Security Blog

Practical, vendor-neutral guides on everything we scan — from SSL/TLS and email authentication to DNS, phishing and web hardening. Each article pairs with a free tool so you can check and fix as you read.

SSL/TLS

SSL/TLS · 6 min What SSL/TLS Really Is — and How an A+ to F Grade Is Decided TLS is the encryption behind the padlock. Learn what actually gets graded — protocols, ciphers, certificate, chain and HSTS — and how to reach an A+. SSL/TLS · 4 min TLS 1.0 and 1.1 Are Deprecated — Why You Should Disable Them Old TLS versions still linger on many servers. Here is why they hurt your security and your grade, and how to turn them off safely. SSL/TLS · 4 min CAA Records: Control Which Authorities Can Issue Your Certificates A CAA record restricts who may issue TLS certificates for your domain — a simple, powerful guardrail against mis-issuance.

Security Headers

Security Headers · 7 min HTTP Security Headers Explained: HSTS, CSP, X-Frame-Options and More A handful of response headers stop entire classes of attack. Here is what each one does and the value to set. Security Headers · 6 min Content-Security-Policy: Your Strongest Defence Against XSS CSP is the most effective header you can deploy — and the most misunderstood. Here is a practical path to a working policy.

Web Security

Web Security · 5 min What Is a Web Application Firewall (WAF) and Do You Need One? A WAF filters malicious traffic before it reaches your app. Learn what it catches, what it does not, and when it is worth it. Web Security · 5 min Open Ports: What They Reveal and Which Ones to Close Every open port is a potential door. Here is how to think about port exposure and reduce your attack surface. Web Security · 5 min CVEs and Outdated Software: Why Version Numbers Matter A known vulnerability in an unpatched server is the easiest way in for attackers. Here is how CVEs work and how to stay ahead. Web Security · 5 min Exposed .git, .env and Backup Files: A Silent Data Leak Misconfigured servers often expose source code, credentials and backups to anyone who asks. Here is how to find and stop it. Web Security · 5 min Cookie Security: Secure, HttpOnly and SameSite Explained Three small cookie flags stop session theft and cross-site attacks. Here is what Secure, HttpOnly and SameSite each do and how to set them. Web Security · 4 min Risky HTTP Methods: Why PUT, DELETE and TRACE Should Be Disabled If your server answers methods like PUT, DELETE or TRACE, attackers may upload or remove files or probe for weaknesses. Here is how to lock them down. Web Security · 4 min Subdomain Enumeration: Why Forgotten Subdomains Are a Risk Old staging, dev and admin subdomains are a favourite attacker entry point. Discover what is exposed before someone else does.

DNS

DNS · 4 min What Is DNSSEC and Should You Enable It? DNSSEC signs your DNS so attackers cannot forge it. Here is what it protects against and how to turn it on.

Email Security

Email Security · 5 min SPF Records Explained: Stop Others Spoofing Your Email SPF tells the world which servers may send mail for your domain. Here is how to write one that actually protects you. Email Security · 6 min DMARC: The Policy That Ties SPF and DKIM Together DMARC tells receivers what to do with mail that fails authentication — and reports who is sending as you. Here is how to roll it out. Email Security · 4 min DKIM: How a Cryptographic Signature Proves Your Email Is Real DKIM adds a tamper-proof signature to your mail. Here is what it is and how to set it up correctly. Email Security · 6 min How Email Spoofing Works — and How to Read a Header The "From" address is trivially faked. Learn how spoofing works and how the headers reveal a message's true origin. Email Security · 5 min MTA-STS and TLS-RPT: Enforcing Encrypted Email Delivery SMTP encryption is optional by default and can be stripped. MTA-STS enforces it and TLS-RPT reports failures. Here is how they work together. Email Security · 5 min Email Blacklists (DNSBLs): Why Your Mail Lands in Spam If your sending IP is on a DNS blacklist, your email goes to spam or is rejected outright. Learn how DNSBLs work and how to get delisted.

Phishing

Phishing · 5 min How to Spot a Phishing URL Before You Click Phishing links rely on small visual tricks. Learn the red flags and how to check a link safely. Phishing · 5 min How to Safely Check a Suspicious Link Without Clicking It Never click a link you are unsure about. Here is how to inspect a URL safely and what a scanner checks for you. Phishing · 6 min Phishing Techniques Explained: How Attackers Trick You From typosquatting to homograph domains and open redirects — the tricks behind phishing links and how each one is detected.

Networking

Networking · 4 min What Your IP Address Reveals About You Your public IP exposes more than you might think. Here is what it shows and what it does not. Networking · 4 min WHOIS & RDAP: What Domain Registration Data Reveals Registration records show a domain age, registrar, nameservers and expiry. Learn how to read them and why domain age matters for trust. Networking · 5 min How IP Geolocation Works — and Why It Is Not Your Exact Address IP geolocation maps an address to a city and network, not your doorstep. Here is how it is derived and how accurate it really is. Networking · 5 min Protecting Your IP Privacy: VPNs, Proxies and What They Hide Your IP is visible to every site you visit. Here is what it exposes, when it matters, and how to mask it.