New answers tagged

0

For two of the installations I manage (so the more talented coders don't have to delve into more time-consuming server administration), I have some web-facing phpMyAdmin installs locked to IP addresses. When we first installed mod_security, we had the issue of phpMyAdmin triggering the SQL injection mechanisms, because that's how it works: it provides mass ...


2

There are tools like Fail2Ban that temporarily restrict access from IPs that have tried for non-existing files in a short time range too often (it is configurable what "too often" means exactly). This will reduce the scanning traffic on your site, but as @fleitner already wrote, you cannot exclude it completely.


0

If you want to make sure that the files are not executed, then the best way is to not let users access the files directly. "But how do you download them if you cant access them?" you might ask. Answer is that you provide a public facing download script that fetches the local file and presents it as a forced download to the user. You can look at this to see ...


3

That is just normal background traffic. All domains are crawled all the time in order to find common vulnerabilities: Unsecured or default passworded admin areas (like the wp-admins.php in your listing) Files containing credentials (config.php) Files or directories that are publicly available but not linked on the page (resulting in some people thinking ...


2

Nuke it from orbit! An attacker compromised your server. It's no longer your server. re-Install the OS, fix the vulnerability in your application and then re-deploy


Top 50 recent answers are included