL certificate to a site I host with them. ...
- 1,927
98
votes
10
answers
32k
views
If a provider sees the last 4 characters of my password, can they see it in full?
I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
- 1,222
34
votes
4
answers
9k
views
Domain about to expire. Afraid that new owners will spread malware
I have a domain that is about to expire. It was used for hosting my freeware which I do not maintain anymore but can still be found on shareware directories. The application points to my domain (...
- 2,473
33
votes
4
answers
9k
views
Why are SSL certificates an annual expense?
I understand SSL certificates cost money because of reputation: most/all web browsers have a limited list of companies that demonstrated they are trusted sources of SSL certificates and therefore don'...
- 2,392
28
votes
3
answers
5k
views
Pentesting against own web service hosted on 3rd party platform
I want to pentest websites and services programmed by our company, which is fine as long as we test it on our own infrastructure. What are the (legal) implications when pentesting our services once ...
- 589
21
votes
4
answers
5k
views
How to keep a shared web hosting server secure?
What are the ways of keeping a shared LAMP server secure, assuming SSH access is available for every user?
Edit: I am mainly thinking of securing the server from the users themselves and between ...
- 5,089
18
votes
6
answers
18k
views
Is showing your IP address in the URL a bad practice?
Someone told me that showing your IP address in a URL (like http://192.0.2.34/default.html) is easier to hack. Is that true? I could trace any domain name and get its IP number as well.
- 423
15
votes
3
answers
4k
views
VPS security best practice
I've just signed up for a linux VPS to host a website I've been creating and I need some advice on the best approach to secure it.
I've previously been hosting it off a VM in the house, but I want to ...
- 303
13
votes
4
answers
5k
views
Accessing multiple sites via HTTPS produces different, unrelated content (Peugeot club via HTTPS)
I've come across a random website Moodoo.cz. The interesting thing is that if you access it via the HTTPS: Moodoo.cz, the content completely changes. It is not that unusual - I guess server can serve ...
- 240
11
votes
3
answers
12k
views
What risks are involved in exposing our home computers over the public internet?
I'm currently running a webserver from home accessible on the public internet via a static IP. What kind of risks are there in doing so?
From what I understand, the setup will not allow connections ...
- 3,313
7
votes
3
answers
415
views
Should I store my intellectual property / code online?
As a hosting company we have gathered a busload of information over the years that are pretty much confidential. This information includes code, graphics, ERD diagrams, SEO strategies and so much more....
- 173
7
votes
2
answers
2k
views
Securely decommissioning a dedicated server
One of my dedicated hosting CentOS servers hit 12 years. I received an end-of-life notice on it, and I started receiving SMART errors as well. I guess it's time to let it go. But before I do, I'd like ...
- 1,233
7
votes
2
answers
2k
views
Manage SSL certificates for a multi-tenant website
We have given customers the option to allow custom domains which ultimately point to our server by changing the CNAME.
Some of our customers would like to have SSL enabled to their domain but I am ...
6
votes
3
answers
4k
views
My sites have been hacked by cpamatik.com , it passes all security checks with Google and Sucuri, but still redirects, any idea? [duplicate]
Almost all my sites got hacked by cpamatik.com virus
All CMS were up to date, plugins, modules etc..(Drupal and Wordpress) , some sites I have logged in to work on, but some sites I haven't touched ...
- 193
6
votes
1
answer
634
views
Find Security Flaws in My Payment Page
I've done some extensive research about how to secure your website from card fraud.
iFrames do a pretty good job of this, however, It can still be worked around from certain exploits.
Many payment ...
6
votes
2
answers
1k
views
How can bulletproof hosting be feasible?
Bulletproof Hosting Providers (BPHS) allow servers containing illegal porn,
malware, organized (cyber)crime, major spam and all this on the WWW?
If Spamhaus can block the entire subnet of such a ...
- 599
5
votes
3
answers
515
views
DoS by consuming all hosting trafic
Given a small website hosted on a small data plan, is it possible for someone to keep doing requesting for my website URL or just an image hosted on my website that will consume all my permitted ...
- 153
5
votes
1
answer
131
views
Should different web apps running on VDS each have their own user account?
I deployed my second rails app on my VDS with capistrano. Should I configure that application server to run as a different user, or the same as the first application?
If I run applications as ...
- 185
4
votes
2
answers
2k
views
Attack surface for a site that hosts only static content HTML and images?
What kind of attack surface is there for a site that only hosts static content: HTML, images, CSS? How can sites like this be successfully penetrated?
- 199
4
votes
3
answers
623
views
Completely mimimise the possibility of my web hosting account being hacked
I've just moved web hosting providers and I want a fresh, secure start. To a certain extent, I don't mind what I have to do I'm just fed up my account being hacked or infected. I just wondered how to ...
- 501
4
votes
1
answer
250
views
How to secure application VM?
This question is derived from my previous question on Isolating Web application where two approaches were recommended.
Apache Chroot Jail
Isolation through Virtualization
My question is if one of ...
- 4,844
4
votes
2
answers
523
views
Database Security
Would having the IP address and name of my database visible to the public be a security risk?
I have hosting with godaddy, a shared hosting plan. When I connect to my DB, via MS-SQL-MS, I can see the ...
- 151
4
votes
2
answers
432
views
Is there any danger in allowing users to host PDF/RTF/DOC files on my web server?
If I were to allow users to host arbitrary PDF/RTF/DOC files on my server all under the same name, but with different query strings would there be anything to worry about? I've heard of PDF/RTF ...
- 367
4
votes
3
answers
8k
views
How dangerous are outdated PHP versions for my clients?
In the company where I work (webhosting) our custoumers can choose the PHP version they want to use for their website.
However, I have just realized that all of the offered PHP versions are outdated ...
- 287
4
votes
1
answer
528
views
Recommendations for hosting highly sensitive data
I am doing some investigation on hosting sensitive data. Mostly finance and fund data but at a personal level. This will be a secure website where users will be able to login and view their fund ...
- 141
4
votes
1
answer
452
views
Android app using FTP
I have done some android programming (self taught). I have started working on an app idea. The idea is pretty much that people with the app installed can post pictures/videos and text which can be ...
- 143
4
votes
1
answer
196
views
I was the subject of a low-impact DNS attack. What do I need to do?
Recently, my website was subject to a DNS attack of sorts. I have my domain name (which I won't say here but should be pretty easy to find if you're interested) registered with Hostgator and set up ...
- 143
3
votes
3
answers
473
views
Suspicious "100% guaranteed" web hosting security package
Notes: I have very limited knowledge and experience in this field. My boss does not want to spend a penny more that what we already paid for. The website has a form that sends a message to our email ...
3
votes
2
answers
5k
views
"Premium SSL" vs "Stanard SSL" certificates - Any reason why I would want a "Premium SSL"? [duplicate]
Possible Duplicate:
What are the advantages of EV Certificate?
besides the green URL bar and free security scan and whatnot.
Our website does NOT accept any personal info other than email ...
- 41
3
votes
2
answers
1k
views
Risks of serving untrusted content under HTTP Content-Type: text/plain?
Am I gonna run into XSS attacks by doing this, or will a file download be prompted?
Are there security problems that would rise in a modern browser?
- 14k
3
votes
4
answers
4k
views
Is email forwarding an altogether unsafe practice?
Some folks like the idea of keeping the same email address for life. It permits a personal and permanent email address (e.g. [email protected]) even as you change internet service providers. You can ...
- 423
3
votes
3
answers
3k
views
Do I have a virus on my hosted site?
A few weeks ago I hired someone to build for me a very simple PHP site.
I bought PHP hosting and a domain name, and I gave him all the credentials together with the specification of his tasks.
When ...
- 399
3
votes
2
answers
666
views
How risky is having sensitive files on webroot?
I understand that having anything sensitive under webroot is not smart; someone may be able to access it via url. However, I do not have a choice with my web host (iPage) as they limit my server space ...
- 33
3
votes
1
answer
347
views
Are Anti DDoS server farms really effective?
I'm looking to host a web app in a datacenter and I'm considering a few options. All of them seem reputable and claim to offer Anti-DDoS protection.
If just about every hosting provider is offering ...
- 1,091
3
votes
1
answer
176
views
Secure Software Distribution: Is serving a file through HTTPS good enough?
I'd like to know whether HTTPS can be used as a secure means of software distribution.
Concretely, can I put up a file on a server making it accessible through a public HTTPS URL and be sure that it ...
- 143
3
votes
1
answer
156
views
How to know 3rd party ads are safe?
It seems many sites use 3rd party flash ads, those ads could be design to attack user.
Do those site know which ads are safe or not? Or they just transfer any ads to user browser?
In general, how to ...
- 31
3
votes
1
answer
1k
views
Does compromise of one cPanel / WHM account on a server mean the other accounts are at risk?
I have created multiple cpanel accounts using my server WHM panel.
As of now each domain has separate cpanel in my server.
If one of my cpanel (domain) hacked, does that mean other cpanel are hacked ...
- 131
3
votes
3
answers
301
views
Monitoring for security threats
I host and maintain several websites. The users pay to have their sites maintained and secured. However, with the amount of web applications like joolma, wordpress, ect... and their plugins, I need a ...
- 539
3
votes
3
answers
464
views
Dedicated Server in Cloud Environment - SSL Remote Login vs Dedicated VPN
Thanks for taking your time to look into this question.
Background
I have my website hosted in a dedicated server in the cloud. The server is a Windows 2008 R2 machine. To publish I FTP files to ...
- 131
3
votes
3
answers
154
views
Should my webhost show the root filesystem over FTP?
I use a commercial web host, when I log in via regular FTP this is how the directories looks like:
It seems strange that I can access system files, I thought I would be limited to access files ...
- 131
3
votes
1
answer
351
views
malware attack on my website may have started a SOCKS server - please advise [duplicate]
A website I do some volunteer work for was recently one of those affected by a wordpress plugin vulnerability.
Following advice in the answer to this question, which contains details of the attack, ...
- 133
3
votes
0
answers
427
views
Why exactly are self hosted websites deemed that dangerous? [closed]
Up to now I'm using a raspberry pi as a local server for trying out things or hosting my own little projects (beginner level), but I want to make it publicly available (most likely only for people I ...
- 71
3
votes
0
answers
151
views
Can I trace malicious email sent through a cloud hosting service?
Around the time my phone started acting like it was hacked, I was sent a suspicious email that opened automatically into a website without clicking on anything. I tracked it to a cloud hosting service....
- 31
2
votes
2
answers
2k
views
What is the ultimate goal of hacking a webserver? [closed]
Recently I noticed a lot of traffic generated by automated bots that were checking for vulnerabilities in my web server. They were mainly looking for ways to hack into plesk/wordpress which I don't ...
- 139
2
votes
2
answers
2k
views
Is it a real security benefit if a host uses static IP Addresses for authentication?
As my knowledge about information security is not THAT good and Google did not give me a satisfactory answer I would like to ask the community here:
I am working for a company offering online ...
- 151
2
votes
2
answers
3k
views
Dealing with the dangers of self-hosting a webserver?
Assuming for a self-hosted webserver:
the webserver only hosts a static html website
iptables is used to reject every IP except a few known ones
only Port 443 is forwarded and the website requires ...
- 71
2
votes
1
answer
285
views
Is internal or external hosting more secure? [closed]
I have been looking for a while to find out the number of malicious attacks that have been successful against internal vs externally hosted web and SQL solutions.
When I say internal, I mean the ...
- 29
2
votes
1
answer
1k
views
Can I use the same ssl cert to protect my web site and sign my app?
I'm considering buying an SSL cert from my web host provider (smarterasp.net)
They list the cert as :
SSL-S Comodo SSL Certificate - Single Domain or Subdomain
Do you know if I can use that ...
- 123
2
votes
3
answers
186
views
Creating a website to test my scanner that I scripted
Hi I looked around on Google and this site for about the last hour and I couldn't find anything that gave a direct answer to my question. I changed the code around in a scanner that I used in the past,...
- 39
2
votes
3
answers
781
views
What are the techniques to know if VPS cloud hosting provider is accessing my data?
Immutable laws of security: https://fossbytes.com/10-immutable-laws-security-microsoft/
If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore.
I understand ...
- 565