HTTPS, TLS, and the headers that protect your visitors
Redirects, certificates, CSP, cookies, and CORS done right.
Every guide in this topic
Does your site still answer over plain HTTP?
If http:// still serves your page, any shared network can rewrite it before it loads. How the downgrade works, how to check, and the one redirect to add.
When does your TLS certificate expire, and what happens when it does?
An expired TLS cert turns your site into a full-screen browser warning overnight. How expiry and old TLS versions break trust, and how to stay ahead of it.
What is HSTS, and why does missing it leave a gap on the first visit?
Without HSTS, the very first request to your site can be downgraded to plaintext and rewritten. What the header does, and the one line that closes the gap.
Do you have a Content-Security-Policy, and is it actually doing anything?
A CSP with unsafe-inline is a lock left in the unlocked position. What the directive really permits, how to check, and how to tighten it safely.
The header that stops your site being framed for clickjacking
Without frame protection, your login form can be invisibly overlaid on a hostile page. How clickjacking works, how to check, and the one header that ends it.
Are your session cookies actually protected? (HttpOnly, Secure, SameSite)
A session cookie without HttpOnly is one any XSS can steal. What the three cookie flags do, how to read your Set-Cookie header, and how to set them right.
Is your CORS policy letting any site read your responses?
Access-Control-Allow-Origin set wrong with credentials hands authenticated data to any origin. How the misconfig works, how to check, and how to fix it.
Your page is HTTPS, but is everything on it? Mixed content, explained
An HTTPS page that loads a script over HTTP has a hole the padlock hides. What active and passive mixed content let an attacker do, and how to find it.
Self-signed, wrong hostname, untrusted: when your TLS cert isn't really trusted
An expired cert is one failure mode. A self-signed one, a hostname mismatch, or an incomplete chain breaks trust too, and the browser warning is just as loud.
The small security headers everyone skips: nosniff, Referrer-Policy, Permissions-Policy
X-Content-Type-Options, Referrer-Policy, and Permissions-Policy are three one-line headers most sites miss. What each one stops, and the block that sets them all.
SecurityHeaders.com alternative: headers plus the rest of your surface
SecurityHeaders.com grades headers well and it's free. But headers are one band of your surface. What to use for headers plus TLS, DNS, secrets, and exposed files in one report.
Your TLS cert is valid, but is it leaking hostnames, signed with a weak key, or living too long?
A cert that passes the browser check can still leak internal hostnames in its SAN list, run on an undersized key, or sit valid for years. Three quiet TLS weaknesses, and how to read them from outside.
Your "Sign in with Google" button builds a public URL. What's in it?
OAuth 2.1 deleted the implicit grant for a reason. How response_type=token, an http redirect_uri, and a cross-domain callback hand your login tokens to the wrong place, all readable in the URL your login button builds.
Is your CDN storing one user's logged-in page for the next visitor?
A session cookie and a public-cache header on the same response means your CDN can serve one user's logged-in page to the next. How web cache deception works, and the header combination that gives it away.
Your CDN cached a response with a key in it. Now everyone gets the key.
A response that carries a server-only secret and a Cache-Control: public header gets stored by your CDN and handed to every visitor of that URL. How a secret ends up cached, and the header that gives it away.
Your login form has a padlock. Does the password actually travel encrypted?
A login form whose action points at http://, or a whole page served over plain HTTP, sends every password across the network in cleartext. How the leak survives a padlock, and the one attribute that gives it away.
Your CSP is set. Does it actually stop anything?
A Content-Security-Policy can be present and barely bind: a wildcard script source, a missing base-uri, no object-src. The gaps that let injection through anyway, and how to read them.
COOP, COEP, CORP: the cross-origin headers your app probably skipped
Three cross-origin headers, COOP, COEP, and CORP, wall your app's window off from other tabs. Most apps doing real auth skip all three. What they stop, and how to set them.
There's a crossdomain.xml on your server from 2014. What does it still allow?
A leftover crossdomain.xml or clientaccesspolicy.xml with a domain=* grant still tells some clients any origin can read your data cross-domain. The legacy policy file to delete.
Find it before someone else does.
Paste your domain. The grade and issue count are free, and you'll see in a couple of minutes exactly what's reachable from outside.
External, read-only scan. We only request public URLs - never log in, never send attack traffic.