Remote Daemon
Web Security, Explained Properly
Deep, practical guides on the exact checks our scanner runs — security headers, email authentication, TLS, cookies and more. No fluff, copy-paste fixes included.
"CORS Misconfiguration Explained: How Cross-Origin Data Theft Actually Happens"
"A deep guide to CORS: how the same-origin policy works, what Access-Control-Allow-Origin really means, why reflecting the Origin header with credentials is a data-breach bug, why wildcard CORS is usually fine for public APIs, and how to configure and test CORS properly."
"Email Security Records Explained: SPF, DKIM and DMARC Without Breaking Delivery"
"A practical, deep guide to email authentication: how SPF, DKIM and DMARC actually work together, why misaligned DNS records send your mail to spam, and how to roll out DMARC from monitoring to enforcement without losing legitimate email."
"Mixed Content Explained: Why One HTTP Script Can Undo Your Entire TLS Setup"
"A deep guide to mixed content: the difference between active and passive mixed content, what browsers block and what they silently upgrade, how one HTTP script compromises an otherwise perfect HTTPS deployment, and every fix — from hardcoded URLs to CSP upgrade-insecure-requests."
"Security Headers Explained: CSP, HSTS, X-Frame-Options and How to Actually Fix Them"
"A deep, practical guide to HTTP security headers: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy — what each one does, how attackers exploit its absence, and copy-paste nginx, Apache and Express fixes."
"Subdomain Takeover: How Dangling DNS Records Become Someone Else's Website"
"A deep guide to subdomain takeover: why deleted S3 buckets, Heroku apps and GitHub Pages sites leave exploitable DNS records behind, how attackers claim and abuse a vulnerable subdomain, which services are vulnerable, and how to detect and prevent it — including scan-backed detection of the dangling CNAMEs."
"TLS Configuration Guide: Protocols, Ciphers, Certificates and the Redirect Everyone Forgets"
"A deep, practical guide to TLS configuration: which protocol versions and cipher suites to enable in 2026, how certificate chains, hostname mismatches and weak RSA keys break security, why the HTTP-to-HTTPS redirect matters as much as the certificate itself, and copy-paste nginx, Apache and Cloudflare fixes."
"Cookie Security Explained: Secure, HttpOnly, SameSite and the __Host- Prefix"
"A deep guide to cookie security flags: what Secure, HttpOnly and SameSite actually defend against, how Domain scoping leaks cookies to subdomains, why the __Host- prefix makes browsers enforce your intent, and copy-paste fixes for nginx, Express, PHP and Django."
"Open Redirects Explained: How a Trusted Domain Becomes a Phishing Weapon"
"A deep guide to open redirects and redirect-chain hygiene: how attacker-controlled redirect parameters abuse your domain's trust, the OAuth token-theft variant, HTTPS-to-HTTP downgrades in chains, and the fix patterns — allowlists, relative-only redirects and confirmation interstitials."
"Rate Limiting Explained: Stopping Brute Force, Stuffing and Abuse at the Door"
"A deep guide to rate limiting: how brute-force and credential-stuffing attacks actually run, why per-IP limits alone fail, how to design limits and responses (429, Retry-After, rate-limit headers), copy-paste nginx/Cloudflare/app-level configs, and how scanners probe for missing limits."
"security.txt Explained: RFC 9116 and the Right Way to Accept Vulnerability Reports"
"A deep guide to security.txt (RFC 9116): what the file is, the required Contact, Expires and Policy fields, where it must live, the mistakes that make it useless (missing expiry, web-form-only contacts, no policy page), and how a good disclosure channel actually operates."
See how your site scores
Every guide on this page maps to a real check in our scanner. Run it free — results in under a minute.
Run a Free Security Scan