What your website tells a stranger before they load the page
Before a single pixel appears, your server has already made a statement about how seriously it takes security. Attackers read it first — here's how to read yours.
What we find, and what it means
Notes from the work: findings we keep seeing, fixes that hold up, and the reasoning behind how this product decides what counts as a risk.
4 articles matching
Tagged csp · clear
The CSP that killed our own form (a production-only Next.js bug)
The forgot-password form is not working at all. Not "it's slow." Not "I got an error." Not working at all. So we did what you do. Checked the error tracker: clean. Checked the…
A Content-Security-Policy That Reports as Present and Defends Nothing
A script-src carrying 'unsafe-inline' passes every presence check and stops no injection. The theatre policy, the working one, and the war story of a strict CSP that broke sign-up with no error anywhere.
3 min read
How to Check Your Website's Security Headers (and What Each One Actually Stops)
One curl command shows you every security header your site sends. This guide is the decoder: what each header stops, what its absence costs, and the three that matter most.
2 min read