Hosting Web Hosting Security 2 — Questions and Answers
Question 1: What is a 'file permission' in Linux web hosting and why does it matter?
- The price charged for file storage
- A numeric code (like 755 or 644) that defines who can read, write, or execute a file, controlling access to sensitive files (Correct answer)
- A DRM system for copyrighted files
- An FTP connection permission setting
Correct answer: A numeric code (like 755 or 644) that defines who can read, write, or execute a file, controlling access to sensitive files
Linux file permissions (expressed as numbers like 755 or 644) control which users can read, write, or execute files, and incorrect permissions can expose sensitive files to unauthorized access.
Question 2: What is 'hotlinking' and why should hosting customers prevent it?
- A type of phishing attack
- When external websites embed your images directly using your server's URL, consuming your bandwidth and resources (Correct answer)
- A fast caching technique
- A CDN configuration method
Correct answer: When external websites embed your images directly using your server's URL, consuming your bandwidth and resources
Hotlinking occurs when other websites directly link to images or files on your server, causing those external sites to consume your hosting bandwidth and potentially driving up costs.
Question 3: What is the purpose of an 'IP blacklist' in hosting security?
- A list of servers to connect to for backups
- A list of known malicious IP addresses that are blocked from accessing your server (Correct answer)
- A list of approved email senders
- A log of all IP addresses that have visited your site
Correct answer: A list of known malicious IP addresses that are blocked from accessing your server
An IP blacklist in hosting security is a list of known malicious or suspicious IP addresses that the server or firewall automatically blocks from making requests.
Question 4: What does 'HTTP Strict Transport Security' (HSTS) do for a hosted website?
- Forces visitors to use a username and password
- Instructs browsers to only connect to your site over HTTPS, preventing protocol downgrade attacks (Correct answer)
- Caches static content on CDN nodes
- Enables HTTP/2 protocol support
Correct answer: Instructs browsers to only connect to your site over HTTPS, preventing protocol downgrade attacks
HSTS is an HTTP header that tells browsers to always use HTTPS when connecting to your site, preventing man-in-the-middle attacks that try to downgrade connections to unencrypted HTTP.
Question 5: What is 'directory listing' in web hosting and why should it be disabled?
- A sitemap of your website pages
- When a web server displays all files in a folder as a browsable list when no index file exists, potentially exposing sensitive files (Correct answer)
- A list of installed WordPress plugins
- The server's list of active virtual hosts
Correct answer: When a web server displays all files in a folder as a browsable list when no index file exists, potentially exposing sensitive files
Directory listing causes the web server to display all files in a folder as a clickable list when no index.html exists, which can expose sensitive files, backups, and configuration data.
Question 6: What does 'CSP' (Content Security Policy) protect against in web hosting?
- SSL certificate expiration
- Cross-site scripting (XSS) attacks by specifying which sources browsers are allowed to load scripts, styles, and other resources from (Correct answer)
- Server-side code injection
- DDoS attacks targeting your server
Correct answer: Cross-site scripting (XSS) attacks by specifying which sources browsers are allowed to load scripts, styles, and other resources from
Content Security Policy (CSP) is an HTTP header that restricts which sources a browser can load scripts, styles, and other resources from, significantly reducing XSS attack risk.
Hosting Web Hosting Security 2
What is a 'file permission' in Linux web hosting and why does it matter?