A 30-minute security baseline for a small business website
No security team, no budget, one afternoon. This checklist covers the basics that stop the automated attacks that actually hit small sites.
Read the post →
How to read a scary website security report
A client forwards a report full of red alerts. Before you panic or pay anyone: here is how to tell signal from sales pitch.
Read the post →
Why we never auto-apply Content-Security-Policy (and how to roll one out safely)
CSP is the strongest security header and the only one that can take down your checkout. Respect that. Roll it out report-only first.
Read the post →
What a good HTTPS setup looks like in 2026
Certificates are free and automatic now. The remaining mistakes are configuration: old protocols, missing redirects, mixed content.
Read the post →
Stop telling attackers exactly what to exploit
Generator tags, X-Powered-By headers and readme files turn generic bots into targeted attacks. Trim the signals.
Read the post →
Secure, HttpOnly, SameSite: cookie flags in plain English
Your session cookie is a key to your site. Three small flags decide how easy that key is to steal.
Read the post →
Clickjacking still works: why X-Frame-Options matters in 2026
An invisible copy of your site inside someone else's page can hijack every click. One header ends the trick.
Read the post →
User enumeration: how attackers learn your WordPress usernames
Half of every login is public if your site leaks usernames. Two URLs reveal them on most WordPress sites.
Read the post →
xmlrpc.php: the WordPress endpoint attackers still love
A leftover from 2008 lets attackers test hundreds of passwords per request. Most sites can turn it off today.
Read the post →
The 6 security headers every website needs (and what they actually do)
Six response headers shut down whole classes of attacks. Most sites send none of them. Here is what each one does, in plain English.
Read the post →
The files your website is accidentally making public
.env files, wp-config backups, readme.html: leftover files hand attackers credentials and version info. Here is how they leak and how to check.
Read the post →
HSTS in plain English: the header that stops HTTPS downgrade attacks
Your padlock does not help if the very first request goes out unencrypted. HSTS closes that gap with one line.
Read the post →