Knowledge base
Security & spam
Unsecured pages, spam, and how to close the gaps. Security headers, certificates, spam and phishing, form abuse, and the checks behind every "Not secure" warning.
64 articles
Articles in Security & spam
Admin URLs, hidden pages and security through obscurity
Why renaming the admin address and hiding pages is not protection, what obscurity is good for, and what the real controls are.
4 min read
Continuous security: why one test per year is not enough
Why a yearly security test leaves a website exposed for most of the year, and what continuous security looks like for a small business without a security team.
4 min read
Data breaches: when you must report and to whom
How to decide whether an incident is notifiable, who must be told beyond the regulator, and the order in which to tell them.
4 min read
DDoS attacks on small websites: what actually happens and what helps
What a denial-of-service attack on a small business website looks like from the inside, why it happens, and what the defence consists of.
4 min read
Encrypting data at rest: what it means for your website's database
What encryption at rest protects against, what it does not, and the layers of it that matter for a business application's data.
4 min read
Environment variables and secrets: where they should never be
The places we find API keys and passwords during audits, why each is dangerous, and the one place secrets belong.
4 min read
Form spam is a security signal, not just a nuisance
Why a contact form full of junk tells you something about how your site is built, and what the junk is probing for.
4 min read
GDPR and security: what "appropriate measures" means for a website
How the regulation's security language maps onto concrete technical controls on a website, and how to document that mapping.
4 min read
ISO 27001, SOC 2 and small businesses: what you need and what you can skip
What these certifications are, when a small business genuinely needs one, what they cost in money and attention, and what to do instead until then.
4 min read
Our take: most security plugins add risk instead of removing it
Why a security plugin on a website is more code on the thing being attacked, what it can and cannot do, and where protection actually comes from.
4 min read
Password policies that people actually follow
What current guidance says about passwords, why forced complexity and expiry made things worse, and the policy a small business can enforce without a revolt.
3 min read
Rate limiting for APIs and forms: how we set the limits
How we decide the numbers behind rate limits on forms, logins and APIs, what happens when they are hit, and how we tune them from real traffic.
4 min read
Reading a vulnerability report: severity, likelihood, and what to fix first
How to read a security scan or penetration test report as a business owner, what the severity labels mean, and how to decide the order of fixes.
3 min read
Security checklist for a business website: the 20 items we verify
The twenty security items we verify on every business website before launch and on every monthly check, with what each protects and how to confirm it.
5 min read
Security for e-commerce: PCI DSS in plain terms and what reduces your scope
What the card industry security standard requires of a small shop, how using a hosted checkout reduces the burden, and what still remains yours.
5 min read
Security glossary: 40 terms in one sentence each
The forty security terms a business owner meets in audits, incident reports and client questionnaires, each explained in one plain sentence.
6 min read
Security questionnaires from enterprise clients: how to answer them
How a small business answers a large client's security questionnaire honestly and well, and how to prepare so it stops being a scramble.
4 min read
Security testing before a launch: what we run, in what order
The sequence of security checks we run on a website or application before it goes live, from automated scans in the pipeline to a manual review.
4 min read
Session security: why "stay logged in" needs care
What a session is, how it can be stolen or abused, and the settings that let users stay logged in without leaving the door open.
4 min read
What a penetration test involves and what you get for it
What happens during a penetration test of a website or application, what you receive, and when a small business needs one.
4 min read
What a web application firewall does and when a small business needs one
What a web application firewall filters, what it cannot fix, and why a static site behind a network layer usually already has the part that matters.
3 min read
API keys in the frontend: a published credential, not a secret
A key in a page's JavaScript is public the moment the page loads. How it happens, how to check your site in two minutes, and the fix.
3 min read
Bot traffic: good bots, bad bots and how to tell them apart
A large share of visits to any website are not people. Which bots you want, which you do not, how to tell them apart in your data, and what to do about each.
3 min read
Broken access control: what it is and why it is missed
Changing a number in the address and seeing someone else's order. Why access control fails so often, where it hides, and how it is tested properly.
3 min read
Brute-force attacks on login pages: what happens and what stops them
Every public login page is being tried by scripts right now. How the attacks work, why weak passwords fall fast, and five layers that stop them.
3 min read
Cleaning a hacked website versus rebuilding it
After a compromise the instinct is to clean and carry on. When the entry point cannot be established, a rebuild on a clean stack is the only way to be sure.
3 min read
Content Security Policy: what it is and why most sites do not have one
A Content Security Policy tells the browser where scripts may come from. Why it stops injected code, why most sites skip it, and how to add one safely.
5 min read
Cookies and their security flags: Secure, HttpOnly and SameSite
A cookie is a note the browser sends with every request. Three flags decide whether it can be stolen or misused. What each does and which to set.
3 min read
Cross-site scripting explained with a comment box
Cross-site scripting is when text a visitor submitted runs as code in other browsers. How a comment becomes an attack, and the two defences.
3 min read
Dependency updates: how often, and how to do them safely
Updates close known holes and occasionally break things. The cadence that balances both, and why a year without updates is the real risk.
3 min read
Domain and DNS security: locks, 2FA and registrar choice
Whoever controls your domain controls your website and your email. The eight controls that protect it and the attacks they prevent.
3 min read
Email security for the whole company, not just the website
Phishing is the leading way attackers get in, not the website. The nine measures that protect a company's mailboxes, in order.
4 min read
Email spoofing: what SPF, DKIM and DMARC do for your domain
Three DNS records decide whether your email is trusted or spoofed. What SPF, DKIM and DMARC each do, in plain terms, and the order to set them up.
3 min read
Fake copies of your website: how to detect and take them down
Cloned sites steal customers, credentials and rankings. How clones are made, four ways to spot one, and the takedown route that works.
3 min read
Honeypots, rate limits and Turnstile: anti-spam without annoying humans
Modern spam protection is invisible to people and expensive for bots. How honeypots, rate limits and Turnstile work together, and why we dropped captchas.
3 min read
How to set up DMARC without breaking your own email
DMARC done in one step blocks your own invoices. The staged method: inventory senders, monitor, read reports, fix, then tighten to quarantine and reject.
3 min read
Incident response plan for a small business: one page is enough
When something goes wrong you should not be improvising. One page for a small business: who does what, in what order, rehearsed once a year.
4 min read
Insecure file uploads: why your "upload your CV" form is a risk
Any form that accepts files is a door into your systems. How upload attacks work and the seven controls that close the door.
3 min read
Logging and alerting: knowing that something happened
Most compromises are found months late because nothing was watching. Seven signals worth alerting on, who receives them, and what to skip.
3 min read
Mixed content: why the padlock disappears and how to find the cause
One image loaded over plain HTTP downgrades a whole secure page. How mixed content happens, how to find the file in two minutes, and how to stop it coming back.
3 min read
Outdated plugins: the number one way small business websites get hacked
Most hacked small business sites were not targeted. They ran a plugin with a known hole and a script found them. Why plugins are the weak point, and what to do.
3 min read
OWASP Top 10 explained for business owners
The OWASP Top 10 is the industry list of the most common web security risks. Each category in one plain sentence, with what it means for a business website.
4 min read
Penetration testing versus a vulnerability scan: which one you need
A scan finds known weaknesses automatically. A penetration test has a person trying to break in. Which one your business needs, and when to do both.
3 min read
Phishing that uses your brand: what to do when you find it
Someone is sending email or running a site that looks like yours to steal from your customers. What to do on day one and what makes it rarer.
3 min read
Privacy by design for forms: collect less, keep it shorter
Every form field is data you must protect, explain and delete. What to ask of each field, where submissions go, and how long to keep them.
3 min read
Security for static websites: smaller attack surface, not zero
A static site removes the database, admin panel and plugins. What is left to protect, and the short list that keeps it safe.
3 min read
Security headers explained: the six lines that protect your visitors
Six short lines in your server response tell browsers how to treat your site. What each one does, what happens without it, and which to set first.
3 min read
Should you block AI crawlers? What it costs you in visibility
Blocking AI crawlers feels like protection and works like invisibility. What the bots do, what you give up, and the middle path we chose for our own site.
3 min read
Signs your website has been compromised, and what each one means
A compromised site looks normal to the owner. The eleven signals to check, what each usually indicates, and the order to act in once you find one.
4 min read
SQL injection explained with a login form
One of the oldest web attacks, still found in scans every week. How a login form becomes a way in, why it works, and the one habit that closes it for good.
3 min read
Subdomain takeover: the forgotten DNS record that becomes a risk
A subdomain still pointed at a cancelled service can be claimed by anyone. How the takeover works and the quarterly check that prevents it.
3 min read
Subresource integrity: making sure third-party scripts are what they claim
When a page loads a script from another server, visitors run whatever it sends. Subresource integrity lets the browser refuse anything changed.
3 min read
Supply chain risk: the packages your website is built from
A website is built from hundreds of open-source packages written by strangers. What can go wrong in that chain and the habits that contain it.
3 min read
Two-factor authentication for your website admin: why it is not optional
A password alone protects nothing that matters. Why two-factor belongs on every admin, hosting and domain login, which kind to use, and how to roll it out.
3 min read
What a security scan checks, and what a clean report actually means
A scan tests your site from the outside for known weaknesses. What it checks, what it cannot see, and how to read a report without panic or false comfort.
3 min read
What an SSL certificate does, and what it does not protect
The padlock means the connection is encrypted and the domain is genuine. It does not mean the site is safe or well built. Where protection stops.
3 min read
What is HSTS and why does your website need it?
HSTS tells browsers to only ever load your site over HTTPS. Here is what it does, what can go wrong, and how to switch it on safely.
3 min read
What to do in the first hour after your website is hacked
Contain, preserve, assess, recover, in that order. The first hour after a hack decides whether you learn how they got in, or whether they come back next month.
3 min read
Why attackers target small businesses too
Nobody would hack us, the most common security assumption, is also the most wrong. Attacks are automated, indiscriminate and profitable at small scale.
3 min read
Why we do not use classic captchas anymore
Distorted letters and image grids annoy humans, exclude some, and are solved by bots for pennies. What we use instead.
3 min read
Why your browser says "Not secure" and how to fix it
The warning means visitors are on an unencrypted or partly encrypted page. Four causes we see, how to find yours, and the fix for each.
3 min read
Why your contact form gets spam, and the three layers that stop it
Form spam is bots, and bots are predictable. A honeypot, a rate limit and a silent browser check stop nearly all of it without making humans solve puzzles.
3 min read
Why your emails land in spam: the technical checklist
When legitimate email lands in spam the cause is usually technical. Twelve checks on authentication, domain reputation, sending setup and content, in order.
3 min read
WordPress security in 2026: the checklist we would apply if we had to
We do not build on WordPress, but many businesses run it. The twelve measures that matter most, in order, and the point where a rebuild is the cheaper fix.
4 min read