Do accessibility overlay widgets actually make your website WCAG compliant?
In 2025, 28% of all digital accessibility lawsuits targeted sites already running an overlay widget. Here is what these tools can and cannot fix, and why the FTC fined one $1 million for claiming otherwise.
Read the post →
EU AI Act penalties: what non-compliance actually costs
The AI Act’s transparency rules carry fines up to EUR 15 million or 3% of global turnover, whichever is higher. Here is what Article 99 actually says, and who enforces it.
Read the post →
Malware and backdoors: the early warning signs your WordPress site has been compromised
SEO spam alone accounted for over 420,000 WordPress malware incidents last year. Here is how a backdoor usually gets in, and the signs that show up before a client calls you panicking.
Read the post →
Do you need an accessibility statement? What the European Accessibility Act requires
The European Accessibility Act has applied since 28 June 2025, and Annex V spells out exactly what a compliant accessibility statement has to say. Here is the short version.
Read the post →
SQL injection explained: how a contact form becomes a way into your database
SQL injection carries more than 14,000 known vulnerabilities and still ranks among OWASP’s top risks in 2025. Here is what it actually is, in plain English.
Read the post →
WordPress login hardening: 2FA, rate limiting, and why "admin" still gets hit
Wordfence blocked over 19 billion brute force attacks in a single quarter of 2025. Three fixes close most of that gap on your own site.
Read the post →
Subdomain takeover: how a forgotten DNS record gets hijacked
An old CNAME pointing at a service you cancelled months ago is enough. Here is how subdomain takeover actually works, and how to check your own DNS zone.
Read the post →
Abandoned WordPress plugins: the security risk hiding in your dashboard
91% of new WordPress vulnerabilities in 2025 came from plugins, per Patchstack. Here is how to spot the abandoned ones before an attacker does.
Read the post →
Does your website chatbot need an AI disclosure label?
EU AI Act transparency rules apply from 2 August 2026. If your site talks back to visitors, Article 50 has a specific, plainly worded requirement for you.
Read the post →
The 5 accessibility failures we find on almost every website
Low contrast text, missing alt text, unlabelled forms: the WebAIM Million finds these on nearly every home page it scans. Here is the short list to check first.
Read the post →
The European Accessibility Act is already in force: do you need to comply?
It has applied since 28 June 2025, and there is a microenterprise exemption most small businesses have never read. Here is how to tell which side you are on.
Read the post →
We audited our own founder's site: 73 to 91 in three clicks
A security tool should eat its own cooking. Here is our founder's own portfolio site, scored, fixed and re-scored, with the one red mark we left alone.
Read the post →
A 30-minute security baseline for a small business website
No security team, no budget, one afternoon. This checklist covers the basics that stop the automated attacks that actually hit small sites.
Read the post →
How to read a scary website security report
A client forwarded us a 24-page security report with a red 9.8 on it. Half a page of it was real. Here is how to tell which half.
Read the post →
Why we never auto-apply Content-Security-Policy (and how to roll one out safely)
CSP is the strongest security header and the only one that can take down your checkout. Respect that. Roll it out report-only first.
Read the post →
What a good HTTPS setup looks like in 2026
Certificates are free and automatic now. The remaining mistakes are configuration: old protocols, missing redirects, mixed content.
Read the post →
Stop telling attackers exactly what to exploit
Generator tags, X-Powered-By headers and readme files turn generic bots into targeted attacks. Trim the signals.
Read the post →
Secure, HttpOnly, SameSite: cookie flags in plain English
Your session cookie is a key to your site. Three small flags decide how easy that key is to steal.
Read the post →
Clickjacking still works: why X-Frame-Options matters in 2026
An invisible copy of your site inside someone else's page can hijack every click. One header ends the trick.
Read the post →
User enumeration: how attackers learn your WordPress usernames
Half of every login is public if your site leaks usernames. Two URLs reveal them on most WordPress sites.
Read the post →
xmlrpc.php: the WordPress endpoint attackers still love
A leftover from 2008 lets attackers test hundreds of passwords per request. Most sites can turn it off today.
Read the post →
The 6 security headers every website needs (and what they actually do)
Six response headers shut down whole classes of attacks. Most sites send none of them. Here is what each one does, in plain English.
Read the post →
The files your website is accidentally making public
.env files, wp-config backups, readme.html: leftover files hand attackers credentials and version info. Here is how they leak and how to check.
Read the post →
HSTS in plain English: the header that stops HTTPS downgrade attacks
Your padlock does not help if the very first request goes out unencrypted. HSTS closes that gap with one line.
Read the post →