Vulnerability, and security breach due to the use of your hosting service

hop

Hello developers, this is a complaint, I am very disappointed with the large number of errors on your hosting service, I don't see the point in buying anything on your hosting service, as it is outdated, works incorrectly, and as I discovered today, there are security breaches and a bug in the use of <iframe> for embedding my website on other websites. The FIRST BUG I discovered is that you have codes embedded in my website that load first, and then only the resources of my website, which means I cannot disable, fix, or remove this faulty function. I will now send you the code with the error: "<script>function toNumbers(d){var e=[];d.replace(/(..)/g,function(d){e.push(parseInt(d,16))});return e}function toHex(){for(var d=[],d=1==arguments.length&&arguments[0].constructor==Array?arguments[0]
,e="",f=0;f<d.length;f++)e+=(16>d[f]?"0":"")+d[f].toString(16);return e.toLowerCase()}var a=toNumbers("f655ba9d09a112d4968c63579db590b4"),b=toNumbers("98344c2eee86c3994890592585b49f80"),c=toNumbers("dec89881b7088bf3e9e71f81b3300360");document.cookie="__test="+toHex(slowAES.decrypt(c,2,a,b))+"; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/"; location.href="http://sv101.ifastnet.com/cookies.html";</script>". As you can see, there is a link to a redirect in your code, http://sv101.ifastnet.com/cookie.html, the problem is that it goes through http, not https, which is not secure and creates a more serious problem. In the console, when trying to display my website through <iframe>, the frame displays an error, MIXED CONTENT, and because of this, your resource is blocked, and my website does not load and does not work. I strongly recommend making everything https and checking everything. There is also another bad thing, the SECOND BUG, as you know, modern websites use the http/3 version, but here it is the oldest version, http/1.1, which is absurd. I have repeatedly written to you about this, but you ignored it. This is a complaint, you should fix this, as the rating of your hosting will never change and may even decrease due to these and other errors. I refused to buy an annual Ultimate subscription from you due to this. There is a lot of hidden information, suspicious content, many bugs, and incorrect operation. In general, I ask you to fix the first and second errors and to respond to my messages instead of ignoring them. Sincerely, Connor Grindevil.

konor

hop
Yes this is true, I have already sent Notifications to Developers of this hosting 😐

trisixtil

Has it been solved ?

Tyler

Hello,
This is not a security breach or vulnerability. The script you are seeing is part of the free hosting security system. It is added by the hosting platform to check that the visitor is using a real web browser with JavaScript and cookies enabled.

This system helps block bots, automated scripts, API tools, cURL, webhooks, and other non-browser traffic. Because of that, some things like iframe embedding, external requests, mobile apps, REST APIs, and validation tools may not work correctly on free hosting.

The __test cookie and redirects like ?i=1 are normal parts of this browser verification system. They are not added by your website code, and they do not mean your website has been hacked.

About the mixed content message, this can happen when the browser blocks the verification page inside an iframe or cross-site embed. Free hosting is mainly designed for websites opened directly in normal web browsers, not for embedding or external automated access.

About HTTP/1.1, seeing HTTP/1.1 does not mean there is a security breach. Aeonfree supports HTTP/2 over HTTPS, but some tools, browsers, or fallback connections may still show HTTP/1.1. HTTP/3 is not required for a website to be secure.

If you need API access, mobile app access, iframe embedding, automated tools, or less restrictive security rules, free hosting may not be the right option. In that case, you should use premium hosting, VPS hosting, or another service designed for those use cases.

So the issue you reported is expected behavior of the free hosting security system, not a bug or security breach.
Hope this answers your questions.