Protect your website with practical guides to backups, restore tests, malware, firewalls and access controls. Plan recovery before something goes wrong.
Capture the exact browser warning and public hostname before changing certificates. Separate date, identity and trust failures, and check the certificate visitors actually receive.
Read the final response, identify which policy owns a violation and test a scoped candidate before enforcement. Keep security boundaries and working reader journeys together.
An accepted SVG is not automatically safe in every context. Check trusted originals, upload processing, image-versus-document behavior and a faithful raster fallback.
Investigate compressed-response failures without confusing them with broken accents. Compare response bytes, coding declarations, negotiation and cached variants across delivery layers.
Distinguish request-header size failures from large uploads and rate limits. Compare sessions safely, trace cookie growth and repair the writer or delivery limit that actually failed.
Compare a downloaded file with a trusted SHA-256 reference. Choose the exact release, inspect mismatches and distinguish hashes from signatures and safety.
Check photo location data before publication, preserve a private original and inspect what visitors can actually download. Resizing alone is not proof of removal.
Decide whether a public source map belongs in your release. Inspect original contents, deployed copies and real secrets while preserving useful private debugging.
Give researchers a clear reporting route with security.txt, a monitored contact and a maintained policy. Understand scope, expiry and what the file does not authorise.
