LiteSpeed

Category: Security

Learn how LiteSpeed keeps your site secure. Protect your servers with already familiar mod_security rules while also taking advantage of a host of built-in anti-DDoS features, such as bandwidth and connection throttling.

Because LSWS’s event-driven architecture handles all connections with a single process (or a few processes), LiteSpeed is able to easily gather data about the number of connections or amount of bandwidth an IP is using. This allows the server to efficiently impose limits.

  • LSWS 5.0.3 Updated To Fix Forced SSL On Google Chrome Version 44.0.2403.89

    LSWS 5.0.3 Updated To Fix Forced SSL On Google Chrome Version 44.0.2403.89

    The latest Google Chrome version 44.0.2403.89 is currently redirecting all HTTP URLs to their HTTPS versions for certain web applications. This is caused by a bug in Chrome causing the “HTTPS: 1” header to be sent by default on every request. This is mainly causing problems for WordPress sites with the WooCommerce plugin installed as well as sites without HTTPS support. Because of WordPress and WooCommerce’s popularity, this bug may be affecting a large number of people.
    (more…)

  • LiteSpeed Web Server Now Protected Against Shellshock

    LiteSpeed Web Server Now Protected Against Shellshock

    Shellshock“Bigger than Heartbleed.” That’s what people are saying about Shellshock (CVE-2014-6271 and CVE-2014-7169). But LiteSpeed Web Server is now the only web server protect against Shellshock. (more…)

  • Unique LiteSpeed Features Fight Symbolic Link Hacking

    Unique LiteSpeed Features Fight Symbolic Link Hacking

    Broken chain

    LSWS boasts two unique features that block symlink hacks: a Follow Symbolic Link setting that cannot be overridden in .htaccess files and strict ownership checking. (more…)

  • LSWS 4.2.12 Fixes Newest OpenSSL Vulnerability

    LSWS 4.2.12 Fixes Newest OpenSSL Vulnerability

    This latest OpenSSL vulnerability affects all versions of OpenSSL, so it is suggested that all users upgrade to 4.2.12. (more…)

  • LiteSpeed Security Patch to Fix Heartbleed Bug in OpenSSL

    LiteSpeed Security Patch to Fix Heartbleed Bug in OpenSSL

    heartbleed logo

     

    LiteSpeed Web Server 4.2.9 was released this morning as a security patch to address the OpenSSL Heartbleed bug. (more…)

  • Atomicorp Announces LiteSpeed Support for ModSecurity Rules

    Atomicorp Announces LiteSpeed Support for ModSecurity Rules

    Atomicorp logo

    Atomicorp, developer’s of the Internet’s most trusted ModSecurity rules, has announced official support for LiteSpeed Web Server with their Realtime ModSecurity Rules. (more…)

  • Why Your HTTP Server Can’t Block SYN Floods (And What You Can Do)

    Why Your HTTP Server Can’t Block SYN Floods (And What You Can Do)

    SYN floods are back in vogue. As DDoS-ing becomes more and more of an industry and the resources necessary for an effective attack become more accessible, SYN flooding has become more popular. Unfortunately, LiteSpeed Web Server (or Apache or Nginx or Lighttpd or Cherokee or Jetty or Tomcat or …) can’t help you with SYN floods. Here’s why and what you can do (including signing up for our free anti-DDoS proxy service): (Check our wiki for simple steps to hardening your kernel against SYN floods. Both the wiki and this article are geared toward hardening a Linux kernel only.) (more…)

  • Closing the Loopholes: Disable CGI Override

    Closing the Loopholes: Disable CGI Override

    Many of our customers disable CGI on their servers because of the risks involved with running CGI: Poorly written CGI scripts can broadcast all kinds of sensitive information to the world. If a hacker, creeping in through a tiny security hole, can successfully upload a CGI script and make it work, they can get access (and even root access) to your server without much restriction. Or the hacker could be one of your clients (signed up with a stolen credit card, perhaps), and then s/he doesn’t need a security hole to run a malicious CGI script.

    There are definitely risks, but many web servers don’t give you a good way to neutralize them. On Apache, you can disable CGI in WHM by unchecking the ExecCGI box (Service Configuration > Apache Configuration > Global Configuration). Disabling CGI, though, does not mean that it stays disabled. Users can enable it using the Options directive Options +ExecCGI in a .htaccess file. (You could turn off the Options directive, but there are many legitimate uses as well — the index feature, for example.)

    This is why LiteSpeed has developed the Apache-style server-level configuration directive DisableCGIOverride. The Disable CGI Overrride directive makes it impossible for users to turn on or off CGI through .htaccess. It will keep that CGI on/off switch firmly where you left it. (If, for some reason, you don’t want any users to turn off CGI, this directive will keep it on.) For cPanel users, just paste the following directive into one of the includes in the Include Editor (Service Configuration > Apache Configuration > Include Editor) in WHM:

    <IfModule LiteSpeed>
DisableCgiOverride On
</IfModule>

    When the Disable CGI Override directive is On, users cannot enable or disable CGI.

    More safety, more control, yet another reason to choose LiteSpeed.

  • DDoS Update: GoDaddy EU Hit

    DDoS Update: GoDaddy EU Hit

    More DDoS attacks in the news, and now hitting something closer to home for most of our users: GoDaddy EU announced that a DDoS attack on Monday caused problems in their system for over 24 hours. (more…)

  • Be Very Afraid: DDoS Attacks in the News

    Be Very Afraid: DDoS Attacks in the News

    Sorry for the sensationalistic headline. We don’t want you to overreact. Yes, the Internet is dangerous now, but it’s always been a dangerous place. Below you’re going to find a bunch of articles pointing out just how dangerous the Internet is (and especially focusing on DDoS attacks) (more…)