Security guides, written to go with the scanners.

Your browser is the most exposed program on your computer. This hub explains the browser's security model, the ways it leaks identity...

Browser fingerprinting combines dozens of small facts about your browser and device into an identifier that survives cookie deletion and...

A secure browser is up to date, enforces the web's security policies, leaks little through WebRTC and fingerprinting, and runs only...

Most browser settings pages are long, but only a handful change your real exposure. The settings worth changing in each major browser,...

Extensions run with more access than any website, and a sold or hijacked extension can read everything you do. What each permission...

WebRTC lets browsers talk to each other directly, and to do that it discovers your network addresses, sometimes bypassing a VPN. The...

Cookies keep you logged in and also follow you across sites. How they work, the difference between first- and third-party cookies, what...

Browsers are patched every few weeks because attackers find exploitable bugs constantly. What a zero-day is, how long you are exposed...

HTTPS-Only mode makes the browser refuse plain HTTP connections unless you explicitly allow them. What an unencrypted connection...

Incognito and private windows delete local history, but they do not hide you from websites, your network or your fingerprint. This guide...

Every website visit starts with a DNS lookup, and by default it is sent in plain text. DNS over HTTPS and DNS over TLS, what they hide,...

Chrome, Firefox, Safari and Edge all store passwords, and they are safer than reuse. This guide compares built-in managers with...

A website vulnerability scan checks the parts of a site an attacker can reach without logging in: Transport security, HTTP headers,...

A vulnerability scan checks a system against a list of known weaknesses and reports what matches. The types of scan, the difference...

Passive scanning observes normal responses; active scanning sends crafted requests to trigger flaws. The boundary, why it matters...

Security headers are instructions a server sends the browser to switch on protections: Framing, MIME sniffing, referrer leakage, script...

A Content Security Policy tells the browser which scripts, styles and resources a page may load, which defeats most cross-site...

HTTP Strict Transport Security tells the browser to never load a site over plain HTTP again. The header, max-age and includeSubDomains,...

TLS is the protocol behind the padlock. What a certificate proves, how the handshake works, why TLS 1.0 and 1.1 are retired, what a...

A certificate warning means the browser could not prove it is talking to the right server. Each error, what causes it on the server...

The OWASP Top 10 is the most cited list of web application risks. Each category with a concrete example, which ones a scanner can detect...

XSS lets an attacker run their own script in your users' browsers. The three types, what an attacker does with it and the layered...

SQL injection turns user input into database commands. The mechanism with examples, why it is still common, why external scanners rarely...

A page that ships an old library ships its known vulnerabilities. How Retire.js-style detection works, the most common vulnerable...

When a page loads a script from a CDN, it trusts that CDN completely. Subresource Integrity pins the script to a hash so a tampered file...

A session cookie without the right flags can be stolen over HTTP, read by injected script or sent in a forged cross-site request. Each...

Mixed content is an HTTPS page that pulls in scripts, images or forms over plain HTTP. Active versus passive mixed content, what...

Without SPF, DKIM and DMARC anyone can send email that appears to come from your domain. What each record does, how to write them, how...

Many breaches start with a file that should never have been public: A .git folder, a .env with database credentials, a backup archive or...

Clickjacking loads your site invisibly inside an attacker's page and tricks users into clicking buttons they cannot see. The attack,...

WordPress runs a large share of the web and is attacked accordingly. What an external scan reveals about a WordPress site, from version...

Every public vulnerability gets a CVE identifier and usually a CVSS score. How the numbering works, what the score measures and does...

The best-known scanners are free and open source, and each answers a different question. What Nuclei, OWASP ZAP, OpenVAS, testssl.sh,...

A scan report is a list of findings with severities, and the hard part is deciding what matters. How severities are assigned, how to...

A file scanner looks for known malware by signature, for suspicious structure such as macros and embedded scripts, and for behaviour...

A scanner decides whether a file is malicious by matching known signatures, analysing structure, emulating behaviour and consulting...

Signatures catch what has been seen before; heuristics catch what looks wrong; behavioural analysis catches what acts wrong. Each...

A hash is a fixed-length fingerprint of a file's bytes. How hashing works, why MD5 and SHA-1 are no longer trusted for security, how...

EICAR is a harmless 68-byte string every antivirus is required to detect. What it is, how to create it, what a detection should look...

PDFs can carry JavaScript, launch actions, embedded files and exploits for the reader itself. The structures attackers use, the signals...

Word and Excel macros remain a leading malware delivery method because they run with your privileges. How macro droppers work, the newer...

invoice.pdf.exe, a screensaver with a folder icon, a shortcut that runs PowerShell: Attackers rely on the file looking harmless. The...

Archives hide malware from casual inspection, can be password-protected to defeat scanners and can expand to terabytes to crash them....

ClamAV is the open-source engine behind mail gateways, file servers and many online scanners. Its signature databases, what it detects...

You have a file and you are not sure. This guide gives an order of checks: Where it came from, its real type, its hash, a scan, and the...

Browsers, operating systems and online scanners each check downloads differently. What happens between clicking a link and opening the...

The words are used interchangeably but they describe different behaviour. This guide defines each type by how it spreads and what it...

Privacy online is mostly about limiting what can be linked back to you: Trackers, leaked addresses, reused passwords and the phishing...

Tracking is the business of linking your visits across sites into a profile. Each technique from third-party cookies to fingerprinting...

A content blocker matches every request against filter lists and stops the ones that serve ads or trackers. Filter lists, cosmetic...

Deleting cookies when you close a tab breaks the long-lived identifiers trackers depend on while keeping the sites you choose logged in....

All three route your traffic through another machine, and they protect very different things. This guide compares them on encryption,...

Your IP address is sent to every server you contact. What it reveals about location and provider, what it does not, how it is combined...

Most account takeovers use a password that leaked somewhere else. How passwords are stored and cracked, why length beats complexity, how...

A second factor stops most password-based takeovers, but the methods differ enormously in strength. This guide ranks SMS codes,...

Phishing succeeds by looking legitimate at a glance. This guide teaches the checks that hold up: Reading a URL from the right end,...

Breach notifications are routine now, and the response is not obvious. This guide gives a prioritised checklist: Which passwords to...

Data brokers assemble profiles from public records, purchases and tracking, then sell them. Where the data comes from, the opt-out...

Do Not Track was ignored for a decade; Global Privacy Control has legal force in some jurisdictions. Both signals, how to send them,...