Security
HTTPS, headers, cookies and certificates — the checks that keep visitors and rankings safe.
Guides
- Security13 min read
Backups that actually restore: a small-site backup plan you can test
A backup you have never restored is a hope. Decide what to copy, how often and where, script it with wp-cli and rclone or a plugin, keep it out of the web root, and test the restore once a quarter.Updated 25 Sept 2026 - Security10 min read
Certificate chain errors: why it works in Chrome and fails elsewhere
A missing intermediate certificate hides in desktop browsers and breaks apps, curl, webhooks and crawlers. Read the chain, match the error to its cause and install the full chain on any server.Updated 25 Sept 2026 - Security13 min read
Certificate expiry: automate renewal, then monitor it
Public TLS certificates now last 200 days at most and 47 by 2029, so renewal has to be automatic. How each renewal stack works, the five ways it fails silently, and how to hear about it first.Updated 25 Sept 2026 - Security10 min read
Content-Security-Policy: from report-only to enforced
Roll out a Content-Security-Policy without breaking checkout, analytics or embeds. Inventory sources, run report-only, read the reports, then enforce with nonces or hashes instead of unsafe-inline.Updated 25 Sept 2026 - Security10 min read
Cookie flags explained: Secure, HttpOnly and SameSite
What Secure, HttpOnly and SameSite do, which attack each one stops, which of your cookies need which flag, and how to set them in PHP, Express, nginx, Apache and WordPress.Updated 25 Sept 2026 - Security11 min read
CORS wildcards: when Access-Control-Allow-Origin: * is dangerous
A wildcard CORS header is fine on fonts and public JSON, and a data leak on anything that answers differently per visitor. What CORS controls, the truly dangerous pattern, and safe allowlists.Updated 25 Sept 2026 - Security10 min read
Directory listings and exposed files: .env, .git and backups
An "Index of /" page or a readable .env file hands database passwords and source code to the first scanner that asks. What leaks, how the report probes for it, and the server rules that close it.Updated 25 Sept 2026 - Security12 min read
Flagged by Google Safe Browsing: what it means and how to clear it
A red "Deceptive site ahead" warning stops almost every visitor. See why Google flagged the site, how to find the cause, clean it in the right order and get the warning lifted with a review request.Updated 25 Sept 2026 - Security11 min read
HSTS: enabling it safely and joining the preload list
Turn on Strict-Transport-Security without locking anyone out, raise max-age in three stages, and decide whether the browser preload list is worth a commitment that is hard to undo.Updated 25 Sept 2026 - Security13 min read
Is my website hacked? Cloaking, spam links and Google-only redirects
Google shows pharma or Japanese text for your site, but your browser shows a clean page. See what Googlebot sees, confirm it by hand and clean a hacked WordPress site step by step.Updated 25 Sept 2026 - Security10 min read
Mixed content: finding and fixing http:// leftovers after HTTPS
Moved to HTTPS and lost the padlock, a stylesheet or a slider? Find every http:// resource the page still loads, fix it at the source in the database and theme, and add a safety net for the rest.Updated 25 Sept 2026 - Security12 min read
Outdated CMS versions: reading the generator tag and updating safely
The generator tag tells every scanner which WordPress, Joomla or Drupal version you run. How the report reads it, what out of date means, and a safe update routine for core, themes, plugins and PHP.Updated 25 Sept 2026 - Security11 min read
Permissions-Policy: turning off camera, microphone and friends
One response header switches off browser features your site never uses, for your own scripts and every embedded iframe. The syntax, a sensible default per site type, server configs and a test.Updated 25 Sept 2026 - Security12 min read
Pharma and casino spam injections: how they hide and how to find them
Why attackers rent your domain for pharma and casino rankings, the six injection shapes and which report finding shows each, where the code lives in WordPress, and a detection routine for one hour.Updated 25 Sept 2026 - Security14 min read
Rate limiting and bots on a small site, without blocking Google
Most traffic on a small site is bots: crawlers, scrapers, login guessers. Layer robots.txt, a CDN, server rate limits and WordPress switches so they stop costing CPU and Google never notices.Updated 25 Sept 2026 - Security14 min read
Recovering a hacked WordPress site, step by step
Contain, preserve, find the entry, reinstall clean, verify with a Googlebot comparison, harden, request review. The order that keeps the spam from coming back, with the wp-cli commands for each step.Updated 25 Sept 2026 - Security12 min read
Referrer-Policy: what leaks in the Referer header and how to stop it
The Referer header tells every site, script and image on your page which URL a visitor came from, query string included. Pick the right Referrer-Policy value, set it on any server and verify it.Updated 25 Sept 2026 - Security8 min read
Security headers from zero to A
Six HTTP headers decide whether your site gets an A or an F on any security scanner. This guide explains what each one does in plain terms, gives copy-paste configs for nginx, Apache, Caddy, Cloudflare and WordPress, and shows how to roll out a Content-Security-Policy without breaking the site.Updated 25 Sept 2026 - Security11 min read
security.txt: the contact file for security researchers
A security.txt file tells whoever finds a hole in your site where to report it. The required fields, the Expires trap, a complete sample, and hosting it on WordPress, Next.js and nginx.Updated 25 Sept 2026 - Security10 min read
Server and X-Powered-By headers: why version numbers matter
Apache/2.4.29, PHP/7.2.24, Express. Two response headers hand every scanner your exact software versions. What they reveal, what hiding them does and does not achieve, and the fix for each server.Updated 25 Sept 2026 - Security8 min read
SSL/TLS checks that matter (and the ones that do not)
Certificate expiry, a full chain, TLS 1.2 or newer, and a redirect from http. Those four decide whether visitors see a padlock or a warning. This guide checks them, explains what each error looks like in the browser, and shows how to automate renewal so it never comes up again.Updated 25 Sept 2026 - Security13 min read
Subresource Integrity for third-party scripts: help and harm
What an integrity hash protects against (the polyfill.io kind of incident), what it cannot (tag managers, chat, anything that updates), how to generate hashes, and when self-hosting is better.Updated 25 Sept 2026 - Security13 min read
The Japanese keyword hack: symptoms, where it hides, how to recover
Japanese titles for your site in Google, a Search Console owner you did not add. How the Japanese keyword hack works, how the checker sees it through the cloaking, and the recovery steps in order.Updated 25 Sept 2026 - Security11 min read
TLS 1.0 and 1.1: turning legacy protocols off without breaking anyone
Browsers dropped TLS 1.0 and 1.1 in 2020 and PCI DSS bans them, yet many servers still accept them. See who still uses them, set a TLS 1.2 minimum on nginx, Apache, Caddy and Cloudflare, and prove it.Updated 25 Sept 2026 - Security10 min read
X-Content-Type-Options, X-Frame-Options and frame-ancestors
Two headers that cost one line each. nosniff stops browsers running uploads as scripts; X-Frame-Options and frame-ancestors stop clickjacking. Configs for nginx, Apache, Caddy, WordPress and Next.js.Updated 25 Sept 2026
Check all 43 at once
The Security headers runs every check on this page against your site.