Web security guides
Practical, vendor-neutral explanations of the configuration that hardens a website — each paired with a free checker so you can fix, then verify. 42 guides across 6 topics.
42 guides
UFW Firewall Guide: Protecting Your Linux Server
A practical guide to UFW (Uncomplicated Firewall) on Linux: default-deny setup, opening only the ports you need, rate-limiting SSH, reading logs, the real automated-scanning threat, and how to verify your actual exposure.
Updated Jul 9, 2026SSH Security Guide: Keys, Root Login, and Hardening
How to secure SSH access to a Linux server: why passwords fail, disabling root login, choosing a safe username, SSH key authentication, and Fail2ban — with exact config.
Updated Jul 9, 2026How to Rate-Limit Your Login Page: Brute-Force & Credential-Stuffing Protection
A complete guide to rate-limiting login and auth endpoints: how much is enough, the layered defence, and exact syntax for Express, Django, Spring, and Rack — plus how to return HTTP 429.
Updated Jul 1, 2026Credential Stuffing: What It Is and How to Prevent It
Credential stuffing replays passwords leaked from other breaches against your login. Prevent it with per-IP rate limiting, MFA, bot detection, and breached-password screening.
Updated Jul 1, 2026CSP frame-ancestors: The Modern Clickjacking Defense
CSP frame-ancestors controls which sites can iframe your page and is the modern replacement for X-Frame-Options. Learn the syntax, precedence rules, and how to deploy it on nginx, Apache, Cloudflare and Next.js.
Updated Jul 1, 2026How to Stop Brute-Force Login Attacks
Brute-force attacks guess passwords against your login page. Stop them with rate limiting, CAPTCHA, and MFA — with exact syntax for Express, Django, Spring, and Rack.
Updated Jul 1, 2026HSTS Test: Check Your Strict-Transport-Security Header
Free HSTS test: check whether your site sends Strict-Transport-Security, its max-age, includeSubDomains and preload — with the exact header to add if it's missing.
Updated Jul 1, 2026HTTP 429 Too Many Requests: What It Means and How to Return It
HTTP 429 Too Many Requests is the rate-limiting signal that blocks brute-force and credential-stuffing bots. Learn what 429 and Retry-After mean and how to return them in any framework.
Updated Jul 1, 2026Partitioned Cookies (CHIPS): What They Are and When You Need Them
A Partitioned cookie (CHIPS) is stored separately per top-level site so embedded third-party contexts keep state as third-party cookies phase out. Learn the syntax and when you need it.
Updated Jul 1, 2026X-Content-Type-Options: nosniff Explained
X-Content-Type-Options: nosniff stops browsers MIME-sniffing responses into the wrong type, mitigating a class of XSS. Learn what it does and the one-line fix.
Updated Jul 1, 2026Cookie Security: Secure, HttpOnly and SameSite Explained
A complete guide to securing cookies: what the Secure, HttpOnly and SameSite flags do, the __Host-/__Secure- prefixes, domain scope, and how to set a session cookie correctly.
Updated Jun 30, 2026The HttpOnly Cookie Flag: Stopping XSS Session Theft
The HttpOnly cookie flag hides a cookie from JavaScript, so a cross-site scripting (XSS) bug can't steal the session token. Learn what it does, when to omit it, and how to set it.
Updated Jun 30, 2026The SameSite Cookie Attribute: Lax, Strict and None
The SameSite cookie attribute controls cross-site sending and defends against CSRF. Learn Lax vs Strict vs None, why a missing SameSite is minor, and why None needs Secure.
Updated Jun 30, 2026The Secure Cookie Flag: What It Does and How to Set It
The Secure cookie flag sends a cookie only over HTTPS, so a session token is never exposed in cleartext. Learn what it does, why SameSite=None needs it, and how to set it.
Updated Jun 30, 2026Email Authentication: SPF, DKIM & DMARC Explained
Stop your domain being spoofed. A practical, vendor-neutral guide to SPF, DKIM and DMARC — what each record does, how to deploy them safely, and how to check your domain.
Updated Jun 26, 2026HTTP Security Headers: The Complete Guide (2026)
A complete, vendor-neutral guide to HTTP security headers: what HSTS, CSP, X-Frame-Options and the rest do, a copy-paste baseline, and the common mistakes — by a security researcher.
Updated Jun 26, 2026SSL/TLS Errors: What They Mean and How to Fix Them
A vendor-neutral guide to SSL/TLS errors: what causes them, how to read the exact error code, and how visitors and site owners should each respond.
Updated Jun 26, 2026Website Security: How to Check and Improve Your Score
Learn what a website security score measures, how SecScan's passive A–F grade is calculated from headers, TLS, and exposed files, and how to raise it fast.
Updated Jun 26, 2026Clickjacking: X-Frame-Options vs CSP frame-ancestors
Stop clickjacking by telling browsers your pages may not be framed. Compare X-Frame-Options DENY/SAMEORIGIN with the modern CSP frame-ancestors directive — and learn why you should send both.
Updated Jun 26, 2026Content-Security-Policy (CSP): A Practical Guide
A practical guide to Content-Security-Policy: what it does, the key directives, nonces and hashes, a report-only rollout, a sane starter policy, and how to verify it.
Updated Jun 26, 2026How to Add Security Headers in Apache
Add HTTP security headers in Apache with mod_headers. Copy-paste Header always set directives for HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy, plus how to verify them.
Updated Jun 26, 2026How to Add Security Headers in Nginx
Add HTTP security headers in nginx with add_header directives and the always flag. Copy-paste values for HSTS, CSP, X-Frame-Options and more, plus the location-block inheritance trap.
Updated Jun 26, 2026How to Add Security Headers with Cloudflare
Add HTTP security headers through Cloudflare without touching your origin. Use Response Header Transform Rules for HSTS, X-Frame-Options, CSP and more, then verify.
Updated Jun 26, 2026How to Fix "DMARC Policy Not Enabled" (Quarantine/Reject Not Enabled)
A "DMARC policy not enabled" warning means you have no DMARC record or one set to p=none. Learn how to publish DMARC and ramp to p=quarantine then p=reject safely.
Updated Jun 26, 2026How to Fix "This Site Can't Provide a Secure Connection"
Chrome's "This site can't provide a secure connection" headline means the TLS handshake failed. Fix it as a visitor or as a site owner, including ERR_SSL_VERSION_OR_CIPHER_MISMATCH.
Updated Jun 26, 2026How to Fix "Your Connection Is Not Private"
The "Your connection is not private" warning means the browser can't trust the site's certificate. Read the NET::ERR_ subcode under Advanced and fix the exact cause.
Updated Jun 26, 2026How to Fix an Expired SSL Certificate
An expired SSL certificate makes every browser block your site. Renew it with your CA, reinstall it on the server, verify, and automate renewal so it can't lapse again.
Updated Jun 26, 2026How to Fix ERR_SSL_PROTOCOL_ERROR
ERR_SSL_PROTOCOL_ERROR means Chrome and the server couldn't agree on a TLS connection. Fix it as a visitor (clock, browser, SSL state) or owner (TLS versions, chain, SNI, ciphers).
Updated Jun 26, 2026How to Fix Multiple SPF Records on One Domain
Two or more SPF records on one domain cause a permerror and break SPF entirely. Learn why it happens and how to merge every sender into a single valid record.
Updated Jun 26, 2026How to Fix NET::ERR_CERT_AUTHORITY_INVALID
NET::ERR_CERT_AUTHORITY_INVALID means the browser doesn't trust the certificate's issuer. Learn what it means for visitors and how owners fix self-signed certs and missing intermediates.
Updated Jun 26, 2026How to Fix NET::ERR_CERT_DATE_INVALID
NET::ERR_CERT_DATE_INVALID means a certificate's dates don't match the clock. Check your device's date first, then renew an expired certificate. Fixes for both.
Updated Jun 26, 2026How to Fix SPF Too Many DNS Lookups (PermError)
SPF allows only 10 DNS lookups before receivers return permerror. Learn to count your lookups and fix overflow by pruning includes, using ip4/ip6, and flattening.
Updated Jun 26, 2026How to Fix SSL Handshake Failed
An SSL handshake fails when the browser and server can't complete TLS negotiation. Diagnose protocol, cipher, SNI, chain, and Cloudflare 525 issues with openssl s_client.
Updated Jun 26, 2026How to Improve Your Website Security Score
Improve your website security score by severity: clear exposed files that cap the grade at F, fix TLS, add core headers, and re-scan after each change.
Updated Jun 26, 2026How to Prevent Email Spoofing of Your Domain
Stop attackers forging your domain. Set up SPF and DKIM, then enforce a DMARC policy of quarantine or reject so receivers refuse spoofed mail.
Updated Jun 26, 2026How to Set Up SPF, DKIM and DMARC for Google Workspace
Step-by-step guide to authenticating Google Workspace mail: publish SPF, turn on DKIM in the Admin console, add a DMARC record at _dmarc, and ramp to enforcement.
Updated Jun 26, 2026How to Set Up SPF, DKIM and DMARC on GoDaddy
A step-by-step guide to publishing SPF, DKIM and DMARC records in GoDaddy's DNS manager — with exact host fields, example values and how to ramp DMARC to enforcement.
Updated Jun 26, 2026How to Set Up SPF, DKIM and DMARC on Microsoft 365 (Office 365)
A clear, step-by-step guide to configuring SPF, DKIM and DMARC for Microsoft 365 (Office 365): the SPF include, the two DKIM CNAMEs, and an enforcing DMARC policy.
Updated Jun 26, 2026HSTS and the Preload List: A Complete Guide
How HSTS forces HTTPS and closes the plaintext-first-request gap, what each directive does, the hstspreload.org requirements, and why preload is a long-term commitment.
Updated Jun 26, 2026Website Security Checklist (2026)
A practical, prioritised website security checklist for 2026: HTTPS and certificates, core security headers, exposed files, email authentication (SPF/DKIM/DMARC), and maintenance — with a free A–F score to verify.
Updated Jun 26, 2026Why Does My Website Say "Not Secure" (and How to Fix It)
Your site shows "Not Secure" when a page isn't served over valid HTTPS — no certificate, an expired or untrusted certificate, or mixed content. Here is how to find the cause and fix it.
Updated Jun 26, 2026Why Your DMARC Is Failing (and How to Fix It)
DMARC fails when neither SPF nor DKIM passes and aligns with your From domain. Learn the four common causes, how to read aggregate reports, and how to fix each.
Updated Jun 26, 2026