The subdomain nobody remembered
In 2023 a marketing team pointed a subdomain at a cloud app. In 2024 the app was deleted. The DNS record wasn't. In 2026, a stranger claimed it.
Web Security
9 articles on web security — what goes wrong, how to fix it, and how to tell the fix held.
What your website tells a stranger before they load the page
Before a single pixel appears, your server has already made a statement about how seriously it takes security. Attackers read it first — here's how to read yours.
The CSP that killed our own form (a production-only Next.js bug)
The forgot-password form is not working at all. Not "it's slow." Not "I got an error." Not working at all. So we did what you do. Checked the error tracker: clean. Checked the…
The Website Security Checklist for 2026 — Sorted by How You Actually Verify Each Item
Most checklists tell you what to do and leave you no way to know whether it is already done. This one is sorted by how each item is verified: what a scanner confirms in seconds, what needs a person, and what no tool can answer for you.
8 min read
Secure, HttpOnly, SameSite: Cookie Attributes Explained by What Goes Wrong Without Them
Three attributes, three specific attacks. What each one stops, what happens on the day it is missing, and the one line of Set-Cookie a session cookie should carry.
2 min read
A Content-Security-Policy That Reports as Present and Defends Nothing
A script-src carrying 'unsafe-inline' passes every presence check and stops no injection. The theatre policy, the working one, and the war story of a strict CSP that broke sign-up with no error anywhere.
3 min read
Missing HSTS Header: What It Means, How to Fix It, and How to Prove You Fixed It
The cheapest finding on your report to fix — one header — and the easiest to get wrong in three specific ways. The exact fix for nginx, Apache, Caddy and Next.js, and how to prove it worked.
5 min read
How to Check Your Website's Security Headers (and What Each One Actually Stops)
One curl command shows you every security header your site sends. This guide is the decoder: what each header stops, what its absence costs, and the three that matter most.
2 min read
How to Monitor SSL Certificate Expiration (Before Your Customers Do It for You)
An expired certificate is a full outage with a scary error page, and certificate lifetimes just got cut in half — renewals you handled yearly are now a several-times-a-year event. The checks, the automation, and why automation still needs a watcher.
2 min read