If a hacker is trying to hack, should I present a pretty error page or redirect somewhere instead of a generic/cryptic error? I feel that the hacker knows what they are doing, I know what they are doing, they aren't supposed to be doing it, so I have no real incentive to put the effort into their experience. It was a hacker because there was a high load of attempting to crack passwords at /users/login.

  • 6
    The answer you're going to get here is probably going to be centered around user experience, probably with the assumption that a newbie might wind up getting accidentally identified as a hacker. If you're wanting an answer from a security perspective and are solely concerned with the hacker's behavior, this question might be a better fit on Security Stack Exchange. Commented Feb 26, 2014 at 18:19
  • 4
    I'm going to be 'that guy' - the correct term here is 'cracker' not 'hacker'. Hackers are nice. Crackers are bad. techrepublic.com/blog/it-security/hacker-vs-cracker However I think that common usage had trumped the original meaning of the word.
    – JonW
    Commented Mar 10, 2014 at 19:49
  • 1
    You should never present cryptic error messages to anyone.
    – DA01
    Commented Mar 10, 2014 at 21:23
  • 4
    This question appears to be off-topic because it is about security. (based on the comments on the answers, this appears to be an issue of security--not user experience).
    – DA01
    Commented Mar 10, 2014 at 21:25

3 Answers 3


There are couple of user bases to consider here.

  • The hacker who is genuinely trying to hack your site by doing some kind of script injection or by trying to make your site run some malicious JavaScript

  • The clueless newbie who is not sure what goes into a form or who just migrated from an old system where he used to enter search queries to retrieve data and does not know that now he can just retrieve content by using the filters provided. An user who does know what he is doing but is not aware of the negative connotations will also fall into the broader version of this group.

While I can understand your objective to be aggressive towards towards the first group, I don't think your second group should suffer the consequences of a careless mistake or lack of knowledge which led them to make this mistake.

To take a simple analogy, take the case of a person who deletes the system files in Windows by accident opposed to someone who just formats the system files intentionally. Both of them get the same error message

enter image description here

This doesnt convey anything to the first user who did it by accident and by providing him with a cryptic error page you are just going confuse him further.

Check out how Google handles a suspected virus activity with a firm but helpful message

enter image description here

Similarly here is another example of how google handles a server which was accidently sending automated results to Google (do note the user was not aware of it, which puts the person in the user group of not being aware that he was making a mistake).

To quote the article

I don't usually run Google searches on FireFox only to see some detailed information as provided by SEOQuake. Yet, today I was searching for some potential answer to a problem I'm running into with MS-Access which crashes a database and ran those on FireFox instead of my favorite: SeaMonkey.

As I was testing, all of a sudden I got the screenshot as shown in the figure below. Although it did not feel like I was sending automatic requests to Google, the SEOQuake toolbar does so on all the results! That means each time I do a search "I" send at least 11 requests to Google. After 3 or 4 searches with pretty much the same terms each time, that's well over 40 requests within 2 or 3 seconds.

That's the first time I got this screen, I'll have to think of turning off the SEOQuake bar whenever I do intensive searches like these.

enter image description here

  • 1
    This last example gave me a great idea. I'll cache their IP address and increment a counter, and anything over 4 failed login attempts will trigger the CAPTCHA. I'll also capture the exception and just send to a simple page 'No hacking allowed.'
    – Chloe
    Commented Feb 24, 2014 at 20:51
  • 3
    @Chloe anyone truly trying to break in to your site will not be foiled by IP logging. If there is real concern about intrusion, you need to be coming at this from a security angle--not UX.
    – DA01
    Commented Mar 10, 2014 at 21:24

If you are sure that the user is hacking, give him a Javascript alert(). It is the bad UX he deserves! (Alternatively, redirect him to a song by Rick Astley.)

If there is a chance it was a valid user making a mistake, then you should provide a message that will help put him back on the right track. Something like "Sorry we do not accept strings containing HTML markup".

If you want to inconvenience and slow down the hacker, make him think that he is making progress. Give him something like a spamtrap or a honeypot to waste his time on.

A classic way to deter a hacker is to simply delay his response. (You can find many systems do this when you enter an incorrect password, rendering bruteforce attacks impractical.) If you make him experience increasingly long delays before he receives each failure response, he will either give up or timeout. A valid user will tolerate some delay while they strain to remember their password.

  • 1
    Unfortunately, they are using bots so they won't see the JS.
    – Chloe
    Commented Feb 24, 2014 at 20:50
  • 1
    Why would you imply that Rick Astley is bad UX?
    – Alpha
    Commented Feb 28, 2014 at 2:12

Hackers don't deserve good UX, they deserve bad UX or no UX. So don't waste your time on this unless it could improve security which I can't see how.

  • 5
    Sorry but no one deserves bad UX
    – Mervin
    Commented Feb 23, 2014 at 20:12
  • 1
    @MervinJohnsingh When every company has similar budget like Google's, we can make it up to the hackers. Commented Feb 23, 2014 at 22:14
  • Hacker doesn't have to be bad. There are White and Black hat hackers. See the difference please.
    – Buksy
    Commented Feb 24, 2014 at 8:51
  • @Buksy "If a hacker is trying to hack....they aren't supposed to be doing it" I don't think the OP is referring to good hackers who are trying to help out the site. I'm just addressing the OP's question not trying to differentiate between good and bad hackers. Commented Feb 24, 2014 at 16:45
  • "No UX for you!"
    – user67695
    Commented Nov 29, 2016 at 19:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.