I clicked View Source to see the code on my new infinity free site which only hosts one .html page. Instead of seeing the code I expected to see, I saw something like the following (see stackoverflow link below). aes.js links to obfuscated code so this is obviously malicious. When I clicked reload t…

It’s breaking my site by causing embedded youtube and gofundme widgets to not load. These are just standard cut-and-paste widgets provided by youtube and gofundme, nothing unusual. Why is the code obfuscated if it’s not malicious? Can it be fixed?

The system specifically prevents embedding to other websites. That’s the whole point. If you sincerely believes this is malicious then please just find somewhere else that suits your needs.

please elaborate why the point is to prevent embedding to other websites such as youtube and gofundme.

The system blocks clients that is not a browser. When other websites need to generate an embed for you, they need to fetch some data of your website by making a request. Most of these times these websites make a request with simple tools that is not a browser, so cannot run JavaScript or accept coo…

I believe there’s a miscommunication. The youtube embed is done with an iframe embed. The fetching is done by a web browser to a 3rd party site namely youtube.com . Youtube is not fetching any data from my web site.

OK so you’ve been a bit unclear. I thought you are going the other way around but actually no. In this case that script has no influence here, it’s not the culprit. Now if you try to embed a random YouTube video it may not work at all. This is because YouTube can reject embeding on their end. If …

I works fine after I click reload. It’s just the first time landing on the page that it isn’t working which is bad if visitors land on my site and it doesn’t load. I suspect that script I mentioned in my first post is causing the widgets to not load.

Technically it shouldn’t because all it does is set a cookie then check that cookie if it is set. The cookie’s name is called _test. Besides a GET parameter i is set so ?i=1. Technically it shouldn’t break because many people have successfully embeded a YouTube video here without problems… If you …

Thank you for your attention to this. My site is also proxied through cloudflare so is it possible that your cookie test and Cloudflare could be having a conflict with each other?

InfinityFree Forum

XSS worm on my InfinityFree site?

Hosting Support

Meishin March 22, 2026, 6:35am 2

Browser Security System - Features and Limitations Websites and PHP

InfinityFree uses a security system on all free hosting accounts to ensure your website is accessed by real web browsers, not bots or automated scripts. While this protects your site from malicious traffic, it can affect certain types of access. How the security system works The system checks that visitors can execute JavaScript and accept cookies: features that all modern web browsers support. This verification happens automatically and most website visitors will never notice it. You may occa…

show post in topic

Home
Categories
Guidelines
Terms of Service
Privacy Policy

Powered by Discourse, best viewed with JavaScript enabled