Website security
Technical guides about website security, written for practical follow-up.
Latest guides
13 articlesAudit security headers across redirects, errors and authenticated pages
Build a response matrix that catches missing middleware, stale edge policies and differences between public and signed-in responses.
Diagnose TLS certificate failures by hostname, chain and time
Investigate certificate errors using the requested hostname, SNI, chain evidence and the clock involved in validation.
Roll out HSTS without stranding a forgotten subdomain
Plan max-age, includeSubDomains and preload decisions around service ownership and recovery time.
Build a CSP rollout around nonces and actual application flows
Move from a dependency inventory to report-only observation and enforcement, with concrete nonce and reporting decisions.
Session cookies: scope, SameSite and prefix rules
Choose attributes that fit login and payment flows, then check what the browser actually accepts and sends.
Referrer-Policy: decide which navigation details leave your site
Compare origin and full-URL disclosure across request types, and test policies where redirects and subresources complicate the picture.
Permissions Policy for embedded camera and microphone features
Debug feature access across top-level headers, iframe allow attributes, user permission and secure contexts.
Debug CORS preflights and credentialed requests
Trace a browser request from Origin through OPTIONS and the actual response, including cache and credential failures.
Read a URL before you trust its destination
Locate the real hostname, identify userinfo and encoding traps, and separate URL syntax from destination reputation.
Percent encoding: choose the right operation for each URL component
Avoid double encoding, broken query parameters and plus-sign mistakes with component-level examples.
Subresource Integrity for scripts served from a CDN
Generate a digest from exact asset bytes and plan for CORS, version changes and failed loads during deployment.
Write a security.txt file that a reporter can actually use
Publish reachable contact details, expiry and canonical information, then test the complete reporting path.
Security headers that earn their place.
A practical way to improve response policies while preserving login, checkout and the integrations your site actually needs.
No guides match that search.
13 guides