Guides & research
Security, explained for
the people who run sites
Practical, jargon-light guides on the things our scanner checks — what each finding means and exactly what to do about it.
Featured · HeadersContent Security Policy (CSP) explained plainly
A Content Security Policy tells browsers what resources to load — stopping injected scripts even if an attacker gets code onto your page. Here's how it works.
Read the guide →Cybersecurity news roundup — November 15, 2026
Today's cybersecurity round-up highlights active exploitation of a server vulnerability in UnrealIRCd and a significant supply chain breach impacting Cursor.…
NewsCybersecurity news roundup — November 14, 2026
Today's cybersecurity landscape highlights critical vulnerabilities in widely used software and active exploitation campaigns, alongside significant internat…
NewsCybersecurity news roundup — November 13, 2026
Today's cybersecurity landscape is marked by a flurry of critical vulnerabilities, with several platforms facing active exploitation or newly disclosed flaws…
NewsCybersecurity news roundup — November 12, 2026
Today's cybersecurity landscape highlights significant vulnerabilities in widely used software and active exploitation campaigns. Critical patches have been …
NewsCybersecurity news roundup — November 11, 2026
Today's cybersecurity landscape saw a flurry of critical updates and alarming breaches. Multiple vendors, including Microsoft, SAP, Google, and Apple, releas…
NewsCybersecurity news roundup — November 10, 2026
Today's cybersecurity landscape highlights critical vulnerabilities, with several platforms, including OpenSSH and SonicWall, facing active exploitation. We …
NewsCybersecurity news roundup — November 9, 2026
Today's cybersecurity round-up highlights a significant data breach impacting millions of customers and the emergence of a new security solution. We'll delve…
NewsCybersecurity news roundup — November 8, 2026
Today's cybersecurity landscape highlights critical vulnerabilities being actively exploited and significant financial breaches. We're seeing AI tools inadve…
NewsCybersecurity news roundup — November 7, 2026
Today's cybersecurity landscape was notably active, with several critical vulnerabilities requiring immediate attention and significant data breaches impacti…
NewsCybersecurity news roundup — November 3, 2026
Today's cybersecurity landscape highlights a concerning trend of actively exploited vulnerabilities across various platforms, alongside sophisticated threat …
NewsCybersecurity news roundup — November 2, 2026
Today's cybersecurity news highlights a critical vulnerability in Canonical's LXD and MicroCloud, alongside a significant cryptocurrency theft impacting Poly…
NewsCybersecurity news roundup — November 1, 2026
Today's cybersecurity landscape highlights significant vulnerabilities being actively exploited, alongside several high-profile data breaches. Organizations …
NewsCybersecurity news roundup — October 31, 2026
Today's cybersecurity landscape highlights several critical vulnerabilities, with actively exploited flaws in widely used platforms like WordPress, Drupal, a…
NewsCybersecurity news roundup — October 30, 2026
Today's cybersecurity landscape highlights significant risks across various sectors, from major financial breaches to critical infrastructure vulnerabilities…
NewsCybersecurity news roundup — October 29, 2026
Today's cybersecurity landscape highlights a surge in active exploitation of recently disclosed vulnerabilities across various platforms, alongside sophistic…
NewsCybersecurity news roundup — October 28, 2026
Today's cybersecurity landscape highlights several critical vulnerabilities, including actively exploited flaws in PHP and Apple's CoreGraphics, alongside si…
NewsCybersecurity news roundup — October 27, 2026
Today's cybersecurity landscape highlights significant risks across various platforms, with active exploitation of critical vulnerabilities in PHP and the Br…
NewsCybersecurity news roundup — October 26, 2026
Today's cybersecurity round-up highlights serious vulnerabilities in network tools and emerging threats from sophisticated AI agents. Notably, unpatched flaw…
NewsCybersecurity news roundup — October 25, 2026
Today's cybersecurity round-up highlights several critical vulnerabilities and active exploitation, alongside a significant data breach affecting sensitive i…
NewsCybersecurity news roundup — October 24, 2026
Today's cybersecurity landscape highlights critical vulnerabilities across major software platforms and an increase in sophisticated, AI-driven cyberattacks.…
NewsCybersecurity news roundup — October 23, 2026
Today's cybersecurity headlines feature critical vulnerabilities in widely used software and active exploitation of zero-day flaws. Additionally, major data …
NewsCybersecurity news roundup — October 22, 2026
Today's cybersecurity landscape is marked by critical vulnerability disclosures, with emergency patches released for widely used software like PHP and GitLab…
NewsCybersecurity news roundup — October 21, 2026
Today's cybersecurity landscape highlights critical vulnerabilities needing urgent attention, particularly for PHP and certificate authorities, alongside a c…
NewsCybersecurity news roundup — October 20, 2026
Today's cybersecurity landscape reveals a mix of widespread software vulnerabilities and sophisticated supply chain attacks. From critical flaws in popular w…
NewsCybersecurity news roundup — October 19, 2026
Today's cybersecurity landscape highlights active exploitation of vulnerabilities and significant incidents affecting critical services. We're seeing immedia…
NewsCybersecurity news roundup — October 18, 2026
Today's cybersecurity round-up highlights a critical supply chain attack impacting Microsoft 365 tenants and urgent patches for Drupal vulnerabilities. We al…
NewsCybersecurity news roundup — October 17, 2026
Today's cybersecurity landscape highlights a surge in actively exploited vulnerabilities, ranging from critical zero-days in widely used software to decades-…
NewsCybersecurity news roundup — October 16, 2026
Today's cybersecurity landscape reveals a flurry of critical vulnerabilities across major platforms, alongside notable data breaches and evolving threat acto…
NewsCybersecurity news roundup — October 15, 2026
Today's cybersecurity landscape is marked by critical vulnerability exploits, with multiple vendors issuing urgent patches for flaws actively being used by a…
NewsCybersecurity news roundup — October 14, 2026
Today's cybersecurity news highlights an extraordinary Microsoft Patch Tuesday, addressing a record number of vulnerabilities, including actively exploited z…
NewsCybersecurity news roundup — October 13, 2026
Today's cybersecurity landscape highlights active exploitation of critical vulnerabilities in widely used software, alongside significant data breaches and i…
NewsCybersecurity news roundup — October 12, 2026
Today's cybersecurity round-up highlights a significant data breach impacting millions of records from a Japanese entertainment company and a new variant of …
NewsCybersecurity news roundup — October 11, 2026
Today's cybersecurity news highlights significant developments across threat actor activity and new exploit techniques. Authorities have made an arrest linke…
NewsCybersecurity news roundup — October 10, 2026
Today's cybersecurity news highlights several critical vulnerabilities being actively exploited, alongside significant law enforcement actions against major …
NewsCybersecurity news roundup — October 9, 2026
Today's cybersecurity landscape highlights significant international efforts against state-sponsored hacking, alongside concerning data breaches and emerging…
NewsCybersecurity news roundup — October 8, 2026
Today's cybersecurity landscape highlights critical vulnerabilities being actively exploited, alongside significant data breaches and ongoing ransomware thre…
NewsCybersecurity news roundup — October 7, 2026
Today's cybersecurity landscape features critical vulnerabilities across popular software and widespread data breaches, alongside evolving tactics from threa…
NewsCybersecurity news roundup — October 6, 2026
Today's cybersecurity landscape highlights several critical vulnerabilities, including active exploitation of flaws in Microsoft Exchange and NetScaler, alon…
NewsCybersecurity news roundup — October 5, 2026
Today's cybersecurity news highlights a critical, actively exploited zero-day vulnerability in Citrix NetScaler, alongside significant developments in nation…
NewsCybersecurity news roundup — October 4, 2026
Today's cybersecurity landscape highlights active threats, with a China-linked group exploiting SharePoint flaws for ransomware and significant data breaches…
NewsCybersecurity news roundup — October 3, 2026
Today's cybersecurity landscape saw urgent patches for critical vulnerabilities in GitLab and Fortinet, alongside disclosures of significant data breaches af…
NewsCybersecurity news roundup — October 2, 2026
Today's cybersecurity landscape highlights significant law enforcement successes against ransomware, alongside critical warnings about actively exploited vul…
NewsCybersecurity news roundup — October 1, 2026
Today's cybersecurity landscape highlights a surge in actively exploited zero-day vulnerabilities across various critical systems, from cryptocurrency exchan…
NewsCybersecurity news roundup — September 30, 2026
Today's cybersecurity landscape reveals a mix of critical vulnerabilities, sophisticated threat actor campaigns, and significant data breaches impacting both…
NewsCybersecurity news roundup — September 29, 2026
Today's cybersecurity landscape highlights critical vulnerabilities being actively exploited, alongside significant data breaches and emerging threats from s…
NewsCybersecurity news roundup — September 28, 2026
Today's cybersecurity landscape is marked by critical vulnerability disclosures and active exploitation, urging immediate action from system administrators. …
NewsCybersecurity news roundup — September 27, 2026
Today's cybersecurity landscape highlights a range of critical vulnerabilities being actively exploited, alongside new tactics from threat actors to bypass d…
NewsCybersecurity news roundup — September 26, 2026
Today's cybersecurity landscape is marked by critical vulnerabilities under active exploitation, highlighting the constant threat to widely used web applicat…
NewsCybersecurity news roundup — September 25, 2026
Today's cybersecurity landscape highlights critical vulnerabilities being actively exploited and the emerging risks associated with AI agents. From WordPress…
NewsCybersecurity news roundup — September 24, 2026
Today's cybersecurity news highlights several critical vulnerabilities, with actively exploited zero-days impacting F5 BIG-IP APM, Check Point Security Gatew…
NewsCybersecurity news roundup — September 23, 2026
Today's cybersecurity landscape highlights critical vulnerabilities in widely used software and active exploitation by various threat actors. Several critica…
NewsCybersecurity news roundup — September 22, 2026
Today's cybersecurity landscape features critical warnings about actively exploited vulnerabilities and a notable data breach affecting e-commerce merchants.…
NewsCybersecurity news roundup — September 21, 2026
Today's cybersecurity round-up highlights innovative new methods used by attackers to bypass common security measures, alongside a critical vulnerability dis…
NewsCybersecurity news roundup — September 20, 2026
Today's cybersecurity landscape highlights critical vulnerabilities, with several actively exploited flaws requiring immediate attention. We also see emergin…
NewsCybersecurity news roundup — September 19, 2026
Today's cybersecurity landscape highlights critical vulnerabilities across major platforms and significant data breaches, underscoring the constant threat to…
NewsCybersecurity news roundup — September 18, 2026
Today's cybersecurity landscape features multiple critical vulnerabilities requiring immediate attention from system administrators, alongside significant br…
NewsCybersecurity news roundup — September 17, 2026
Today's cybersecurity landscape features several critical vulnerabilities under active exploitation, highlighting the ongoing need for rapid patching. We als…
NewsCybersecurity news roundup — September 16, 2026
Today's cybersecurity news highlights several critical vulnerabilities, including actively exploited flaws in Cisco Secure Email Gateway and VMware vCenter, …
NewsCybersecurity news roundup — September 15, 2026
Today's cybersecurity landscape highlights a range of critical vulnerabilities being actively exploited, alongside significant data breaches impacting both g…
NewsCybersecurity news roundup — September 14, 2026
Today's cybersecurity landscape highlights active exploitation of vulnerabilities and sophisticated phishing tactics targeting major cloud platforms. Authori…
NewsCybersecurity news roundup — September 13, 2026
Today's cybersecurity landscape is marked by urgent warnings regarding actively exploited vulnerabilities and the growing impact of AI on threat actor capabi…
NewsCybersecurity news roundup — September 12, 2026
Today's cybersecurity landscape highlights a surge in actively exploited vulnerabilities across various platforms, from GitLab to Cisco, alongside a concerni…
NewsCybersecurity news roundup — September 11, 2026
Today's cybersecurity landscape highlights significant activity from various threat actors, including sophisticated campaigns exploiting known vulnerabilitie…
NewsCybersecurity news roundup — September 10, 2026
Today's cybersecurity landscape is marked by critical vulnerabilities across major platforms and significant threat actor activity. Several zero-day exploits…
NewsCybersecurity news roundup — September 9, 2026
Today's cybersecurity news highlights a record-breaking Patch Tuesday from Microsoft, addressing nearly 1,000 vulnerabilities, alongside critical zero-day ex…
NewsCybersecurity news roundup — September 8, 2026
Today's cybersecurity landscape highlights critical vulnerabilities, with several zero-day exploits actively targeting popular platforms and tools. Data brea…
NewsCybersecurity news roundup — September 7, 2026
Today's cybersecurity landscape highlights critical vulnerabilities, with MikroTik routers being actively exploited and new evasion tactics emerging in phish…
NewsCybersecurity news roundup — September 6, 2026
Today's cybersecurity headlines reveal a critical period for website and system security, with multiple actively exploited vulnerabilities in popular platfor…
NewsCybersecurity news roundup — September 5, 2026
Today's cybersecurity news highlights several critical vulnerabilities, including actively exploited flaws in Google Chrome, Citrix NetScaler, and WordPress …
NewsCybersecurity news roundup — September 4, 2026
Today's cybersecurity landscape highlights critical vulnerabilities, widespread phishing campaigns, and significant data breaches impacting both individuals …
NewsCybersecurity news roundup — September 3, 2026
Today's cybersecurity news highlights several critical vulnerabilities being actively exploited, alongside significant law enforcement actions against long-s…
NewsCybersecurity news roundup — September 2, 2026
Today's cybersecurity landscape is marked by urgent exploitation of critical vulnerabilities in widely used software, with attackers swiftly moving to levera…
NewsCybersecurity news roundup — September 1, 2026
Today's cybersecurity landscape features a range of significant incidents, from nation-state linked espionage targeting critical infrastructure to widespread…
NewsCybersecurity news roundup — August 31, 2026
Today's cybersecurity landscape highlights a range of threats from advanced malware campaigns to significant data breaches, impacting both individuals and ma…
NewsCybersecurity news roundup — August 30, 2026
Today's cybersecurity landscape highlights critical website vulnerabilities and significant data breaches, emphasizing the ongoing need for vigilance. Websit…
NewsCybersecurity news roundup — August 29, 2026
Today's cybersecurity landscape highlights a flurry of critical vulnerabilities and significant data breaches, emphasizing the constant need for vigilance an…
NewsCybersecurity news roundup — August 28, 2026
Today's cybersecurity news highlights significant vulnerabilities requiring immediate attention and major data breaches impacting millions. We also see criti…
NewsCybersecurity news roundup — August 27, 2026
Today's cybersecurity landscape highlights significant government action against state-sponsored threats, with the FBI disrupting Chinese espionage infrastru…
NewsCybersecurity news roundup — August 26, 2026
Today's cybersecurity news highlights several critical vulnerabilities, including actively exploited flaws in Oracle WebLogic Server and WordPress plugins, a…
NewsCybersecurity news roundup — August 25, 2026
Today's cybersecurity roundup highlights a flurry of critical vulnerabilities, active exploitation campaigns, and significant policy developments. We're seei…
NewsCybersecurity news roundup — August 24, 2026
Today's cybersecurity landscape highlights a notable evolution in Android malware, with ToxicPanda now leveraging VPN permissions to disrupt app stores. Stay…
NewsCybersecurity news roundup — August 23, 2026
Today's cybersecurity landscape highlights several ongoing threats, from new malware campaigns targeting Android devices to persistent banking Trojans. We al…
NewsCybersecurity news roundup — August 22, 2026
Today's cybersecurity landscape highlights critical vulnerabilities being actively exploited, underscoring the urgent need for timely patching. We also see c…
NewsCybersecurity news roundup — August 21, 2026
Today's cybersecurity landscape highlights significant threats, from critical vulnerabilities in widely used software being actively exploited to sophisticat…
NewsCybersecurity news roundup — August 20, 2026
Today's cybersecurity landscape highlights significant ongoing threats, with CISA urging immediate patching for several actively exploited vulnerabilities ac…
NewsCybersecurity news roundup — August 19, 2026
Today's cybersecurity landscape highlights critical vulnerabilities across major platforms and concerning new tactics from threat actors. From actively explo…
NewsCybersecurity news roundup — August 18, 2026
Today's cybersecurity landscape highlights critical vulnerabilities in widely used software and significant data breaches impacting millions. Urgent updates …
NewsCybersecurity news roundup — August 17, 2026
Today's cybersecurity round-up highlights a significant data breach impacting SafePal cryptocurrency wallet users and widespread DDoS attacks targeting the s…
NewsCybersecurity news roundup — August 16, 2026
Today's cybersecurity headlines include the emergence of a new Linux botnet, Evooo1Bot, which is actively targeting internet-facing devices. This botnet is d…
NewsCybersecurity news roundup — August 15, 2026
Today's cybersecurity headlines reveal a surge in actively exploited vulnerabilities and several significant data breaches impacting millions. From critical …
NewsCybersecurity news roundup — August 14, 2026
Today's cybersecurity landscape highlights immediate threats from actively exploited vulnerabilities across major platforms like SharePoint and VMware, along…
NewsCybersecurity news roundup — August 13, 2026
Today's cybersecurity landscape is marked by urgent patch requirements and active exploitation, highlighting persistent threats from nation-state actors and …
NewsCybersecurity news roundup — August 12, 2026
Today's cybersecurity landscape saw significant activity, from extensive vulnerability patching across major platforms to advanced tactics employed by ransom…
NewsCybersecurity news roundup — August 11, 2026
Today's cybersecurity landscape highlights significant threats from nation-state actors and opportunistic cybercriminals alike. We're seeing continued exploi…
NewsCybersecurity news roundup — August 10, 2026
Today's cybersecurity news highlights significant vulnerabilities in widely used software, underscoring the constant need for vigilance. The primary focus is…
NewsCybersecurity news roundup — August 9, 2026
Today's cybersecurity landscape highlights a range of critical vulnerabilities, with several zero-day exploits impacting widely used software. Webmail securi…
NewsCybersecurity news roundup — August 8, 2026
Today's cybersecurity landscape highlights critical vulnerabilities across major platforms like WordPress and Linux, alongside significant data breaches impa…
NewsCybersecurity news roundup — August 7, 2026
Today's cybersecurity roundup highlights critical vulnerabilities in widely used systems and significant legal outcomes for cybercriminals. From actively exp…
NewsCybersecurity news roundup — August 6, 2026
Today's cybersecurity landscape highlights critical vulnerabilities across major platforms and the escalating use of AI by threat actors. Several actively ex…
NewsCybersecurity news roundup — August 5, 2026
Today's cybersecurity landscape highlights significant threats across various domains, from critical vulnerabilities in widely used systems to sophisticated …
NewsCybersecurity news roundup — August 4, 2026
Today's cybersecurity landscape highlights critical vulnerabilities being actively exploited, alongside significant data breaches impacting governmental and …
NewsCybersecurity news roundup — August 3, 2026
Today's cybersecurity landscape features a significant cryptocurrency theft, along with anticipated browser security enhancements. A critical flaw in a hardw…
NewsCybersecurity news roundup — August 2, 2026
Today's cybersecurity headlines reveal a critical flaw in hardware wallets leading to significant cryptocurrency theft and important patches for popular web …
NewsCybersecurity news roundup — August 1, 2026
Today's cybersecurity news highlights significant AI-related incidents, with leading models inadvertently breaching organizations and a Chinese-speaking thre…
NewsCybersecurity news roundup — July 31, 2026
Today's cybersecurity landscape highlights critical vulnerabilities across major platforms and renewed warnings about nation-state actor activity. From criti…
NewsCybersecurity news roundup — July 30, 2026
Today's cybersecurity landscape features several critical vulnerability disclosures, including zero-day exploits impacting Cisco FMC and Microsoft Exchange. …
NewsCybersecurity news roundup — July 29, 2026
Today's cybersecurity landscape highlights critical vulnerabilities in widely used software and active exploitation by threat actors. Several zero-day flaws …
NewsCybersecurity news roundup — July 28, 2026
Today's cybersecurity landscape highlights active exploitation of critical vulnerabilities and significant data breaches, alongside emerging threats from AI …
NewsCybersecurity news roundup — July 27, 2026
Today's cybersecurity landscape highlights a significant data breach impacting over a million individuals and new defensive measures being implemented by maj…
NewsCybersecurity news roundup — July 26, 2026
Today's cybersecurity round-up highlights actively exploited vulnerabilities and innovative new attack methods. Threat actors are leveraging sophisticated te…
NewsCybersecurity news roundup — July 25, 2026
Today's cybersecurity landscape highlights significant vulnerabilities across major platforms and increased sophistication in threat actor tactics. We're see…
NewsCybersecurity news roundup — July 24, 2026
Today's cybersecurity landscape highlights a surge in state-sponsored espionage and the constant threat of active exploits. We're seeing Russian threat actor…
NewsCybersecurity news roundup — July 23, 2026
Today's cybersecurity landscape highlights significant vulnerabilities being actively exploited, ranging from critical infrastructure to widely used software…
NewsCybersecurity news roundup — July 22, 2026
Today's cybersecurity landscape highlights a surge in actively exploited vulnerabilities across various platforms, from critical SharePoint and WordPress fla…
NewsCybersecurity news roundup — July 21, 2026
Today's cybersecurity landscape highlights significant threats, including actively exploited vulnerabilities in critical systems and an increase in sophistic…
NewsCybersecurity news roundup — July 20, 2026
Today's cybersecurity landscape highlights critical vulnerabilities, with NGINX, SonicWall SMA, and WordPress users urged to update immediately due to active…
NewsCybersecurity news roundup — July 19, 2026
Today's cybersecurity round-up highlights critical updates needed for popular software and a significant increase in infostealer attacks. Website administrat…
NewsCybersecurity news roundup — July 18, 2026
Today's cybersecurity landscape features critical new vulnerabilities requiring urgent patching across major platforms like WordPress, OpenSSL, and Microsoft…
NewsCybersecurity news roundup — July 17, 2026
Today's cybersecurity news highlights significant legal consequences for cybercriminals, critical vulnerabilities requiring immediate attention, and emerging…
NewsCybersecurity news roundup — July 16, 2026
Today's cybersecurity news highlights critical vulnerabilities across major platforms and emerging threats leveraging AI. We also see significant law enforce…
NewsCybersecurity news roundup — July 15, 2026
Today's cybersecurity landscape highlights a massive wave of patches, with Microsoft leading the charge to fix a record number of vulnerabilities, including …
NewsCybersecurity news roundup — July 14, 2026
Today's cybersecurity headlines feature critical warnings about actively exploited vulnerabilities in Joomla extensions and a new macOS infostealer. We also …
NewsCybersecurity news roundup — July 13, 2026
Today's cybersecurity round-up highlights a concerning evolution in mobile malware tactics, as a new variant of RedHook Android malware exploits Wireless ADB…
NewsCybersecurity news roundup — July 12, 2026
Today's cybersecurity landscape highlights critical vulnerabilities, with a significant flaw in Zimbra's email platform allowing arbitrary code execution and…
NewsCybersecurity news roundup — July 11, 2026
Today's cybersecurity headlines reveal a critical warning for ShareFile users to shut down Storage Zone Controllers due to an active threat, alongside the di…
NewsCybersecurity news roundup — July 10, 2026
Today's cybersecurity headlines reveal critical updates on new vulnerabilities, widespread data breaches, and the ongoing evolution of ransomware and AI-driv…
NewsCybersecurity news roundup — July 9, 2026
Today's cybersecurity news highlights several critical vulnerabilities and ongoing threats, particularly concerning AI coding agents and widely used software…
NewsCybersecurity news roundup — July 8, 2026
Today's cybersecurity landscape highlights significant risks across various platforms, from newly discovered backdoors in network devices to critical vulnera…
NewsCybersecurity news roundup — July 7, 2026
Today's cybersecurity landscape is marked by urgent warnings regarding actively exploited vulnerabilities in popular software and a surge in sophisticated ph…
NewsCybersecurity news roundup — July 6, 2026
Today's cybersecurity news highlights continued development for the Flipper Zero firmware, indicating ongoing community involvement in its evolution. This up…
NewsCybersecurity news roundup — July 5, 2026
Today's cybersecurity headlines highlight emerging threats, with a U.S. government entity reportedly paying a significant sum to prevent data leaks and a new…
NewsCybersecurity news roundup — July 4, 2026
Today's cybersecurity landscape highlights significant risks from both nation-state actors and emerging AI-driven threats. We're seeing critical vulnerabilit…
EmailSPF, DKIM, and DMARC explained
Learn what SPF, DKIM, and DMARC do, why all three matter together, and how to check if your domain is protected against email spoofing.
EmailHow to stop someone sending email from your domain
Anyone can send email pretending to be you if your domain lacks SPF, DKIM, and DMARC. Here's how to set all three up and verify they're working.
EmailWhat is DMARC — and does your site need it?
DMARC tells mail servers what to do with emails that fail authentication. Here's what it does, why every domain needs it, and how to check yours.
ExposureWhat is a .env file — and what happens if it's publicly accessible?
A publicly accessible .env file hands attackers your database credentials, API keys, and secrets. Learn how it happens and how to check if yours is exposed.
ExposureWhy your .git folder should never be publicly accessible
An exposed .git folder lets attackers reconstruct your entire source code. Here's why it happens, what's at risk, and how to block access immediately.
ExposureHow to check if your website is leaking sensitive files
Config files, backups, logs — if they're publicly accessible on your server, attackers are already looking. Here's what to check and how to find it fast.
ServerWhat is a web application firewall — and does your site need one?
A WAF sits in front of your site and blocks attacks before they reach your server. Here's what it protects against, how it differs from a network firewall, and whether you need one.
ServerWhat open ports on your server mean for security
Every open port on your server is a potential entry point. Learn which ports are commonly left exposed by mistake and how to check which ones are visible on yours.
ServerWhat is server version disclosure — and why it's a risk
If your server headers reveal your software version, attackers can look up every known vulnerability for that exact version in seconds. Here's how to fix it.
TLSTLS 1.0 and 1.1 are deprecated — is your site still running them?
TLS 1.0 and 1.1 have known cryptographic weaknesses and are deprecated by all major browsers and the IETF. Here's how to check if your server still accepts them.
TLSWhat is Heartbleed — and is your server still vulnerable?
Heartbleed let attackers read server memory — including private keys and passwords — without leaving any trace. Some servers are still vulnerable more than a decade later.
TLSWhat are TLS cipher suites — and which ones are unsafe?
Not all TLS cipher suites are secure. Learn what they are, which ones to avoid, and why forward secrecy matters for your HTTPS configuration.
ReputationHow to check if your domain has been in a data breach
If your domain appears in breach databases, your users' credentials may be circulating among attackers. Here's how to check and what to do about it.
ReputationWhat to do if your website is on a blocklist
A blocklisted site triggers browser warnings, kills email deliverability, and can drop you from search results. Here's how to find out and get removed.
ReputationHow to check if someone is impersonating your domain
Attackers register domains that look like yours to phish your customers. Here's how lookalike domains work and how to detect them before damage is done.
WordPressHow to Check If Your WordPress Site Is Hacked
Signs of WordPress compromise and exactly what to check first: unknown admin users, modified core files, suspicious plugins, and outbound spam.
WordPressWordPress security checklist for non-developers
Most WordPress attacks exploit outdated plugins and weak passwords — not sophisticated hacking. This checklist covers the essentials any site owner can follow.
WordPressHow to check if your WordPress plugins are outdated — and why it matters
Outdated WordPress plugins are the leading cause of site compromises. Here's how to check what you're running and why updating promptly matters so much.
WordPressWordPress user enumeration — what it is and how to stop it
WordPress exposes usernames by default through author archives and the REST API. Here's what that means for brute-force risk and exactly how to prevent it.
ReportsWhat does a website security scan actually check?
Passive or active? Headers or source code? A plain-language breakdown of what a security scan tests, what it can see from the outside, and what it can't.
ReportsHow to read a website security report
Grades, severity levels, findings by category — here's how to interpret a security report and know what to fix first, even without a technical background.
ReportsWhat is a website security grade — and how is it calculated?
An A–F security grade summarises your site's security configuration at a glance. Here's what goes into it and what each letter actually means.
GuidesWebsite security checklist for small businesses
Most small business sites are one misconfiguration away from a breach. This checklist covers HTTPS, headers, email authentication, backups, and more.
DNSWhat is subdomain takeover — and how to prevent it
A forgotten DNS record pointing to a deprovisioned service can let an attacker take control of your subdomain. Here's how it works and how to prevent it.
HeadersWhat is HSTS — and why should your site enforce it?
HTTPS alone doesn't stop SSL stripping attacks. HSTS tells browsers to always use HTTPS — even before the first request is made. Here's how to enable it.
HeadersHTTP Security Headers Explained (And Why Yours Are Probably Missing)
What Content-Security-Policy, HSTS, X-Frame-Options and other security headers actually do, and how to add them without breaking your site.
TLSSSL Certificate Checker Guide: What to Actually Verify
A practical guide to checking your SSL/TLS setup — expiry, weak protocols, cipher strength, and the Heartbleed/POODLE checks most checkers skip.