Nearly half of the web's biggest sites send no Content-Security-Policy
One check of each of the 1,000 most visited sites: which security headers they send, how well, and what a small site can take from it.
7 min read
Category
Security & TLS
TLS, certificates, security headers and the other checks that keep a public site trustworthy.
8 articles
The 47-day certificate: what shorter TLS lifetimes mean for a small site, and what to do before March 2027
The schedule to 47 days, why browsers and CAs chose it, what breaks for a small site, and a plan that takes an afternoon.
9 min read
Claude Code extension hacked on Cursor: check these versions before your developer machine is compromised
Tampered builds 2.1.312 and 2.1.313 planted an SSH key. The one-line check, the clean-up and what to rotate.
15 min read
DigiCert G5 root migration on 12 November 2026: what website owners need to know
DigiCert's default chain moves to the G5 roots on 12 November. What changes, who must act, and the 2027 deadlines behind it.
10 min read
The eMudhra certificate incident explained: could your website's HTTPS connection be affected?
Eight intermediate CAs with guessable keys, a root removed from every browser, and a walkthrough to check your own chain.
11 min read
WordPress security alert, November 2026: the critical core and plugin vulnerabilities every website owner should check
Core 7.1.4, Contact Form 7 6.2.4 and Gravity Forms 3.1.3 each close an unauthenticated flaw. The versions, the conditions and the check.
11 min read
Most DDoS attacks now last under 10 minutes. Here's why that's harder to handle (and what to do)
Why attacks that end in minutes beat human response and five-minute checks, and what to do.
17 min read
How to check your TLS configuration in 2026: protocols, ciphers, certificates, HSTS and the changes that catch sites out
Ten checks, the 2026 changes, and how to read a grade.
13 min read