Security
HTTPS, headers, cookies and certificates: the checks that keep visitors and rankings safe.
Guides
- Security17 min read
"This Connection Is Not Private" in Safari: the fix on iPhone, iPad and Mac
"This Connection Is Not Private" is Safari's warning when a site's certificate fails a check: expired, issued for another name, or from an issuer your device does not trust. Here is the fix on iPhone, iPad and Mac, then how a site owner finds which problem it is.Updated 13 Nov 2026 - Security16 min read
PR_END_OF_FILE_ERROR: what it means and how to fix it
PR_END_OF_FILE_ERROR is Firefox's message when the other end closed the connection before the secure handshake finished. Here is the visitor fix in order of likelihood, then how a site owner proves whose side drops it.Updated 12 Nov 2026 - Security13 min read
SSL_ERROR_RX_RECORD_TOO_LONG: why Firefox says it and how to fix it
SSL_ERROR_RX_RECORD_TOO_LONG is Firefox's error when a server answers an HTTPS request in plain HTTP. Here is the visitor fix, the bytes that make Firefox say "record too long", one curl test that proves it, and the fix for nginx, Apache, app servers and Cloudflare.Updated 11 Nov 2026 - Security16 min read
ERR_SSL_VERSION_OR_CIPHER_MISMATCH: what it means and how to fix it
ERR_SSL_VERSION_OR_CIPHER_MISMATCH means the browser and the server share no TLS version or no cipher, so the handshake stops before any page loads. Here is the visitor fix, then how to tell the two server causes apart and fix each.Updated 10 Nov 2026 - Security20 min read
SSL errors, browser by browser: what each message means and how to fix it
Every SSL error in Chrome, Firefox, Safari and Edge mapped to the server state behind it, with the fix for visitors and for site owners, and a lab where we caused each one on purpose.Updated 9 Nov 2026 - Security13 min read
What is an SSL certificate? Inside the file
An SSL certificate is a signed file that binds your domain name to a public key, issued by an authority browsers trust. Here is everything inside it.Updated 27 Oct 2026 - Security13 min read
What is an SSL handshake? Every step, in plain language
The SSL handshake, today a TLS handshake, is the short exchange in which a browser and a server agree on encryption before any page data moves. Here is each step of the TLS 1.3 exchange, what it costs in milliseconds, and where it breaks.Updated 24 Oct 2026 - Security12 min read
"Your connection is not private": what it means and how to fix it
"Your connection is not private" means the browser rejected the site's certificate: it has expired, covers another name, or comes from an issuer the browser does not trust. Here is the visitor fix, then the site-owner fix for each error code.Updated 4 Oct 2026 - Security11 min read
Access-Control-Allow-Origin: what CORS allows and when * is dangerous
Access-Control-Allow-Origin tells browsers which other sites may read a response. What CORS is, when the * wildcard is fine, when it leaks data, and how to write a safe allowlist.Updated 4 Oct 2026 - Security13 min read
Google Safe Browsing: check your site and clear a flag
Google Safe Browsing is the list behind the red "Deceptive site ahead" warning. Check whether your site is listed, find what triggered it, clean it and request a review.Updated 4 Oct 2026 - Security20 min read
HTTP security headers: what each one does and the set that earns an A
HTTP security headers are instructions your server sends with every page that switch off risky browser defaults. This guide explains each one in plain terms, gives the set that earns an A, and shows how to add them on any server.Updated 4 Oct 2026 - Security12 min read
Pharma and casino spam injections: how they hide and how to find them
Why attackers rent your domain for pharma and casino rankings, the six injection shapes and which report finding shows each, where the code lives in WordPress, and a detection routine for one hour.Updated 4 Oct 2026 - Security16 min read
Rate limiting and bots on a small site, without blocking Google
Most traffic on a small site is bots: crawlers, scrapers, login guessers. Layer robots.txt, a CDN, server rate limits and WordPress switches so they stop costing CPU and Google never notices.Updated 4 Oct 2026 - Security13 min read
strict-origin-when-cross-origin: Referrer-Policy and Permissions-Policy
strict-origin-when-cross-origin sends your full URL to your own pages and only your domain to other sites. What leaks without it, how to set Referrer-Policy, and its companion Permissions-Policy.Updated 4 Oct 2026 - Security13 min read
Why are my emails going to spam? A diagnosis in six steps
Why your emails go to spam, and how to find out which reason applies to you: authentication, a tool sending as your domain, reputation, server basics or content. Check them in this order and fix the first one that fails.Updated 4 Oct 2026 - Security22 min read
SSL and TLS: how HTTPS works and the checks that matter
HTTPS is an SSL/TLS certificate, a handshake and a few server settings working together. This guide explains the whole system in plain language, then the checks that keep the padlock on.Updated 2 Oct 2026 - Security13 min read
What is cloaking in SEO? Why hacked sites show Google a different page
Cloaking in SEO means showing search engines different content from what people see. Google treats it as spam, and hacked sites use it to hide injected links from their owners. Here is how it works and how to see what Googlebot sees.Updated 28 Sept 2026 - Security12 min read
Content Security Policy: roll it out without breaking your site
A Content Security Policy tells the browser where your pages may load scripts, styles and frames from. Roll it out from report-only to enforced, with nonces or hashes instead of unsafe-inline.Updated 27 Sept 2026 - Security12 min read
How to check your WordPress version, and what to do when it is out of date
Check your WordPress version in the dashboard, on the server or from outside through the generator tag. What counts as out of date, and a safe routine for updating core, themes, plugins and PHP.Updated 27 Sept 2026 - Security12 min read
HttpOnly cookie, Secure and SameSite: the cookie flags explained
An HttpOnly cookie cannot be read by JavaScript, so an injected script cannot steal it. What HttpOnly, Secure and SameSite each block, which cookies need which, and how to set them.Updated 27 Sept 2026 - Security11 min read
Renew an SSL certificate: automate renewal, then monitor expiry
Public SSL certificates now last 200 days at most and will drop to 47 by 2029, so renewal has to be automatic. How to renew on each stack, why renewal fails silently, and how to monitor expiry.Updated 27 Sept 2026 - Security10 min read
TLS 1.2 vs 1.3: what changed, and turning TLS 1.0 and 1.1 off
TLS 1.3 is faster and simpler than TLS 1.2, and both are safe when configured well; TLS 1.0 and 1.1 are not. The differences, a 1.2-plus-1.3 config for every server, and how to prove the old versions are off.Updated 27 Sept 2026 - Security11 min read
WordPress backup: a plan you have actually test-restored
To back up a WordPress site, copy the database and wp-content off the server on a schedule, keep the copies out of the web root, and prove they work with a restore every quarter.Updated 27 Sept 2026 - Security13 min read
WordPress hacked? Clean it and keep it clean, step by step
WordPress hacked? Contain it, preserve the evidence, find the way in, reinstall clean, verify what Google sees, harden and request a review, with the wp-cli commands for each step.Updated 27 Sept 2026 - Security10 min read
X-Frame-Options, frame-ancestors and nosniff: stop clickjacking
X-Frame-Options and CSP frame-ancestors stop other sites framing your pages for clickjacking; X-Content-Type-Options nosniff stops MIME sniffing. What to send and where to set it.Updated 27 Sept 2026 - Security13 min read
"This site may be hacked": why Google shows it and how to remove it
"This site may be hacked" is a label Google adds under a search result when it believes someone changed the site or added spam pages. It goes away once the site is clean and Google has checked it. Here is how to confirm the cause, clean up and ask for the review.Updated 26 Sept 2026 - Security13 min read
554 5.7.5 permanent error evaluating DMARC policy: what it means and how to fix it
A "554 5.7.5 permanent error evaluating DMARC policy" bounce means the receiving server could not get a usable DMARC result for your domain. What causes it, how to tell the causes apart, and how to fix DMARC and DKIM fail results.Updated 26 Sept 2026 - Security11 min read
Cloudflare error 525 and 526: fix the SSL handshake to your server
Error 525 "SSL handshake failed" means Cloudflare could not set up HTTPS with your origin server; error 526 means the origin's certificate is invalid in Full (strict) mode. Both are fixed on your server, usually in ten minutes.Updated 26 Sept 2026 - Security11 min read
DMARC policy: moving from p=none to quarantine and reject
Your DMARC policy decides what happens to mail that forges your domain. What none, quarantine and reject do, how to fix "DMARC policy not enabled", and a safe path to p=reject.Updated 26 Sept 2026 - Security10 min read
DMARC reports: how to read aggregate (rua) reports and what to act on
A DMARC report is the daily XML summary that Gmail, Outlook, Yahoo and other receivers send you about every server that used your domain. How to receive them, how to read each part, and which rows need action.Updated 26 Sept 2026 - Security12 min read
ERR_SSL_PROTOCOL_ERROR: what it means and how to fix it
ERR_SSL_PROTOCOL_ERROR means the browser and the server could not agree on a secure connection, so the handshake stopped before any page loaded. Here is the quick fix for visitors and the server-side causes for site owners.Updated 26 Sept 2026 - Security9 min read
Gmail, Yahoo and Outlook bulk-sender requirements: the DMARC rule and the rest
Google's DMARC requirement, and the rest of the Gmail, Yahoo and Outlook rules for bulk senders: SPF and DKIM, an aligned DMARC record, one-click unsubscribe and a spam rate under 0.3%. Who counts as a bulk sender and how to check you comply.Updated 26 Sept 2026 - Security10 min read
Google Workspace SPF record, DKIM and DMARC: the complete setup
The Google Workspace SPF record is v=spf1 include:_spf.google.com ~all. How to publish it, turn on Google Workspace DKIM in the Admin console, and set up DMARC, with the exact records and the mistakes that break them.Updated 26 Sept 2026 - Security23 min read
Hacked website? The signs, how to confirm it, and how to recover
A hacked website rarely looks hacked to its owner. Learn the signs, see your site the way Google does, confirm what you find and clean it so the spam does not come back.Updated 26 Sept 2026 - Security12 min read
HTTPS vs HTTP: the difference, and why your site says "Not secure"
HTTPS is HTTP sent through an encrypted TLS connection, so nobody on the network can read or change it; plain HTTP is readable text. Here is what the difference means for visitors and search, and how to fix a "Not secure" label.Updated 26 Sept 2026 - Security11 min read
Let's Encrypt: get a free SSL certificate and keep it renewing
Let's Encrypt is a non-profit certificate authority that issues free SSL certificates, trusted by every browser and renewed automatically. This guide shows how to get one on your host, your own server or WordPress, and when a paid certificate is still worth it.Updated 26 Sept 2026 - Security10 min read
Magecart card skimming on WooCommerce: how skimmers get in and how to find them
Magecart is the name for attacks that inject card-skimming JavaScript into checkout pages. On WooCommerce, skimmers hide in the database, fake plugins and third-party scripts. Here is how they work, how to detect them and what to do.Updated 26 Sept 2026 - Security10 min read
Microsoft 365 SPF record, DKIM and DMARC: set up Office 365 email authentication
The Microsoft 365 SPF record is v=spf1 include:spf.protection.outlook.com -all. How to publish it, set up DKIM for Office 365 with the two selector CNAMEs, and add DMARC, with the exact records and how to verify them.Updated 26 Sept 2026 - Security10 min read
Multiple SPF records and the 10-lookup limit: how to fix SPF PermError
Multiple SPF records on one domain make SPF fail for every message, and so do more than 10 DNS lookups. How to merge two SPF records into one, count your lookups, and bring the count back under 10.Updated 26 Sept 2026 - Security17 min read
Outdated JavaScript libraries: find old jQuery and update it safely
Which jQuery, jQuery UI, Bootstrap, Lodash or Moment.js versions your site runs, which ones have known vulnerabilities, and how to update them safely on WordPress and custom sites.Updated 26 Sept 2026 - Security11 min read
SPF record: syntax, examples and ~all vs -all
An SPF record is the DNS TXT record that lists which servers may send email for your domain. Its syntax term by term, copy-ready examples, and when to end it with ~all or -all.Updated 26 Sept 2026 - Security18 min read
SPF, DKIM and DMARC: set up email authentication in the right order
SPF, DKIM and DMARC are the three DNS records that prove your mail is really yours. What each one does, how they fit together, and the order to set them up in.Updated 26 Sept 2026 - Security10 min read
What is BIMI? Your logo in the inbox, and what it takes
BIMI is the DNS record that lets Gmail, Yahoo and Apple Mail show your logo next to your emails. What it needs, what VMC and CMC certificates are, and how to set it up.Updated 26 Sept 2026 - Security10 min read
What is DKIM? Signatures, selectors and the DKIM record
DKIM signs every email your domain sends so receivers can prove it came from you and was not changed. How the signature works, what a selector is, and how to publish the DKIM record.Updated 26 Sept 2026 - Security12 min read
What is DMARC? How it works, and your first DMARC record
DMARC is the DNS record that tells mail servers what to do with email that pretends to be from your domain, and sends you reports about who uses it. How it works, and the record to publish first.Updated 26 Sept 2026 - Security12 min read
WordPress hacked redirect: why your site sends visitors to spam and how to find it
A WordPress hacked redirect sends visitors to scam, casino or adult sites, often only from Google, only on phones or only once. Here is how to reproduce it, where the redirect code hides and how to remove it for good.Updated 26 Sept 2026 - Security10 min read
Certificate chain errors: why it works in Chrome and fails elsewhere
A missing intermediate certificate hides in desktop browsers and breaks apps, curl, webhooks and crawlers. Read the chain, match the error to its cause and install the full chain on any server.Updated 25 Sept 2026 - Security10 min read
Directory listings and exposed files: .env, .git and backups
An "Index of /" page or a readable .env file hands database passwords and source code to the first scanner that asks. What leaks, how the report probes for it, and the server rules that close it.Updated 25 Sept 2026 - Security11 min read
HSTS: enabling it safely and joining the preload list
Turn on Strict-Transport-Security without locking anyone out, raise max-age in three stages, and decide whether the browser preload list is worth a commitment that is hard to undo.Updated 25 Sept 2026 - Security10 min read
Mixed content: finding and fixing http:// leftovers after HTTPS
Moved to HTTPS and lost the padlock, a stylesheet or a slider? Find every http:// resource the page still loads, fix it at the source in the database and theme, and add a safety net for the rest.Updated 25 Sept 2026 - Security11 min read
security.txt: the contact file for security researchers
A security.txt file tells whoever finds a hole in your site where to report it. The required fields, the Expires trap, a complete sample, and hosting it on WordPress, Next.js and nginx.Updated 25 Sept 2026 - Security10 min read
Server and X-Powered-By headers: why version numbers matter
Apache/2.4.29, PHP/7.2.24, Express. Two response headers hand every scanner your exact software versions. What they reveal, what hiding them does and does not achieve, and the fix for each server.Updated 25 Sept 2026 - Security13 min read
Subresource Integrity for third-party scripts: help and harm
What an integrity hash protects against (the polyfill.io kind of incident), what it cannot (tag managers, chat, anything that updates), how to generate hashes, and when self-hosting is better.Updated 25 Sept 2026 - Security13 min read
The Japanese keyword hack: symptoms, where it hides, how to recover
Japanese titles for your site in Google, a Search Console owner you did not add. How the Japanese keyword hack works, how the checker sees it through the cloaking, and the recovery steps in order.Updated 25 Sept 2026
Check all 48 at once
The Security headers checker runs every check on this page against your site.