CE Phoenix Cart Forum

Hopefully someone with a bit more knowledge than me may have the answer to this. I have googled the life out of it, and it does appear to be something that is done.

I have had a few customers report that Malwarebytes is reporting my website as unsafe and compromised. The report included an IP address which I think was for the server not the website in particular.

I contacted the hosts about this. At first, in typical host fashion, the hosts would not agree that there was a problem and pointed me to another site where the report showed the server as being clean and safe. After a bit of going backwards and forwards they added a line of code to the htaccess file in the root. This is what they added
I have never had anything like this in that file before. Is this something that needs doing and is safe to do, or is it more of a sticking plaster to cover a problem.

Hi,
this might be a good explanation:
https://help.dreamhost.com/hc/en-us/art ... ity-policy

Kind regards
Christoph

14Steve14 wrote: ↑Thu Sep 29, 2022 8:54 am Malwarebytes is reporting my website as unsafe and compromised.

With these things, the exact message is important.

14Steve14 wrote: ↑Thu Sep 29, 2022 8:54 am

Code: Select all

Header always set Content-Security-Policy: upgrade-insecure-requests

This says that if someone tries to go to http://www.example.com/ then it will automatically change it to https://www.example.com/ -- as settings go, it's pretty harmless. Whether it has anything to do with what Malwarebytes is saying, I don't know.

ecartz wrote: ↑Thu Sep 29, 2022 8:41 pm

14Steve14 wrote: ↑Thu Sep 29, 2022 8:54 am Malwarebytes is reporting my website as unsafe and compromised.

With these things, the exact message is important.

14Steve14 wrote: ↑Thu Sep 29, 2022 8:54 am

Code: Select all

Header always set Content-Security-Policy: upgrade-insecure-requests

This says that if someone tries to go to http://www.example.com/ then it will automatically change it to https://www.example.com/ -- as settings go, it's pretty harmless. Whether it has anything to do with what Malwarebytes is saying, I don't know.

Thanks @ecartz
I dont have the actual message that Malwarebytes produced. We initially installed a 7 day trial of the full version of Malwarebytes and we got a message saying something along the lines that the website has been compromised and could be a potential risk. The user then has to click a button to access the site. That happened on both the front end and the back end. I have since had several customers report the same thing from a warning they are receiving from Malwarebytes. The problems seem to have been apparent only recently.

The report for the IP address that is included in the warning message can be seen at https://www.abuseipdb.com/check/198.244.203.91. (purposely not a link|)

The hosts checked on a difference website and by the looks of it the IP address is listed. See https://mxtoolbox.com/SuperTool.aspx?ac ... n=toolpage. They seem to think this is nothing to worry about. May be time to get them to move the website to another server, or even change hosts.

14Steve14 wrote: ↑Fri Sep 30, 2022 8:02 am The report for the IP address that is included in the warning message

That report is saying that your IP, which may be used by multiple sites, is associated with someone doing port scans. The only ways to fix that are

1. For the host to convince the report site that they have barred whomever was doing the port scans from their server.
2. To change to a different IP.

We of course have a number of certified hosts who would presumably be happy for your business and would give you a new IP. You could replace the IP in that URL with the new IP to see if there have been problems reported on that IP before actually transferring the site. You might have to pay them for a month's hosting before they tell you the new IP.

It's also possible that your existing host may be able to switch you to a different IP, even on the same server. You'd also need to change your DNS to match, but that would likely be easier than changing hosts.

Basically, either the host fixes it (possibly with some DNS help from you) or you change hosts. (Assuming this is important enough to you that you feel the need to fix it.) If trying to get the host to fix it, I would emphasize that some customers are not able to access the site.

The problem shown in the URL that you posted has nothing to do with the .htaccess code that you posted. That .htaccess code ensures that people using the website use secure communications between their computers and the site. The IP abuse report is claiming that people are running malicious code on the same server where your site is stored. That's what they mean by the server being compromised.

Note that it is possible for a server to be set up such that one site does not have access to the code from another site. It's also possible for a server to be set up such that access to one site works for everything.