Security Best Practices
HTTP security headers: the essential list
Security headers are instructions your server sends with every response, telling the browser how to protect your users. They cost almost nothing to add, yet many sites are missing several of them. This guide covers the headers every web application ...
A practical guide to Content Security Policy (CSP)
Content Security Policy (CSP) is the strongest browser-side defence against cross-site scripting. It tells the browser which sources of scripts, styles, images and frames are allowed, and blocks everything else. A weak CSP, for example one that ...
HTTPS done right: HSTS and TLS configuration
Having an HTTPS certificate is only the start. Old TLS versions, weak cipher suites, expiring certificates and a missing HSTS header can all leave traffic open to interception. How it happens Servers often keep TLS 1.0 and 1.1 enabled for ...
Secure cookie flags: Secure, HttpOnly and SameSite
Session cookies are the keys to your users' accounts. A few attributes on each cookie decide whether it can be stolen by scripts, sent over plain HTTP, or attached to requests from other websites. How it happens Frameworks do not always set safe ...
Session management best practices
Once a user logs in, the session is what keeps them logged in. If session tokens are predictable, never expire or are exposed in URLs, an attacker can take over accounts without ever knowing a password. How it happens Common weaknesses include short ...
Login and password security best practices
Login pages attract constant automated attacks: credential stuffing, brute force and username enumeration. A few design decisions make the difference between a login page that holds and one that leaks. How it happens Weak password rules, no rate ...
Keeping third-party components up to date
Most applications are built largely from third-party code: frameworks, JavaScript libraries, web servers and databases. When one of them has a known vulnerability (a CVE), attackers can often exploit it with public tools, without finding anything new ...
WordPress security best practices
WordPress powers a large share of the web, which makes it a constant target. Most WordPress compromises come from outdated plugins and themes, exposed login and XML-RPC endpoints, and information leaks. How it happens Plugins are added and rarely ...
Preventing information disclosure: .git, .env, backups and source maps
Many breaches start with information the site gave away by accident: a .git folder, an .env file with database passwords, a backup archive, a JavaScript source map, or a detailed error page. How it happens Deployment processes copy more than they ...
API keys and secrets in front-end code
Anything you send to the browser is public. Yet API keys, cloud tokens and private credentials regularly end up in JavaScript bundles, HTML comments and configuration endpoints. How it happens A developer adds a key to get a feature working, or a ...
Protecting against clickjacking
Clickjacking hides your real page inside an invisible frame on an attacker's site. The user thinks they are clicking the attacker's content, but they are actually clicking buttons on your page, such as "delete account" or "confirm payment". How it ...
Rate limiting and denial-of-service protection
Without rate limits, attackers can try thousands of passwords, scrape all your data or overload expensive endpoints. Rate limiting and resource limits are basic protections that many APIs still lack. How it happens An endpoint accepts unlimited ...
Subresource Integrity and third-party scripts
Most websites load scripts from CDNs and third-party services. If one of those sources is compromised, the attacker's code runs on your site with full access to your users' data. Subresource Integrity (SRI) is a simple defence. How it happens Your ...
Securing OAuth, OpenID Connect and SAML single sign-on
Single sign-on (OAuth 2.0, OpenID Connect and SAML) is convenient for users, but the protocols are detailed and easy to implement slightly wrong. A small mistake can let an attacker log in as someone else. How it happens Typical flaws include a ...
Turn off debug mode and verbose errors in production
Debug mode is useful while developing and dangerous in production. Debug pages, stack traces and detailed error messages show attackers your code paths, library versions, file locations and sometimes credentials. How it happens A framework's debug ...
Locking down admin panels and management endpoints
Admin panels, framework management endpoints (such as Spring Boot Actuator), cloud storage buckets and unused HTTP methods are often exposed to the internet by mistake. They give attackers a shortcut to powerful functions. How it happens A CMS admin ...
Securing AI and LLM features: prompt injection and beyond
Many applications now include AI chatbots, assistants and summarisers built on large language models (LLMs). These features bring new risks: prompt injection, data exfiltration and abuse that traditional security testing does not cover. How it ...
Common web application attacks and quick steps to prevent them
The attacks that make the news are usually the largest or most sophisticated ones, but web applications of every size are attacked every day. The good news is that a small number of well-known attack types account for most incidents, and each has ...
Network vulnerability scanning explained
Vulnerability scanning is an automated inspection of computers, networks and applications to identify security weaknesses that an attacker could exploit. What a network vulnerability scan does A network vulnerability scanner checks systems and ...
How to improve web application security
Security is an element of web application development that is often overlooked. Business websites and applications need to be accessible and easy to use, and that openness brings a wide range of security challenges. These are practical ways to ...
Android reverse engineering basics
This article introduces reverse engineering of Android apps: what it is, the tools used, and how to make your own app harder to reverse engineer. What is reverse engineering? Reverse engineering means taking something apart to understand how it ...
How to use Burp Suite with an Android device
This guide shows how to route an Android device's traffic through Burp Suite, so you can see the requests an app sends. Use it only with apps and systems you own or are authorised to test. Part 1: point the device at Burp Suite On the device, open ...
How to detect a RAT (remote access trojan) on Windows
A remote access trojan (RAT), sometimes called a remote administration tool, is malware that gives an attacker remote control of a computer. This article shows one manual way to look for a RAT on Windows. Antivirus software detects many RATs, but not ...
How to use Drozer for Android security testing
Drozer is a security testing framework for Android. It lets you interact with an app's components, such as activities, services and content providers, to find weaknesses. This guide covers the basic setup and commands. Only test apps you own or are ...
How to set up and use Mobile Security Framework (MobSF)
Mobile Security Framework (MobSF) is an open-source tool for analysing the security of mobile apps. This guide shows how to install it and read the results of an APK analysis. Only analyse apps you own or are authorised to test. Note: the screenshots ...