Security headers, CSP and HSTS, explained.
You ran a header check, and the report came back with a deduction next to Referrer-Policy. Now you've got two questions stacked on top of each other: what does this header actually control, and if...
Read moreIf a checker just flagged your Content-Security-Policy for 'unsafe-inline' in script-src, you're standing at a decision that looks small but isn't: nonce, hash, or leave it as-is. A CSP nonce is a...
Read moreContent-Security-Policy-Report-Only is the header that lets you test a Content Security Policy against real traffic without actually blocking anything. Send it alongside your normal responses,...
Read moreIf you just ran a security headers scan and saw "X-Content-Type-Options: Missing" staring back at you, you're in the right place. This header has exactly one job and one valid value: nosniff....
Read morePicture your login page loaded inside an invisible iframe, stacked directly on top of a button on someone else's site that says "Claim Your Free Gift." You click what you think is the gift button....
Read moreA few years back, security educator Tanya Janca registered a .dev domain, pointed it at a simple registrar forwarding rule, and got HTTPS errors in front of a live audience the first time she...
Read more
