Guides
In-depth guides
Longer walkthroughs for specific setups: real screenshots, code you can paste and the reason behind every step. The short fix page for each check lives under Learn.
All guides
25 guides, page 2 of 3.
- Security11 min read
Permissions-Policy: turning off camera, microphone and friends
One response header switches off browser features your site never uses, for your own scripts and every embedded iframe. The syntax, a sensible default per site type, server configs and a test.Updated 25 Sept 2026 - Security12 min read
Pharma and casino spam injections: how they hide and how to find them
Why attackers rent your domain for pharma and casino rankings, the six injection shapes and which report finding shows each, where the code lives in WordPress, and a detection routine for one hour.Updated 25 Sept 2026 - Security14 min read
Rate limiting and bots on a small site, without blocking Google
Most traffic on a small site is bots: crawlers, scrapers, login guessers. Layer robots.txt, a CDN, server rate limits and WordPress switches so they stop costing CPU and Google never notices.Updated 25 Sept 2026 - Security14 min read
Recovering a hacked WordPress site, step by step
Contain, preserve, find the entry, reinstall clean, verify with a Googlebot comparison, harden, request review. The order that keeps the spam from coming back, with the wp-cli commands for each step.Updated 25 Sept 2026 - Security12 min read
Referrer-Policy: what leaks in the Referer header and how to stop it
The Referer header tells every site, script and image on your page which URL a visitor came from, query string included. Pick the right Referrer-Policy value, set it on any server and verify it.Updated 25 Sept 2026 - Security8 min read
Security headers from zero to A
Six HTTP headers decide whether your site gets an A or an F on any security scanner. This guide explains what each one does in plain terms, gives copy-paste configs for nginx, Apache, Caddy, Cloudflare and WordPress, and shows how to roll out a Content-Security-Policy without breaking the site.Updated 25 Sept 2026 - Security11 min read
security.txt: the contact file for security researchers
A security.txt file tells whoever finds a hole in your site where to report it. The required fields, the Expires trap, a complete sample, and hosting it on WordPress, Next.js and nginx.Updated 25 Sept 2026 - Security10 min read
Server and X-Powered-By headers: why version numbers matter
Apache/2.4.29, PHP/7.2.24, Express. Two response headers hand every scanner your exact software versions. What they reveal, what hiding them does and does not achieve, and the fix for each server.Updated 25 Sept 2026 - Security8 min read
SSL/TLS checks that matter (and the ones that do not)
Certificate expiry, a full chain, TLS 1.2 or newer, and a redirect from http. Those four decide whether visitors see a padlock or a warning. This guide checks them, explains what each error looks like in the browser, and shows how to automate renewal so it never comes up again.Updated 25 Sept 2026 - Security13 min read
Subresource Integrity for third-party scripts: help and harm
What an integrity hash protects against (the polyfill.io kind of incident), what it cannot (tag managers, chat, anything that updates), how to generate hashes, and when self-hosting is better.Updated 25 Sept 2026 - Security13 min read
The Japanese keyword hack: symptoms, where it hides, how to recover
Japanese titles for your site in Google, a Search Console owner you did not add. How the Japanese keyword hack works, how the checker sees it through the cloaking, and the recovery steps in order.Updated 25 Sept 2026 - Security11 min read
TLS 1.0 and 1.1: turning legacy protocols off without breaking anyone
Browsers dropped TLS 1.0 and 1.1 in 2020 and PCI DSS bans them, yet many servers still accept them. See who still uses them, set a TLS 1.2 minimum on nginx, Apache, Caddy and Cloudflare, and prove it.Updated 25 Sept 2026
Guides tell you how. Your report tells you what.
Run a free report to see which of these guides apply to your site.