Web security guides
Practical, vendor-neutral explanations of the configuration that hardens a website — each paired with a free checker so you can fix, then verify. 62 guides across 6 topics.
62 guides
API Security Testing: What to Test, In What Order, and What Can Be Automated
A practical API security testing guide: build the endpoint inventory, run the two-account authorisation matrix (BOLA, BFLA, excessive data exposure), probe inputs read-only, and check the perimeter — plus what automated scanning can and cannot do.
Updated Sep 21, 2026API Security Checklist: 25 Items, Each With How to Verify It
A practical API security checklist ordered by what breaks in practice: authorization, authentication, input and resource limits, surface and transport — each item with the request or test that verifies it, plus the cadence for running them.
Updated Sep 21, 2026API Security Testing Tools: What Each Category Finds, and the Gap They All Share
Proxies, spec-driven fuzzers, template scanners and injection specialists: what each category of API security testing tool honestly finds, why none of them detects BOLA/IDOR without two accounts, and a stack that covers the ground.
Updated Sep 21, 2026IDOR Vulnerability (BOLA): Why Scanners Miss It and How to Test With Two Accounts
What an IDOR / BOLA vulnerability is, why automated scanners miss it (a leak returns a normal 200 OK), the two-account method that actually detects it — cross-account read, unauthenticated read, bounded enumeration — and the code shape that prevents it.
Updated Sep 21, 2026Nuclei Vulnerability Scanner: Safe Tags, Real Limits, and the Command We Actually Run
What the Nuclei scanner is, how its templates work, the exact tags to use and to exclude (dos, intrusive, fuzzing), how to avoid duplicating your passive checks, what it cannot find, and how it compares to a commercial scanner or a pentest.
Updated Sep 21, 2026Attack Surface Management (ASM): A Practical Guide for Small Teams and Agencies
What attack surface management is, how it differs from vulnerability scanning, the discover → assess → reduce → monitor loop, how attackers map your surface, and a free-tool routine a small team or agency can run monthly.
Updated Sep 18, 2026Subdomain Enumeration: How to Find All Subdomains of a Domain (Passively First)
How to find all subdomains of a domain: Certificate Transparency logs, DNS, scan databases, search engines and tools like subfinder and amass — passive first, active only on domains you own. How to classify results (live, third-party, dangling, unresolved) and what to do with each.
Updated Sep 18, 2026Attack Surface Management Tools in 2026: Enterprise EASM, Mid-Market Scanners and the Free Stack
How to choose attack surface management tools: enterprise EASM platforms (Defender EASM, CyCognito), mid-market scanners (Intruder, Detectify, HostedScan), scan databases (Censys, Shodan) and the free open-source stack — compared on discovery, monitoring and pricing model.
Updated Sep 18, 2026Attack Surface Monitoring: What to Watch Continuously (and What a One-Time Scan Misses)
Attack surface monitoring watches for change: lookalike certificates in CT logs, typosquat registrations, cloned copies of your site, new subdomains, expiring certificates and config drift. How it works without scanning anyone, and what to do when an alert fires.
Updated Sep 18, 2026Certificate Transparency Logs: What They Reveal and How to Search Them (crt.sh and Beyond)
What Certificate Transparency logs are, how to search them with crt.sh and Cert Spotter, what they reveal about a domain (every subdomain that had HTTPS, timelines, lookalike certificates), how they leak internal hostnames, and how to use them for recon and monitoring.
Updated Sep 18, 2026Content-Security-Policy-Report-Only: Roll Out CSP Without Breaking Your Site
How Content-Security-Policy-Report-Only works, report-to vs report-uri, where CSP violation reports go, how to read them, and when it is safe to switch to an enforcing policy. nginx and Next.js snippets included.
Updated Sep 18, 2026CSP 'unsafe-inline': Why It Neutralises Your Policy and How to Remove It
'unsafe-inline' in Content-Security-Policy script-src switches off XSS protection. Learn why, when it is safely ignored (nonce/hash), and how to replace it with nonces, hashes and 'strict-dynamic' on Next.js and nginx.
Updated Sep 18, 2026CSP Is Blocking My Site: How to Fix It Without Disabling Content-Security-Policy
How to read a 'Refused to load … violates Content Security Policy' error, widen the one directive that caused it, and why disabling CSP is the wrong fix. Covers scripts, fonts, iframes, eval and duplicate policies.
Updated Sep 18, 2026CSP script-src and default-src: The Fallback Chain, Wildcards and a Starter Policy
How Content-Security-Policy resolves script-src, default-src and the fallback chain, why * and https: in script-src are a hole, the four directives default-src never covers, and a copy-paste starter policy for nginx, Apache and Next.js.
Updated Sep 18, 2026External Attack Surface Management (EASM), Explained for People Who Don't Run a SOC
What external attack surface management covers (seven asset classes), what enterprise EASM platforms like Defender EASM and CyCognito actually do, a free do-it-yourself EASM baseline for small teams and agencies, and when buying a platform makes sense.
Updated Sep 18, 2026How to Map Your Attack Surface (Free, in an Afternoon)
Map your external attack surface with public data and no scanning: subdomains from Certificate Transparency, DNS targets and dangling CNAMEs, ports via Censys/Shodan, tech fingerprints, certificate expiry, email posture and third-party origins — plus a downloadable inventory template.
Updated Sep 18, 2026How to Reduce Your Attack Surface: A 12-Point Checklist for Websites and Small Networks
Attack surface reduction for websites and small networks: retire unused hostnames, fix dangling DNS, take admin panels offline, close ports, enforce HTTPS/HSTS, headers, cookies, email authentication, remove exposed files, trim third-party scripts, register lookalikes, monitor the rest. Each item links to a free check.
Updated Sep 18, 2026Subdomain Enumeration Tools: subfinder, amass, crt.sh, dnsx — Which to Use and How
The subdomain enumeration tools that matter: subfinder and amass for aggregated passive discovery, crt.sh and Cert Spotter for Certificate Transparency, dnsx and httpx to resolve and probe, dnstwist for lookalikes — with install commands, a full pipeline, and when passive is enough.
Updated Sep 18, 2026Subdomain Takeover: How Dangling DNS Records Hand Your Hostname to a Stranger
What a subdomain takeover is, how a dangling CNAME or DNS record to a cancelled SaaS, bucket or cloud app makes it possible, why it matters (phishing, cookies, email), how to check for dangling records passively, and how to fix and prevent it.
Updated Sep 18, 2026Exposed .env and .git Files: How Attackers Find Leaked Secrets
A public .env or .git folder leaks database credentials, API keys and source code to anyone who requests the right URL. Learn what commonly gets exposed, how scanners find it, and how to close it off.
Updated Aug 26, 2026UFW Firewall Guide: Protecting Your Linux Server
A practical guide to UFW (Uncomplicated Firewall) on Linux: default-deny setup, opening only the ports you need, rate-limiting SSH, reading logs, the real automated-scanning threat, and how to verify your actual exposure.
Updated Jul 9, 2026SSH Security Guide: Keys, Root Login, and Hardening
How to secure SSH access to a Linux server: why passwords fail, disabling root login, choosing a safe username, SSH key authentication, and Fail2ban — with exact config.
Updated Jul 9, 2026How to Rate-Limit Your Login Page: Brute-Force & Credential-Stuffing Protection
A complete guide to rate-limiting login and auth endpoints: how much is enough, the layered defence, and exact syntax for Express, Django, Spring, and Rack — plus how to return HTTP 429.
Updated Jul 1, 2026Credential Stuffing: What It Is and How to Prevent It
Credential stuffing replays passwords leaked from other breaches against your login. Prevent it with per-IP rate limiting, MFA, bot detection, and breached-password screening.
Updated Jul 1, 2026CSP frame-ancestors: The Modern Clickjacking Defense
CSP frame-ancestors controls which sites can iframe your page and is the modern replacement for X-Frame-Options. Learn the syntax, precedence rules, and how to deploy it on nginx, Apache, Cloudflare and Next.js.
Updated Jul 1, 2026How to Stop Brute-Force Login Attacks
Brute-force attacks guess passwords against your login page. Stop them with rate limiting, CAPTCHA, and MFA — with exact syntax for Express, Django, Spring, and Rack.
Updated Jul 1, 2026HSTS Test: Check Your Strict-Transport-Security Header
Free HSTS test: check whether your site sends Strict-Transport-Security, its max-age, includeSubDomains and preload — with the exact header to add if it's missing.
Updated Jul 1, 2026HTTP 429 Too Many Requests: What It Means and How to Return It
HTTP 429 Too Many Requests is the rate-limiting signal that blocks brute-force and credential-stuffing bots. Learn what 429 and Retry-After mean and how to return them in any framework.
Updated Jul 1, 2026Partitioned Cookies (CHIPS): What They Are and When You Need Them
A Partitioned cookie (CHIPS) is stored separately per top-level site so embedded third-party contexts keep state as third-party cookies phase out. Learn the syntax and when you need it.
Updated Jul 1, 2026X-Content-Type-Options: nosniff Explained
X-Content-Type-Options: nosniff stops browsers MIME-sniffing responses into the wrong type, mitigating a class of XSS. Learn what it does and the one-line fix.
Updated Jul 1, 2026Cookie Security: Secure, HttpOnly and SameSite Explained
A complete guide to securing cookies: what the Secure, HttpOnly and SameSite flags do, the __Host-/__Secure- prefixes, domain scope, and how to set a session cookie correctly.
Updated Jun 30, 2026The HttpOnly Cookie Flag: Stopping XSS Session Theft
The HttpOnly cookie flag hides a cookie from JavaScript, so a cross-site scripting (XSS) bug can't steal the session token. Learn what it does, when to omit it, and how to set it.
Updated Jun 30, 2026The SameSite Cookie Attribute: Lax, Strict and None
The SameSite cookie attribute controls cross-site sending and defends against CSRF. Learn Lax vs Strict vs None, why a missing SameSite is minor, and why None needs Secure.
Updated Jun 30, 2026The Secure Cookie Flag: What It Does and How to Set It
The Secure cookie flag sends a cookie only over HTTPS, so a session token is never exposed in cleartext. Learn what it does, why SameSite=None needs it, and how to set it.
Updated Jun 30, 2026Email Authentication: SPF, DKIM & DMARC Explained
Stop your domain being spoofed. A practical, vendor-neutral guide to SPF, DKIM and DMARC — what each record does, how to deploy them safely, and how to check your domain.
Updated Jun 26, 2026HTTP Security Headers: The Complete Guide (2026)
A complete, vendor-neutral guide to HTTP security headers: what HSTS, CSP, X-Frame-Options and the rest do, a copy-paste baseline, and the common mistakes — by a security researcher.
Updated Jun 26, 2026SSL/TLS Errors: What They Mean and How to Fix Them
A vendor-neutral guide to SSL/TLS errors: what causes them, how to read the exact error code, and how visitors and site owners should each respond.
Updated Jun 26, 2026Website Security: How to Check and Improve Your Score
Learn what a website security score measures, how SecScan's passive A–F grade is calculated from headers, TLS, and exposed files, and how to raise it fast.
Updated Jun 26, 2026Clickjacking: X-Frame-Options vs CSP frame-ancestors
Stop clickjacking by telling browsers your pages may not be framed. Compare X-Frame-Options DENY/SAMEORIGIN with the modern CSP frame-ancestors directive — and learn why you should send both.
Updated Jun 26, 2026Content-Security-Policy (CSP): A Practical Guide
A practical guide to Content-Security-Policy: what it does, the key directives, nonces and hashes, a report-only rollout, a sane starter policy, and how to verify it.
Updated Sep 18, 2026How to Add Security Headers in Apache
Add HTTP security headers in Apache with mod_headers. Copy-paste Header always set directives for HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy, plus how to verify them.
Updated Jun 26, 2026How to Add Security Headers in Nginx
Add HTTP security headers in nginx with add_header directives and the always flag. Copy-paste values for HSTS, CSP, X-Frame-Options and more, plus the location-block inheritance trap.
Updated Jun 26, 2026How to Add Security Headers with Cloudflare
Add HTTP security headers through Cloudflare without touching your origin. Use Response Header Transform Rules for HSTS, X-Frame-Options, CSP and more, then verify.
Updated Jun 26, 2026How to Fix "DMARC Policy Not Enabled" (Quarantine/Reject Not Enabled)
A "DMARC policy not enabled" warning means you have no DMARC record or one set to p=none. Learn how to publish DMARC and ramp to p=quarantine then p=reject safely.
Updated Jun 26, 2026How to Fix "This Site Can't Provide a Secure Connection"
Chrome's "This site can't provide a secure connection" headline means the TLS handshake failed. Fix it as a visitor or as a site owner, including ERR_SSL_VERSION_OR_CIPHER_MISMATCH.
Updated Jun 26, 2026How to Fix "Your Connection Is Not Private"
The "Your connection is not private" warning means the browser can't trust the site's certificate. Read the NET::ERR_ subcode under Advanced and fix the exact cause.
Updated Jun 26, 2026How to Fix an Expired SSL Certificate
An expired SSL certificate makes every browser block your site. Renew it with your CA, reinstall it on the server, verify, and automate renewal so it can't lapse again.
Updated Jun 26, 2026How to Fix ERR_SSL_PROTOCOL_ERROR
ERR_SSL_PROTOCOL_ERROR means Chrome and the server couldn't agree on a TLS connection. Fix it as a visitor (clock, browser, SSL state) or owner (TLS versions, chain, SNI, ciphers).
Updated Jun 26, 2026How to Fix Multiple SPF Records on One Domain
Two or more SPF records on one domain cause a permerror and break SPF entirely. Learn why it happens and how to merge every sender into a single valid record.
Updated Jun 26, 2026How to Fix NET::ERR_CERT_AUTHORITY_INVALID
NET::ERR_CERT_AUTHORITY_INVALID means the browser doesn't trust the certificate's issuer. Learn what it means for visitors and how owners fix self-signed certs and missing intermediates.
Updated Jun 26, 2026How to Fix NET::ERR_CERT_DATE_INVALID
NET::ERR_CERT_DATE_INVALID means a certificate's dates don't match the clock. Check your device's date first, then renew an expired certificate. Fixes for both.
Updated Jun 26, 2026How to Fix SPF Too Many DNS Lookups (PermError)
SPF allows only 10 DNS lookups before receivers return permerror. Learn to count your lookups and fix overflow by pruning includes, using ip4/ip6, and flattening.
Updated Jun 26, 2026How to Fix SSL Handshake Failed
An SSL handshake fails when the browser and server can't complete TLS negotiation. Diagnose protocol, cipher, SNI, chain, and Cloudflare 525 issues with openssl s_client.
Updated Jun 26, 2026How to Improve Your Website Security Score
Improve your website security score by severity: clear exposed files that cap the grade at F, fix TLS, add core headers, and re-scan after each change.
Updated Jun 26, 2026How to Prevent Email Spoofing of Your Domain
Stop attackers forging your domain. Set up SPF and DKIM, then enforce a DMARC policy of quarantine or reject so receivers refuse spoofed mail.
Updated Jun 26, 2026How to Set Up SPF, DKIM and DMARC for Google Workspace
Step-by-step guide to authenticating Google Workspace mail: publish SPF, turn on DKIM in the Admin console, add a DMARC record at _dmarc, and ramp to enforcement.
Updated Jun 26, 2026How to Set Up SPF, DKIM and DMARC on GoDaddy
A step-by-step guide to publishing SPF, DKIM and DMARC records in GoDaddy's DNS manager — with exact host fields, example values and how to ramp DMARC to enforcement.
Updated Jun 26, 2026How to Set Up SPF, DKIM and DMARC on Microsoft 365 (Office 365)
A clear, step-by-step guide to configuring SPF, DKIM and DMARC for Microsoft 365 (Office 365): the SPF include, the two DKIM CNAMEs, and an enforcing DMARC policy.
Updated Jun 26, 2026HSTS and the Preload List: A Complete Guide
How HSTS forces HTTPS and closes the plaintext-first-request gap, what each directive does, the hstspreload.org requirements, and why preload is a long-term commitment.
Updated Jun 26, 2026Website Security Checklist (2026)
A practical, prioritised website security checklist for 2026: HTTPS and certificates, core security headers, exposed files, email authentication (SPF/DKIM/DMARC), and maintenance — with a free A–F score to verify.
Updated Jun 26, 2026Why Does My Website Say "Not Secure" (and How to Fix It)
Your site shows "Not Secure" when a page isn't served over valid HTTPS — no certificate, an expired or untrusted certificate, or mixed content. Here is how to find the cause and fix it.
Updated Jun 26, 2026Why Your DMARC Is Failing (and How to Fix It)
DMARC fails when neither SPF nor DKIM passes and aligns with your From domain. Learn the four common causes, how to read aggregate reports, and how to fix each.
Updated Jun 26, 2026