{"id":2764,"date":"2026-10-06T15:00:00","date_gmt":"2026-10-06T12:00:00","guid":{"rendered":"https:\/\/narhost.com\/blog\/?p=2764"},"modified":"2026-09-26T23:17:46","modified_gmt":"2026-09-26T20:17:46","slug":"xss-nedir","status":"publish","type":"post","link":"https:\/\/narhost.com\/blog\/xss-nedir\/","title":{"rendered":"XSS Nedir, Web Sitesinde Nas\u0131l \u00d6nlenir ve Neden Tehlikelidir"},"content":{"rendered":"<div id=\"ai-ozet\" class=\"ai-box\">\n<p class=\"ai-box-title\">K\u0131saca \u00f6zet<\/p>\n<ul>\n<li>XSS nedir sorusunun k\u0131sa cevab\u0131: sald\u0131rgan\u0131n bir web sayfas\u0131na kendi beti\u011fini yerle\u015ftirmesi ve bu beti\u011fin sayfay\u0131 a\u00e7an ziyaret\u00e7inin taray\u0131c\u0131s\u0131nda, sitenin yetkisiyle \u00e7al\u0131\u015fmas\u0131d\u0131r.<\/li>\n<li>\u00dc\u00e7 t\u00fcr\u00fc vard\u0131r: veritaban\u0131na kaydedilip herkese g\u00f6sterilen stored, ba\u011flant\u0131 \u00fczerinden tek ki\u015fiye yans\u0131yan reflected ve tamamen taray\u0131c\u0131da olu\u015fan DOM tabanl\u0131 XSS.<\/li>\n<li>En s\u0131k sonu\u00e7lar\u0131 oturum \u00e7erezinin \u00e7al\u0131nmas\u0131, y\u00f6netici panelinde i\u015flem yapt\u0131r\u0131lmas\u0131, sahte giri\u015f formu g\u00f6sterilmesi ve ziyaret\u00e7inin ba\u015fka siteye y\u00f6nlendirilmesidir.<\/li>\n<li>Kal\u0131c\u0131 \u00e7\u00f6z\u00fcm \u00e7\u0131kt\u0131 ka\u00e7\u0131\u015flamad\u0131r: kullan\u0131c\u0131 verisi sayfaya bas\u0131l\u0131rken ba\u011flam\u0131na g\u00f6re zarars\u0131z metne \u00e7evrilir.<\/li>\n<li>\u0130\u00e7erik G\u00fcvenli\u011fi Politikas\u0131 (CSP) ba\u015fl\u0131\u011f\u0131, ka\u00e7an bir a\u00e7\u0131kta bile tan\u0131mad\u0131\u011f\u0131n\u0131z betiklerin \u00e7al\u0131\u015fmas\u0131n\u0131 s\u0131n\u0131rlar.<\/li>\n<li>WordPress sitelerde XSS a\u00e7\u0131klar\u0131n\u0131n \u00e7o\u011fu eklenti ve temalardan gelir; g\u00fcncelleme ve az eklenti en etkili \u00f6nlemdir.<\/li>\n<\/ul>\n<\/div>\n<p>Yorum onay\u0131 bekleyen bir mesaj\u0131 a\u00e7t\u0131n\u0131z ve ard\u0131ndan y\u00f6netici panelinde tan\u0131mad\u0131\u011f\u0131n\u0131z bir kullan\u0131c\u0131 olu\u015ftu. Ya da ziyaret\u00e7ileriniz sitenize girdiklerinde bir anl\u0131\u011f\u0131na ba\u015fka bir sayfaya y\u00f6nlendirildiklerini s\u00f6yl\u00fcyor. Bu t\u00fcr \u015fik\u00e2yetlerin arkas\u0131nda s\u0131k g\u00f6r\u00fclen a\u00e7\u0131klardan biri XSS&#8217;tir. XSS nedir diye bakt\u0131\u011f\u0131n\u0131zda kar\u015f\u0131n\u0131za \u00e7\u0131kan tan\u0131mlar teknik g\u00f6r\u00fcn\u00fcr; site sahibi a\u00e7\u0131s\u0131ndan \u00f6z\u00fc \u015fu: sitenize g\u00fcvenen taray\u0131c\u0131, sald\u0131rgan\u0131n yazd\u0131\u011f\u0131 kodu sizin kodunuz san\u0131p \u00e7al\u0131\u015ft\u0131r\u0131r.<\/p>\n<h2>XSS Nedir, Taray\u0131c\u0131da Ne Olur<\/h2>\n<p>XSS, \u0130ngilizce Cross-Site Scripting ifadesinin k\u0131saltmas\u0131d\u0131r; T\u00fcrk\u00e7ede siteler aras\u0131 betik \u00e7al\u0131\u015ft\u0131rma denir. Taray\u0131c\u0131lar bir sayfadaki beti\u011fe, o sayfan\u0131n ait oldu\u011fu alan ad\u0131n\u0131n yetkilerini verir. Betik o alan ad\u0131n\u0131n \u00e7erezlerini okuyabilir, oturum a\u00e7m\u0131\u015f kullan\u0131c\u0131 ad\u0131na istek g\u00f6nderebilir, sayfan\u0131n g\u00f6r\u00fcn\u00fcm\u00fcn\u00fc de\u011fi\u015ftirebilir. Bu yetki sitenin kendi kodu i\u00e7in tasarlanm\u0131\u015ft\u0131r.<\/p>\n<p>A\u00e7\u0131k, site kullan\u0131c\u0131dan ald\u0131\u011f\u0131 bir veriyi sayfaya i\u015flemeden bast\u0131\u011f\u0131nda do\u011far. Bir yorum, arama kutusuna yaz\u0131lan kelime ya da ba\u011flant\u0131daki bir parametre sayfada g\u00f6sterilirken HTML olarak yorumlan\u0131rsa, i\u00e7ine g\u00f6m\u00fclm\u00fc\u015f betik de \u00e7al\u0131\u015f\u0131r. Taray\u0131c\u0131 bu beti\u011fin siteye mi sald\u0131rgana m\u0131 ait oldu\u011funu ay\u0131rt edemez. Ayr\u0131nt\u0131l\u0131 tan\u0131m ve \u00f6rnek t\u00fcrler <a href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\" title=\"OWASP Cross Site Scripting Prevention Cheat Sheet \u2014 resm\u00ee korunma rehberi\" target=\"_blank\" rel=\"noopener\">OWASP&#8217;\u0131n XSS \u00f6nleme rehberinde<\/a> yer al\u0131yor.<\/p>\n<div class=\"highlight-box\">\n<p class=\"label\">Bilgi<\/p>\n<p>SQL injection sunucudaki veritaban\u0131n\u0131 hedef al\u0131r; XSS ise ziyaret\u00e7inin taray\u0131c\u0131s\u0131n\u0131. Bu y\u00fczden XSS&#8217;te \u00e7o\u011fu zaman sunucu dosyalar\u0131n\u0131z sa\u011flam kal\u0131r, zarar ise kullan\u0131c\u0131lar\u0131n\u0131za ve y\u00f6netici oturumunuza y\u00f6nelir. \u0130ki a\u00e7\u0131\u011f\u0131n k\u00f6k\u00fc ortakt\u0131r: kullan\u0131c\u0131dan gelen veriye gere\u011finden fazla g\u00fcvenilmesi.<\/p>\n<\/div>\n<h2>Stored, Reflected ve DOM Tabanl\u0131 XSS Fark\u0131<\/h2>\n<p>XSS nedir sorusunun ikinci yar\u0131s\u0131 t\u00fcrlerdir. \u00dc\u00e7 t\u00fcr, beti\u011fin sayfaya nereden geldi\u011fine g\u00f6re ayr\u0131l\u0131r. Hangi t\u00fcrle kar\u015f\u0131 kar\u015f\u0131ya oldu\u011funuz, etkinin ne kadar yay\u0131laca\u011f\u0131n\u0131 ve d\u00fczeltmenin nerede yap\u0131laca\u011f\u0131n\u0131 belirler.<\/p>\n<table>\n<thead>\n<tr>\n<th>T\u00fcr<\/th>\n<th>Betik nereden gelir<\/th>\n<th>Kimi etkiler<\/th>\n<th>Tipik yer<\/th>\n<th>D\u00fczeltme nerede yap\u0131l\u0131r<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Stored (kal\u0131c\u0131) XSS<\/td>\n<td>Veritaban\u0131na kaydedilmi\u015f i\u00e7erikten<\/td>\n<td>Sayfay\u0131 a\u00e7an herkesi, y\u00f6neticiler dahil<\/td>\n<td>Yorumlar, profil alanlar\u0131, \u00fcr\u00fcn yorumlar\u0131, ileti\u015fim formu kay\u0131tlar\u0131<\/td>\n<td>Sunucu taraf\u0131nda \u00e7\u0131kt\u0131 bas\u0131l\u0131rken<\/td>\n<\/tr>\n<tr>\n<td>Reflected (yans\u0131yan) XSS<\/td>\n<td>Ba\u011flant\u0131daki parametreden, an\u0131nda<\/td>\n<td>Haz\u0131rlanm\u0131\u015f ba\u011flant\u0131ya t\u0131klayan ki\u015fiyi<\/td>\n<td>Arama sonu\u00e7 sayfas\u0131, hata mesajlar\u0131<\/td>\n<td>Sunucu taraf\u0131nda parametre sayfaya yaz\u0131l\u0131rken<\/td>\n<\/tr>\n<tr>\n<td>DOM tabanl\u0131 XSS<\/td>\n<td>Sayfadaki JavaScript&#8217;in i\u015fledi\u011fi veriden<\/td>\n<td>Haz\u0131rlanm\u0131\u015f ba\u011flant\u0131y\u0131 a\u00e7an ki\u015fiyi<\/td>\n<td>Adres \u00e7ubu\u011funu okuyan tek sayfa uygulamalar\u0131, filtre betikleri<\/td>\n<td>\u0130stemci taraf\u0131ndaki JavaScript kodunda<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Site sahibi i\u00e7in en tehlikelisi stored XSS&#8217;tir, \u00e7\u00fcnk\u00fc sald\u0131rgan\u0131n kimseyi kand\u0131rmas\u0131na gerek kalmaz. Zararl\u0131 i\u00e7eri\u011fi bir kez kaydeder; onay bekleyen yorumu inceleyen y\u00f6netici sayfay\u0131 a\u00e7t\u0131\u011f\u0131nda betik, y\u00f6netici yetkisiyle \u00e7al\u0131\u015f\u0131r.<\/p>\n<h2>XSS A\u00e7\u0131\u011f\u0131 Siteye ve Ziyaret\u00e7iye Ne Yapt\u0131r\u0131r<\/h2>\n<p>Etkinin s\u0131n\u0131r\u0131, beti\u011fin \u00e7al\u0131\u015ft\u0131\u011f\u0131 sayfada kimin oturum a\u00e7m\u0131\u015f oldu\u011fudur. S\u0131radan bir ziyaret\u00e7ide sald\u0131rgan kullan\u0131c\u0131y\u0131 sahte bir giri\u015f formuna ya da zararl\u0131 bir siteye y\u00f6nlendirebilir, sayfan\u0131n i\u00e7eri\u011fini de\u011fi\u015ftirebilir. Oturum \u00e7erezi beti\u011fe a\u00e7\u0131ksa, kullan\u0131c\u0131n\u0131n oturumunu kendi taray\u0131c\u0131s\u0131na ta\u015f\u0131yabilir.<\/p>\n<p>Y\u00f6netici taraf\u0131nda sonu\u00e7 a\u011f\u0131rla\u015f\u0131r. Betik, y\u00f6neticinin taray\u0131c\u0131s\u0131nda \u00e7al\u0131\u015ft\u0131\u011f\u0131 i\u00e7in y\u00f6neticinin yapabilece\u011fi her \u015feyi deneyebilir: yeni y\u00f6netici hesab\u0131 a\u00e7mak, eklenti y\u00fcklemek, tema dosyas\u0131n\u0131 d\u00fczenlemek. Bu noktada XSS, tam site ele ge\u00e7irmeye d\u00f6n\u00fc\u015f\u00fcr. Arama motorlar\u0131 da zararl\u0131 y\u00f6nlendirme yapan sayfalar\u0131 uyar\u0131yla g\u00f6sterebilir, bu da trafik kayb\u0131 demektir.<\/p>\n<div class=\"senaryo-block\">\n<p class=\"label\">\u00d6rnek senaryo<\/p>\n<p>Bir dil kursu, WordPress sitesinde \u00f6\u011frenci yorumlar\u0131n\u0131 g\u00f6steren bir eklenti kullan\u0131yor. Eklentinin eski s\u00fcr\u00fcm\u00fc, yorumdaki isim alan\u0131n\u0131 sayfaya i\u015flemeden bas\u0131yor. Sald\u0131rgan isim alan\u0131na betik g\u00f6m\u00fcl\u00fc bir yorum g\u00f6nderiyor. Kurs y\u00f6neticisi yorumu onaylamak i\u00e7in panelde a\u00e7t\u0131\u011f\u0131 anda betik \u00e7al\u0131\u015f\u0131yor ve arka planda yeni bir y\u00f6netici hesab\u0131 olu\u015fturuyor. Birka\u00e7 g\u00fcn sonra sitenin ana sayfas\u0131 kumar reklamlar\u0131na y\u00f6nleniyor. Eklenti g\u00fcncellenip gereksiz y\u00f6netici silinene, parolalar de\u011fi\u015ftirilene kadar site iki g\u00fcn kapal\u0131 kal\u0131yor.<\/p>\n<\/div>\n<figure class=\"nh-sema\"><img loading=\"lazy\" src=\"https:\/\/narhost.com\/blog\/wp-content\/uploads\/2026\/09\/xss-nedir-sema-narhost.webp\" alt=\"xss nedir sorusunu \u00e7\u0131kt\u0131 ka\u00e7\u0131\u015flama, i\u00e7erik g\u00fcvenli\u011fi politikas\u0131, g\u00fcvenli \u00e7erez ve g\u00fcncel eklenti katmanlar\u0131yla a\u00e7\u0131klayan \u015fema\" width=\"1200\" height=\"500\" loading=\"lazy\" decoding=\"async\"><figcaption>XSS riskini d\u00fc\u015f\u00fcren d\u00f6rt katman: \u00e7\u0131kt\u0131 ka\u00e7\u0131\u015flama, CSP ba\u015fl\u0131\u011f\u0131, HttpOnly \u00e7erez ve g\u00fcncel eklenti.<\/figcaption><\/figure>\n<h2>XSS Nas\u0131l \u00d6nlenir, D\u00f6rt Katman<\/h2>\n<p>XSS&#8217;e kar\u015f\u0131 etkili savunma, verinin sayfaya girdi\u011fi her noktada do\u011fru i\u015flem yap\u0131lmas\u0131na dayan\u0131r. A\u015fa\u011f\u0131daki katmanlar birbirini tamamlar.<\/p>\n<p><strong>\u00c7\u0131kt\u0131 ka\u00e7\u0131\u015flama.<\/strong> Kullan\u0131c\u0131dan gelen veri sayfaya bas\u0131l\u0131rken ba\u011flam\u0131na g\u00f6re d\u00f6n\u00fc\u015ft\u00fcr\u00fcl\u00fcr. HTML g\u00f6vdesinde \u00f6zel karakterler varl\u0131k kodlar\u0131na \u00e7evrilir; \u00f6znitelik, JavaScript ve adres ba\u011flamlar\u0131n\u0131n her birinin kendi kural\u0131 vard\u0131r. Ka\u00e7\u0131\u015flama girdiye de\u011fil \u00e7\u0131kt\u0131ya uygulan\u0131r, \u00e7\u00fcnk\u00fc ayn\u0131 veri farkl\u0131 yerlerde farkl\u0131 ba\u011flamda g\u00f6sterilebilir. Modern \u015fablon motorlar\u0131 ve WordPress&#8217;in \u00e7\u0131kt\u0131 fonksiyonlar\u0131 bu i\u015fi haz\u0131r yapar; sorun, bu fonksiyonlar\u0131 kullanmayan eklenti ve temalardad\u0131r.<\/p>\n<p><strong>\u0130\u00e7erik G\u00fcvenli\u011fi Politikas\u0131.<\/strong> CSP, sunucunun taray\u0131c\u0131ya &#8220;bu sayfada yaln\u0131z \u015fu kaynaklardan gelen betikleri \u00e7al\u0131\u015ft\u0131r&#8221; dedi\u011fi bir HTTP ba\u015fl\u0131\u011f\u0131d\u0131r. \u0130yi kurulmu\u015f bir politika, sayfaya s\u0131zm\u0131\u015f sat\u0131r i\u00e7i beti\u011fin \u00e7al\u0131\u015fmas\u0131n\u0131 engeller. <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Guides\/CSP\" title=\"MDN Web Docs \u2014 Content Security Policy rehberi\" target=\"_blank\" rel=\"noopener\">MDN&#8217;in \u0130\u00e7erik G\u00fcvenli\u011fi Politikas\u0131 rehberi<\/a> ba\u015fl\u0131\u011f\u0131n yap\u0131s\u0131n\u0131 anlat\u0131yor. Politikay\u0131 \u00f6nce yaln\u0131z raporlama kipinde denemek, sitenin kendi betiklerini bozmadan ayar yapman\u0131z\u0131 sa\u011flar.<\/p>\n<p><strong>G\u00fcvenli \u00e7erez ayarlar\u0131.<\/strong> Oturum \u00e7erezlerinin HttpOnly i\u015faretiyle g\u00f6nderilmesi, beti\u011fin \u00e7erezi okumas\u0131n\u0131 engeller. Secure ve SameSite i\u015faretleri de \u00e7erezin nereye g\u00f6nderilece\u011fini s\u0131n\u0131rlar. Bu, a\u00e7\u0131\u011f\u0131 kapatmaz ama oturum \u00e7alma senaryosunu zorla\u015ft\u0131r\u0131r.<\/p>\n<p><strong>G\u00fcncel eklenti ve tema.<\/strong> WordPress sitelerde yay\u0131mlanan XSS a\u00e7\u0131klar\u0131n\u0131n \u00f6nemli bir k\u0131sm\u0131 eklentilerde \u00e7\u0131kar ve yamayla kapan\u0131r. G\u00fcncellemeleri geciktirmemek bu y\u00fczden \u00f6nemlidir; eklentilerin nas\u0131l g\u00fcvenle g\u00fcncellenece\u011fi <a href=\"https:\/\/narhost.com\/destek\/sitenizi-guncel-tutun-wordpress-eklentileri-nasil-guncellenir\/\" title=\"WordPress Eklentileri Nas\u0131l G\u00fcncellenir \u2014 Narhost Destek Merkezi\">WordPress eklentileri g\u00fcncelleme kart\u0131nda<\/a> anlat\u0131l\u0131yor.<\/p>\n<div class=\"warn-box\">\n<p class=\"label\">Dikkat<\/p>\n<p>Girdiden yaln\u0131z belirli etiketleri silen kara liste filtreleri XSS&#8217;e kar\u015f\u0131 g\u00fcvenilir de\u011fildir. Taray\u0131c\u0131lar\u0131n betik \u00e7al\u0131\u015ft\u0131rabildi\u011fi yol say\u0131s\u0131 \u00e7ok fazlad\u0131r ve filtreler d\u00fczenli olarak a\u015f\u0131l\u0131r. G\u00fcvenli y\u00f6ntem, veriyi g\u00f6sterildi\u011fi ba\u011flama g\u00f6re ka\u00e7\u0131\u015flamak ve HTML girdisine ger\u00e7ekten izin verilen yerlerde denetlenmi\u015f bir temizleme k\u00fct\u00fcphanesi kullanmakt\u0131r.<\/p>\n<\/div>\n<h2>WAF ve G\u00fcvenlik Eklentisi Yeterli mi<\/h2>\n<p>XSS nedir ve nas\u0131l i\u015fler sorusunu cevaplad\u0131ktan sonra akla gelen ilk \u00e7\u00f6z\u00fcm genellikle bir g\u00fcvenlik duvar\u0131d\u0131r. Web uygulamas\u0131 g\u00fcvenlik duvar\u0131, isteklerde bilinen betik kal\u0131plar\u0131n\u0131 arar ve e\u015fle\u015fenleri durdurur. Reflected XSS denemelerinin \u00f6nemli k\u0131sm\u0131n\u0131 yakalayabilir. Ancak DOM tabanl\u0131 XSS sunucuya hi\u00e7 u\u011framayabilir, stored XSS de zarars\u0131z g\u00f6r\u00fcnen par\u00e7alara b\u00f6l\u00fcnerek kaydedilebilir. WAF zaman kazand\u0131ran bir katmand\u0131r; kodu d\u00fczeltmez. Hangi site i\u00e7in ek bir WAF katman\u0131n\u0131n ger\u00e7ekten de\u011fer katt\u0131\u011f\u0131n\u0131 <a href=\"https:\/\/narhost.com\/blog\/waf-gerekir-mi\/\" title=\"WAF Gerekir mi \u2014 Narhost Blog\">WAF gerekir mi yaz\u0131s\u0131<\/a> tart\u0131\u015f\u0131yor.<\/p>\n<p>A\u00e7\u0131k istismar edilmi\u015fse temizlik ayr\u0131 bir s\u00fcre\u00e7tir: a\u00e7\u0131\u011f\u0131 kapatmak, eklenen y\u00f6netici hesaplar\u0131n\u0131 ve zararl\u0131 kay\u0131tlar\u0131 silmek, t\u00fcm oturumlar\u0131 sonland\u0131r\u0131p parolalar\u0131 de\u011fi\u015ftirmek. Bu s\u0131ran\u0131n tamam\u0131 <a href=\"https:\/\/narhost.com\/blog\/site-hacklenirse-ne-yapmali\/\" title=\"Site Hacklenirse Ne Yapmal\u0131 \u2014 Narhost Blog\">site hacklenirse ne yapmal\u0131 rehberinde<\/a> var.<\/p>\n<div class=\"success-box\">\n<p class=\"label\">Sonu\u00e7<\/p>\n<p>XSS nedir sorusunun site sahibi i\u00e7in kar\u015f\u0131l\u0131\u011f\u0131, taray\u0131c\u0131n\u0131n g\u00fcvenini k\u00f6t\u00fcye kullanan bir a\u00e7\u0131kt\u0131r. Kal\u0131c\u0131 \u00e7\u00f6z\u00fcm \u00e7\u0131kt\u0131 ka\u00e7\u0131\u015flamad\u0131r; CSP, HttpOnly \u00e7erez ve WAF ka\u00e7an bir hatan\u0131n etkisini daralt\u0131r. WordPress kullan\u0131yorsan\u0131z i\u015fin b\u00fcy\u00fck k\u0131sm\u0131 eklenti se\u00e7imi ve g\u00fcncellemedir: az, bak\u0131m\u0131 s\u00fcren ve g\u00fcncel eklenti.<\/p>\n<\/div>\n<h2>Kontrol Listesi, XSS Riskini Azaltmak<\/h2>\n<ul class=\"kontrol-listesi\">\n<li>Eklenti ve temalar\u0131 g\u00fcncel tutun, bir y\u0131l\u0131 a\u015fk\u0131n s\u00fcredir g\u00fcncellenmeyenleri de\u011fi\u015ftirin.<\/li>\n<li>Yorum, form ve profil alan\u0131 gibi kullan\u0131c\u0131 i\u00e7eri\u011fi kabul eden bile\u015fenleri listeleyin.<\/li>\n<li>Onay bekleyen yorumlar\u0131, zorunlu de\u011filse, y\u00f6netici hesab\u0131 yerine d\u00fc\u015f\u00fck yetkili bir edit\u00f6r hesab\u0131yla inceleyin.<\/li>\n<li>Oturum \u00e7erezlerinin HttpOnly ve Secure i\u015faretli oldu\u011funu taray\u0131c\u0131 geli\u015ftirici ara\u00e7lar\u0131ndan kontrol edin.<\/li>\n<li>CSP ba\u015fl\u0131\u011f\u0131n\u0131 \u00f6nce raporlama kipinde deneyin, sonra uygulamaya al\u0131n.<\/li>\n<li>\u00d6zel kod yazd\u0131rd\u0131ysan\u0131z geli\u015ftiriciden \u00e7\u0131kt\u0131 ka\u00e7\u0131\u015flamas\u0131 yap\u0131ld\u0131\u011f\u0131n\u0131n teyidini al\u0131n.<\/li>\n<li>Y\u00f6netici hesaplar\u0131nda iki ad\u0131ml\u0131 do\u011frulamay\u0131 a\u00e7\u0131n.<\/li>\n<\/ul>\n<div class=\"kb-faq\">\n<h2>S\u0131k\u00e7a sorulan sorular<\/h2>\n<h3>Teknik olmayan biri i\u00e7in XSS nedir, ziyaret\u00e7iye nas\u0131l zarar verir?<\/h3>\n<p>XSS, sitenize yerle\u015ftirilen yabanc\u0131 bir beti\u011fin ziyaret\u00e7inin taray\u0131c\u0131s\u0131nda sitenizin yetkisiyle \u00e7al\u0131\u015fmas\u0131d\u0131r. Ziyaret\u00e7i sahte bir giri\u015f formuna ya da zararl\u0131 bir siteye y\u00f6nlendirilebilir, g\u00f6rd\u00fc\u011f\u00fc sayfa de\u011fi\u015ftirilebilir. Oturum \u00e7erezleri korunmuyorsa a\u00e7\u0131k olan oturumu sald\u0131rgana ge\u00e7ebilir. Ziyaret\u00e7i bunu sitenizden gelen bir sorun olarak alg\u0131lar, bu da g\u00fcven kayb\u0131 demektir.<\/p>\n<h3>SSL sertifikas\u0131 XSS&#8217;e kar\u015f\u0131 korur mu?<\/h3>\n<p>Korumaz. SSL, taray\u0131c\u0131 ile sunucu aras\u0131ndaki trafi\u011fi \u015fifreler ve arada dinlemeyi engeller. XSS ise sitenin kendi i\u00e7eri\u011fine yerle\u015fen betikle \u00e7al\u0131\u015f\u0131r; bu betik \u015fifreli ba\u011flant\u0131 \u00fczerinden de ayn\u0131 \u015fekilde teslim edilir. SSL gereklidir ve oturum \u00e7erezlerinin Secure i\u015faretiyle g\u00f6nderilmesini m\u00fcmk\u00fcn k\u0131lar, ama XSS i\u00e7in ayr\u0131 \u00f6nlemler gerekir.<\/p>\n<h3>WordPress&#8217;te XSS a\u00e7\u0131\u011f\u0131 olup olmad\u0131\u011f\u0131n\u0131 nas\u0131l anlar\u0131m?<\/h3>\n<p>En pratik yol, kulland\u0131\u011f\u0131n\u0131z eklenti ve temalar\u0131n s\u00fcr\u00fcmlerini yay\u0131mlanm\u0131\u015f g\u00fcvenlik bildirimleriyle kar\u015f\u0131la\u015ft\u0131rmakt\u0131r. Bir\u00e7ok g\u00fcvenlik eklentisi ve hosting paneli bilinen a\u00e7\u0131k i\u00e7eren s\u00fcr\u00fcmleri uyar\u0131r. Belirti olarak tan\u0131mad\u0131\u011f\u0131n\u0131z y\u00f6netici hesaplar\u0131, beklenmedik y\u00f6nlendirmeler ve sayfa kayna\u011f\u0131nda sizin eklemedi\u011finiz betik etiketleri aran\u0131r.<\/p>\n<h3>CSP kurmak siteyi bozar m\u0131?<\/h3>\n<p>Aceleyle kurulursa bozabilir. Analitik, sohbet balonu, \u00f6deme formu ve yaz\u0131 tipi gibi d\u0131\u015f kaynaklar politikada izin verilmezse \u00e7al\u0131\u015fmaz. Bu y\u00fczden CSP \u00f6nce yaln\u0131z raporlama kipinde a\u00e7\u0131l\u0131r, hangi kaynaklar\u0131n engellenece\u011fi birka\u00e7 g\u00fcn g\u00f6zlenir, izin listesi buna g\u00f6re tamamlan\u0131r ve ancak sonra uygulama kipine ge\u00e7ilir.<\/p>\n<h3>XSS a\u00e7\u0131\u011f\u0131 olan bir site Google&#8217;da cezaland\u0131r\u0131l\u0131r m\u0131?<\/h3>\n<p>A\u00e7\u0131\u011f\u0131n kendisi s\u0131ralamay\u0131 do\u011frudan etkilemez. \u0130stismar edilip sayfalara zararl\u0131 y\u00f6nlendirme ya da istenmeyen i\u00e7erik eklenirse arama motoru siteyi g\u00fcvenli olmayan olarak i\u015faretleyebilir ve ziyaret\u00e7ilere uyar\u0131 g\u00f6sterebilir. Temizlik yap\u0131ld\u0131ktan sonra yeniden inceleme talebiyle uyar\u0131 kald\u0131r\u0131labilir, ama kaybedilen trafik ve g\u00fcven zaman al\u0131r.<\/p>\n<\/div>\n<div class=\"cta-box\">\n<p class=\"label\">Narhost&#8217;ta<\/p>\n<p>Web hosting paketlerimizde \u00fccretsiz SSL, WP Toolkit Deluxe ile eklenti ve tema g\u00fcncellemelerinin tek panelden y\u00f6netimi bulunan cPanel gelir.<\/p>\n<p><a class=\"cta-btn\" href=\"https:\/\/narhost.com\/web-hosting\" title=\"Narhost Web Hosting paketleri\">Web hosting paketlerini incele<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"<p>XSS nedir sorusunun k\u0131sa cevab\u0131: sald\u0131rgan\u0131n bir web sayfas\u0131na kendi beti\u011fini yerle\u015ftirmesi ve bu beti\u011fin ziyaret\u00e7inin taray\u0131c\u0131s\u0131nda sitenin yetkisiyle \u00e7al\u0131\u015fmas\u0131d\u0131r. \u00dc\u00e7 XSS t\u00fcr\u00fc ve kal\u0131c\u0131 \u00f6nlemler bu rehberde.<\/p>\n","protected":false},"author":1,"featured_media":2765,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":["post-2764","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guvenlik"],"_links":{"self":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts\/2764","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/comments?post=2764"}],"version-history":[{"count":1,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts\/2764\/revisions"}],"predecessor-version":[{"id":2766,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts\/2764\/revisions\/2766"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/media\/2765"}],"wp:attachment":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/media?parent=2764"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/categories?post=2764"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/tags?post=2764"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}