What is a website Drive-by Download Attack?
In simple layman’s terms a hacker or someone with malicious intentions or a malicious website will display a popup of some kind that is misleading and looks completely harmless. Example: A button that says “click to close” actually starts a download of malicious software/code to your computer. Drive-by Downloads can also be hidden in Frames on a legitimate website that does not have malicious intentions. Typically that website has been hacked and can infect your computer with malicious code. By adding this code below you can protect your website and your website visitors against Drive-by Download attacks.
What is a MIME Sniffing|Data Sniffing|Content Sniffing Attack?
MIME Sniffing is used in XSS attacks – Cross-Site Scripting attacks. Typically this method and type of attack is used on and only effective on websites that allow file uploads and content types are not specified or specified incorrectly. The hacker will upload a file and then use that file in an XSS exploit/attack. Even if your site does not allow file uploads this code below is good idea to use/have.
1. Copy the code below to this BPS Root Custom Code text box: CUSTOM CODE TOP PHP/PHP.INI HANDLER/CACHE CODE
2. Click the Save Root Custom Code button.
3. BPS Pro 11.9+ & BPS .53.8+: Go to the Security Modes page and click the Root Folder BulletProof Mode Activate button.
3. Older BPS versions: Go to the Security Modes page, click the Create secure.htaccess File AutoMagic button and activate Root Folder BulletProof Mode.
Notes:
• This code goes after php/php.ini handler .htaccess code (if you have php/php.ini handler .htaccess code) and before any caching .htaccess code (if you have any .htaccess caching code). The order would be: 1. php/php.ini handler .htaccess code, 2. the X-Content-Type-Options nosniff htaccess code and then 3. htaccess caching code in this Custom Code text box.
• If you add this code in an .htaccess file in an .htaccess file in the root of your hosting account, then this code will be applied to all of your websites under your hosting account. You would not need to add this code to any of your other sites.
<IfModule mod_headers.c> # Protects against Drive-by Download attacks # Protects against MIME/Content/Data sniffing Header set X-Content-Type-Options nosniff </IfModule>
Note: You can combine the MIME sniffing|Drive-by Download Attack Bonus Custom Code above with the External iFrame|Clickjacking Bonus Custom Code here: http://forum.ait-pro.com/forums/topic/rssing-com-good-or-bad/
<IfModule mod_headers.c> # Using DENY will block all iFrames including iFrames on your own website # Header set X-Frame-Options DENY # Recommended: SAMEORIGIN - iFrames from the same site are allowed - other sites are blocked # Block other sites from displaying your website in iFrames # Protects against Clickjacking Header always append X-Frame-Options SAMEORIGIN # Protects against Drive-by Download attacks # Protects against MIME/Content/Data sniffing Header set X-Content-Type-Options nosniff </IfModule>