Guides
In-depth guides
Longer walkthroughs for specific setups: real screenshots, code you can paste and the reason behind every step. The short fix page for each check lives under Learn.
All guides
54 guides, page 2 of 5.
- Security16 min read
Rate limiting and bots on a small site, without blocking Google
Most traffic on a small site is bots: crawlers, scrapers, login guessers. Layer robots.txt, a CDN, server rate limits and WordPress switches so they stop costing CPU and Google never notices.Updated 4 Oct 2026 - Security13 min read
strict-origin-when-cross-origin: Referrer-Policy and Permissions-Policy
strict-origin-when-cross-origin sends your full URL to your own pages and only your domain to other sites. What leaks without it, how to set Referrer-Policy, and its companion Permissions-Policy.Updated 4 Oct 2026 - Security13 min read
Why are my emails going to spam? A diagnosis in six steps
Why your emails go to spam, and how to find out which reason applies to you: authentication, a tool sending as your domain, reputation, server basics or content. Check them in this order and fix the first one that fails.Updated 4 Oct 2026 - Security22 min read
SSL and TLS: how HTTPS works and the checks that matter
HTTPS is an SSL/TLS certificate, a handshake and a few server settings working together. This guide explains the whole system in plain language, then the checks that keep the padlock on.Updated 2 Oct 2026 - Security13 min read
What is cloaking in SEO? Why hacked sites show Google a different page
Cloaking in SEO means showing search engines different content from what people see. Google treats it as spam, and hacked sites use it to hide injected links from their owners. Here is how it works and how to see what Googlebot sees.Updated 28 Sept 2026 - Security12 min read
Content Security Policy: roll it out without breaking your site
A Content Security Policy tells the browser where your pages may load scripts, styles and frames from. Roll it out from report-only to enforced, with nonces or hashes instead of unsafe-inline.Updated 27 Sept 2026 - Security12 min read
How to check your WordPress version, and what to do when it is out of date
Check your WordPress version in the dashboard, on the server or from outside through the generator tag. What counts as out of date, and a safe routine for updating core, themes, plugins and PHP.Updated 27 Sept 2026 - Security12 min read
HttpOnly cookie, Secure and SameSite: the cookie flags explained
An HttpOnly cookie cannot be read by JavaScript, so an injected script cannot steal it. What HttpOnly, Secure and SameSite each block, which cookies need which, and how to set them.Updated 27 Sept 2026 - Security11 min read
Renew an SSL certificate: automate renewal, then monitor expiry
Public SSL certificates now last 200 days at most and will drop to 47 by 2029, so renewal has to be automatic. How to renew on each stack, why renewal fails silently, and how to monitor expiry.Updated 27 Sept 2026 - Security10 min read
TLS 1.2 vs 1.3: what changed, and turning TLS 1.0 and 1.1 off
TLS 1.3 is faster and simpler than TLS 1.2, and both are safe when configured well; TLS 1.0 and 1.1 are not. The differences, a 1.2-plus-1.3 config for every server, and how to prove the old versions are off.Updated 27 Sept 2026 - Security11 min read
WordPress backup: a plan you have actually test-restored
To back up a WordPress site, copy the database and wp-content off the server on a schedule, keep the copies out of the web root, and prove they work with a restore every quarter.Updated 27 Sept 2026 - Security13 min read
WordPress hacked? Clean it and keep it clean, step by step
WordPress hacked? Contain it, preserve the evidence, find the way in, reinstall clean, verify what Google sees, harden and request a review, with the wp-cli commands for each step.Updated 27 Sept 2026
Guides tell you how. Your report tells you what.
Run a free report to see which of these guides apply to your site.