Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

A system whose primary function is to deliver web pages on request to clients. This includes as a core the delivery of HTML documents as well as any additional content that may be included by a document, such as images, style sheets and scripts.

Many web servers also support server-side scripting, e.g., Apache HTTP Server and PHP. This means that the behaviour of the web server can be scripted in separate files, while the actual server software remains unchanged. Usually, this function is used to create HTML documents "on-the-fly" as opposed to returning fixed documents. This is referred to as dynamic and static content respectively. The former is primarily used for retrieving and/or modifying information from databases. The latter is, however, typically much faster and more easily cached.

Web servers can also be found embedded in devices such as printers, routers, webcams and serving only a local network. The web server may then be used as a part of a system for monitoring and/or administrating the device in question. This usually means that no additional software has to be installed on the client computer, since only a web browser is required (which now is included with most operating systems).

(core info from wikipedia)

935 questions
124
votes
7 answers

Is using Git for deploying a bad practice?

I tend to use Git for deploying production code to the web server. That usually means that somewhere a master Git repository is hosted somewhere accessible over ssh, and the production server serves that cloned repository, while restricting access…
Septagram
  • 1,343
  • 2
  • 9
  • 5
105
votes
11 answers

Best practices for Apache Server hardening?

What are some best practices, recommendations, required reading for securing an Apache Server?
Eric Warriner
  • 3,251
  • 3
  • 24
  • 20
94
votes
5 answers

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

On the advantages side, I see several benefits to using the Let's Encrypt service (e.g., the service is free, easy to setup, and easy to maintain). I'm wondering what, if any, are the disadvantages to using Let's Encrypt? Any reasons why website…
93
votes
7 answers

Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's are trying to hack my SSL port or are looking for…
microwth
  • 2,101
  • 2
  • 14
  • 19
81
votes
13 answers

What are the pros and cons of site wide SSL (https)?

What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
Olivier Lalonde
  • 5,039
  • 8
  • 31
  • 35
77
votes
6 answers

Should I reject a CSR when the host emailed me the private key for SSL certificate request?

I just requested a CSR from my shared web hosting provider, to generate a certificate which I will send back to them to install. (The certificate itself is to be generated properly by an organisation I work for who can provide certificates for our…
scipilot
  • 873
  • 1
  • 6
  • 8
76
votes
4 answers

"Optimal" Web Server SSL Cipher Suite Configuration

Over the last couple of years there have been a number of changes in what would be considered an optimal SSL cipher suite configuration (e.g. the BEAST and CRIME attacks, the weaknesses in RC4) My question is, what would currently be considered an…
Rory McCune
  • 60,923
  • 14
  • 136
  • 217
76
votes
8 answers

Is running "apt-get upgrade" every so often enough to keep a Web-server secure?

Assumptions: Normal LAMP Web-server running web app. (Eg. AWS EC2+Apache2+MySQL+Php7) Not directly targeted by some super-hacker or governmental organisation etc. Related to point above, no social engineering and the web app itself is…
MPS
  • 911
  • 1
  • 7
  • 12
65
votes
5 answers

Why is passing the session id as url parameter insecure?

I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and argued that Paypal, for example, is passing the…
Jonathan Egerton
  • 815
  • 1
  • 8
  • 6
61
votes
4 answers

I think I accidentally DoS'd a website. What should I do?

I was browsing a website, and stumbled across a sample scheme for password-protecting web pages. The owner of the website specifically had a page that invited people to attempt to hack it. I wanted to give it a try, so I wrote up a quick python…
Michael0x2a
  • 721
  • 1
  • 5
  • 9
60
votes
15 answers

How is "hacking" even possible if I "defend" properly?

On a Linux-based server, I follow basic practices as below: Make the admin account password long and complicated enough (i.e. theoretically speaking, password cannot be cracked within reasonable time). Monitor all incoming network traffic to the…
J. Berman
  • 603
  • 5
  • 6
58
votes
2 answers

What should end-users do about Heartbleed?

What should a website operator do about the Heartbleed OpenSSL exploit? mainly talks about what people running websites should do about Heartbleed. What should end-users of websites be doing? Do they need to change their passwords? If so, should…
Andrew Grimm
  • 2,100
  • 2
  • 20
  • 27
57
votes
8 answers

Brutalized VPS recovery data now available. Considerations?

Backstory My sites and VPS were stolen from me. The hosting company and I were locked out and unable to access it. They weren't able to create a temp password for access because the attacker blocked it. The last time I was logged into WHM, root…
56
votes
4 answers

Strange requests to web server

I have a Linode VPS running Nginx, which currently serves only static content. Once I was looking at the log and noticed some strange requests: XXX.193.171.202 - - [07/Aug/2013:14:04:36 +0400] "GET /user/soapCaller.bs HTTP/1.1" 404 142 "-" "Morfeus…
Michael Pankov
  • 671
  • 1
  • 5
  • 6
54
votes
5 answers

Should I disable HTTP HEAD requests?

I have seen increased 'HEAD' requests in my webserver access.log. What are these requests for? Should I disable this method in my webserver configs?
hnn
  • 997
  • 2
  • 8
  • 12
1
2 3
62 63