Nearly half of the web's biggest sites send no Content-Security-Policy
One check of each of the 1,000 most visited sites: which security headers they send, how well, and what a small site can take from it.
7 min read
Author
Bhalendu Chaubey
Founder, BCDRPulse
Founder of BCDRPulse. Enterprise backup and data protection since 2007, supporting Fortune 500 companies. Writes guides to keeping a site up, fast and secure, and to proving it.
Articles.
22 articles
Backup restore testing: how to prove a backup works before the day you need it
Four levels of restore test, how often to run each, what to write down, and the failures a test finds before ransomware does.
10 min read
Black Friday is 27 November: a three-week countdown for a shop that cannot go down
The numbers behind Black Friday 2026, what fails first under a shopping spike, and a week-by-week plan from today to Cyber Monday.
11 min read
DNS is the single point of failure nobody monitors: lessons from SkyBell, Marketo, Facebook and Dyn
Four outages, one cause. How DNS fails, from a lapsed renewal to a lost provider, and the six controls that keep your name resolving.
10 min read
How to read a load test report: p95, error rate, throughput, and the line between slow and broken
The four numbers in every load test report, what each one is telling you, and how to turn the report into a decision.
10 min read
Synology NAS ransomware (C3RB3R): patch, close the door, and check what the box was protecting
The fixed DSM builds, a ten-minute exposure check, the recovery steps, and the backup design lesson behind the wave.
10 min read
The 47-day certificate: what shorter TLS lifetimes mean for a small site, and what to do before March 2027
The schedule to 47 days, why browsers and CAs chose it, what breaks for a small site, and a plan that takes an afternoon.
9 min read
How often should uptime monitoring check your site? One minute, five minutes, and what each one misses
The check interval decides how long you are down before you know. The maths, what each interval misses, and how to pick yours.
9 min read
Claude Code extension hacked on Cursor: check these versions before your developer machine is compromised
Tampered builds 2.1.312 and 2.1.313 planted an SSH key. The one-line check, the clean-up and what to rotate.
15 min read
Cyber insurance requirements in 2026: the security and recovery controls businesses should have before they apply
The seven controls insurers ask about, what proves each one, and the claims data behind the questions.
11 min read
DigiCert G5 root migration on 12 November 2026: what website owners need to know
DigiCert's default chain moves to the G5 roots on 12 November. What changes, who must act, and the 2027 deadlines behind it.
10 min read
The eMudhra certificate incident explained: could your website's HTTPS connection be affected?
Eight intermediate CAs with guessable keys, a root removed from every browser, and a walkthrough to check your own chain.
11 min read
Temple's launch-night crash: what a pre-order spike teaches every team
A scheduled crowd, one page that could not grow, and the five things every launch team can take from the night.
10 min read
WordPress security alert, November 2026: the critical core and plugin vulnerabilities every website owner should check
Core 7.1.4, Contact Form 7 6.2.4 and Gravity Forms 3.1.3 each close an unauthenticated flaw. The versions, the conditions and the check.
11 min read
AI agent traffic is changing how websites break: what the 2026 data shows and how to prepare
Why AI agents break sites that handle human traffic fine, and a seven-step plan.
13 min read
Chaos engineering for small teams: how to start testing failure without breaking production
What it is, which tools fit a small team, and a 30-day plan with ten starter experiments.
17 min read
Ransomware now goes after your backups first: how to make recovery survive an attack
Attackers destroy backups before they encrypt. The controls that keep recovery alive.
18 min read
Most DDoS attacks now last under 10 minutes. Here's why that's harder to handle (and what to do)
Why attacks that end in minutes beat human response and five-minute checks, and what to do.
17 min read
How to check your TLS configuration in 2026: protocols, ciphers, certificates, HSTS and the changes that catch sites out
Ten checks, the 2026 changes, and how to read a grade.
13 min read
Load testing vs stress testing vs spike testing vs soak testing: which one do you need?
Four tests, four questions: normal day, breaking point, sudden surge, long haul.
10 min read
SOC 2 disaster recovery evidence: what auditors ask for and how to produce it
The availability criteria, the evidence list, and a drill report that passes.
13 min read
RTO vs RPO: what they mean, how to set them, and how to prove you can meet them
The two numbers behind every recovery plan, and how to measure the real ones.
14 min read