Security Articles
Practical guidance on protecting credentials, secrets, and sensitive data.
HTTP Security Headers Explained: A Practical Developer Guide
A handful of response headers tell the browser how to defend the page they came with. Here's what each one actually does.
Published
Content-Security-Policy (CSP) Explained With Examples
CSP is an allow-list for where your page's resources can load from. Here's how the directives fit together.
Published
What Is HSTS? Strict-Transport-Security Explained
HSTS closes a narrow but real window for downgrade attacks. Here's exactly what it enforces and how to configure it.
Published
CORS Explained: Access-Control-Allow-Origin, Credentials and Common Mistakes
CORS is a browser-enforced exception to the same-origin policy. Here's how it works and the one combination that goes wrong constantly.
Published
How to Fix Common Content-Security-Policy Errors
Read the console message, find the directive, then choose the safest fix: move, nonce, hash, or allow a specific host.
Published
How to Secure HTTP Response Headers: A Practical Checklist
The headers worth setting, safe starting values, how to configure them on Apache and Nginx, and which old ones to leave behind.
Published
How to Read Email Headers
A practical, field-by-field guide to reading raw email headers and knowing which lines to trust.
Published
How to Trace an Email Using Its Headers
Follow the Received chain from the first server to your mailbox, and learn what an email trace really shows.
Published
SPF vs DKIM vs DMARC Explained
Three standards, three different identities. Here is what each one checks and how DMARC combines them.
Published
What Is an Authentication-Results Header?
How receiving servers record SPF, DKIM and DMARC outcomes, and how to read the fields.
Published
How to Read Received Headers
Break a Received header into its clauses and follow a message hop by hop.
Published
What Is a Return-Path?
The Return-Path is the bounce address: here is how it differs from From and what it does and does not prove.
Published
What Is a Message-ID?
The unique label every email carries, how threading uses it, and why it is not proof of origin.
Published
How to Detect Email Header Spoofing
Technical indicators of spoofed headers, and why none of them is proof on its own.
Published
How to Investigate Suspicious Emails Using Headers
A calm, step-by-step workflow for reviewing a suspicious message's headers.
Published
What Does SPF PASS Mean?
What an SPF pass proves, what it does not, and how it fits with DKIM and DMARC.
Published
What Does DKIM PASS Mean?
What a verified DKIM signature proves, how to read the tags, and what it cannot tell you.
Published
What Does DMARC PASS Mean?
DMARC ties SPF and DKIM to the visible From domain. Here is how a pass is decided.
Published
What Does a Different Reply-To Address Mean?
Why Reply-To and From sometimes differ, when that is normal, and when to take a closer look.
Published