Nimbusec Website Security Monitor Issue Types (Short)
Malware
Name
Event
Description
Malware
malware
Malicious code fragments are found on a Web page. Typical examples would be, amongst others, credit card skimmers, crypto miners or tech scams.
SEO-Spam
seospam
If changes on a website are detected while acting as 'googlebot' instead of the default browser agent a warning for suspicious behavior is created
Web Shell
webshell
Malicious code patterns are found in source files based on behaviour patters and signature database of the Nimbusec server agent
Application
CMSOutdated VersionApplication |
cms-version
An application running on an outdated verrsion has been found on the website
CMSVulnerable VulnerableApplication
cms-vulnerable
An application with a possible vulnerability has been found on the website
CMS Tampered
cms-tampered
Core file of WordPress change and are only generated by Nimbusec's server agent. However, Nimbusec cannot not distinguish between legitimate and malicious changes.
TLS
tls-protocol
Unsafe TLS protocol allowed in configuration
TLS Ciphersuite
tls-ciphersuite
Unsafe TLS cipher allowed in configuration
TLS Sigalg
tls-sigalg
Outdated hash algorithm was used in the creation of the certificate
TLS Notrust
tls-notrust
Untrasted root certificate
TLS Hostname
tls-hostname
Hostname or alternative name does not match the certificate
TLS Expires
tls-expires
The TLS certificate will expire soon or has already expired
TLS Legacy
tls-legacy
Symantec legacy certificate in use
TLS Misconfigured Chain
tls-misconfigured-chain
The received certificate chain was incomplete or misconfigured
TLS Revoked Cert
tls-revoked-cert
The certificate was revoked
No HTTPS Redirect
no-https-redirect
HTTP website does not redirect to HTTPS
Content
defacement
The visual appearance of a website was changed to distribute social, political or just for fun messages to the visitor
Content Violation
content-violation
Changes of the content of a Web page are detected. These change may be intended by the website owner or may be the result of a malicious attack. However, Nimbusec does not distinguish between legitimate and malicious changes.
Blacklist
blacklist
The domain which is subject to review is found on blacklists monitored by Nimbusec
Reputation
suspicious-link-v2
Suspicious resources, based on blacklists monitored by Nimbusec, are embedded (but not loaded) on a Web page. A typical example of this type of event would be a link (a-tag) which points to a suspicious domain found in the Nimbusec blacklist.
Suspicious Request
suspicious-request
A suspicious resource, based on blacklists monitored by Nimbusec, is actively loaded by a Web page. A typical example of this type of event would be a JavaScript source which points to a suspicions domain.
Configuration
When a web server’s directory listing is enabled, anyone can browse the contents of folders (e.g., `/files/`) instead of being restricted to specific pages.
php Error
config-phperror
When PHP error messages are shown directly to users instead of being logged securely.
public config
config-public
Apache status pages are checked for public accesibillity.
Security Header config
config-secheads
Will be shown if SHR rating is grade "D" or lower.
(missing or improperly configured HTTP security headers, such as Content-Security-Policy, Stricy-Transport-Security or X-Frame-Options)
Deprecated Header
config-header-deprecated
Text
SRI Missing
sri-missing
SRI Invalid
sri-invalid
Hijack Link
hijack-link
Hijack Resource
hijack-resource
