Website security
Technical guides about website security, written for practical follow-up.
Latest guides
13 articlesYour homepage headers pass. What happens on a redirect or an error?
Build a small response matrix that tests security policies across the routes and status codes users actually receive.
A valid certificate can still fail for the hostname you requested
Trace TLS errors through hostname matching, SNI, chain delivery and the time used by the verifier.
The forgotten subdomain in an HSTS rollout
Review subdomain readiness and recovery time before adding includeSubDomains or requesting preload.
A CSP nonce must change with the response, not with the deployment
Inspect nonce generation, caching and report-only observations while introducing CSP to a real application.
A login cookie is set but the next request omits it. Check the scope
Use Domain, Path, Secure and SameSite evidence to explain a session cookie that behaves differently across requests.
A campaign URL carries private details. Check what the referrer reveals
Compare full-URL, origin-only and omitted referrers for the navigation and subresource requests that matter.
The embed asks for a camera, but the parent page never delegated it
Trace feature delegation through the top-level header, iframe policy and user permission for embedded media.
OPTIONS succeeded. Why did the browser still reject the API response?
Inspect preflight and actual-response headers together for credentialed and cross-origin API requests.
The brand name is in the URL. Is it actually the destination host?
Inspect parsed hostnames, user information and encoded components before using a link in a domain decision.
An encoded query changed its meaning. Check which component you encoded
Work through ampersands, plus signs and percent escapes using the encoding operation appropriate to each URL component.
A CDN file changed and the browser blocked it. Recheck the SRI contract
Generate integrity values from exact served bytes and coordinate asset versions, HTML changes and cross-origin delivery.
A security.txt contact can parse correctly and still be unreachable
Check reporting destinations, expiry and published location so a security report has a usable path to an owner.
Introduce browser security policies around the flows you cannot break
Plan staged policy changes for login, embeds and third-party dependencies, with response-level verification.
No guides match that search.
13 guides