Security Guides
Deep, practical guides on the security decisions every website needs to make. No fluff, no vendor pitches.
All guides
HTTP Security Headers: A Practical Guide
Every HTTP security header explained in plain English, with production-ready examples for Nginx, Apache, Cloudflare, Express and WordPress.
Updated 2026-01-15
Content Security Policy (CSP): What It Is and How to Ship It
A step-by-step guide to writing, testing and shipping a strict Content Security Policy without breaking your site.
Updated 2026-01-10
HTTP Strict Transport Security (HSTS)
How HSTS works, how to enable it safely, and when (and how) to preload your domain into every major browser.
Updated 2026-01-08
Referrer-Policy
Referrer-Policy controls how much of your URL is sent to other sites. Here's the setting that balances analytics with privacy.
Updated 2026-01-05
Permissions-Policy
Turn off camera, microphone, geolocation and other powerful browser APIs for your site and any iframes you embed.
Updated 2026-01-03
Cookie Security: SameSite, Secure, HttpOnly
How to configure cookies so they can't be stolen by XSS, sent over HTTP, or used in CSRF attacks.
Updated 2026-01-02
HTTPS: The Non-Negotiable Baseline
Every site needs HTTPS. Here's how to enforce it, why HTTP is worse than you think, and how to test your setup.
Updated 2026-01-01
TLS: Ciphers, Versions and Common Mistakes
The TLS versions and cipher suites you should support in 2026, plus what to deprecate.
Updated 2025-12-28
SSL Certificates in Plain English
How SSL certificates work, what to check on your own, and why EV certificates are no longer worth paying for.
Updated 2025-12-27
CORS: Cross-Origin Resource Sharing
How CORS actually works, common misconfigurations, and how to lock down Access-Control-Allow-Origin.
Updated 2025-12-20
DNS Security Basics
A checklist of DNS records every domain should have — CAA, DNSSEC, SPF, DKIM and DMARC — with why each one matters.
Updated 2025-12-15
Website Security Tips
A pragmatic checklist of the security wins that give the biggest reduction in risk for the least effort.
Updated 2025-12-10
How to scan your website for malware
A practical guide to detecting, removing, and preventing website malware — from common infection signs to remote and server-side scanning methods.
Updated 2026-02-01