Check explainers

HSTS (HTTP Strict Transport Security)

What the HSTS header does, why missing HSTS is flagged as a security finding, and the exact Strict-Transport-Security header to add on nginx, Apache, and Cloudflare.

Content-Security-Policy (CSP)

What the Content-Security-Policy header does, why it's the highest-impact defense against XSS attacks, and a starter CSP policy you can deploy today.

DMARC (Domain-based Message Authentication)

What a DMARC record does, why p=none leaves your domain spoofable, and the step-by-step path from monitoring to p=reject enforcement without breaking mail flow.

Cookie Consent (GDPR/ePrivacy)

What valid cookie consent looks like under GDPR and ePrivacy, why pre-ticked banners and pre-loaded trackers fail compliance, and how to fix your banner.

SPF (Sender Policy Framework)

What the SPF record does for email authentication, how to publish a correct TXT record for your domain, and the lookup-limit pitfalls that break delivery.

DKIM (DomainKeys Identified Mail)

What DKIM email signing does, how it proves your mail wasn't forged or altered, and how to enable it on Google Workspace, Microsoft 365, and other providers.

X-Frame-Options / frame-ancestors

What clickjacking attacks are, how invisible iframes hijack your users' clicks, and the X-Frame-Options and frame-ancestors headers that stop them.

llms.txt (AI Crawler Guidance)

What the llms.txt file is, how it guides AI crawlers like GPTBot and ClaudeBot to cite your site accurately, and why AI visibility starts with crawler guidance.