Plain, current guidance on the security posture anyone can check from the outside — and how to keep it from silently breaking.
SPF is simple — until it quietly outgrows the 10-DNS-lookup cap and fails silently. How it works and how to stay under the limit.
Published October 14, 2026The verified logo in the inbox — and why you can't switch it on without DMARC at enforcement.
Published October 12, 2026An RFP says "must be Section 508 compliant." Who it binds, the WCAG standard behind it, and how to prove it with a VPAT.
Published October 9, 2026The small file that tells researchers how to report a bug — before they post it publicly. Format, required fields, and the Expires gotcha.
Published October 7, 2026A hijacked third-party script can run attacker code on every visitor. SRI blocks it in one attribute — here's how, and its limits.
Published October 5, 2026Enable 1.3, keep a hardened 1.2, kill 1.0/1.1. What changed, whether 1.2 is still safe, and the config to run.
Published October 2, 2026It tells the world which certificate authorities may issue certs for your domain. What it does, the gotcha that breaks renewals, and how to add it.
Published September 30, 2026Most alt text is written wrong. The one question that gets it right, the five image types, and when empty alt is correct.
Published September 28, 2026A forgotten subdomain pointing at a dead service is a loaded gun. How the attack works and the decommission order that stops it.
Published September 25, 2026Your HTTPS site's padlock is broken or a widget vanished. Find every insecure asset and fix it for good.
Published September 23, 2026GDPR isn't just cookie banners — Article 32 expects real, checkable security. The technical baseline it wants.
Published September 21, 2026What it protects against, why most domains skip it, the one risk that can take your domain offline, and when it's a one-click yes.
Published September 18, 2026CSP is the header most likely to break your site if you enforce it cold. The report-only-first way to ship it.
Published September 16, 2026The accessibility report buyers ask for: VPAT vs ACR, the four editions, who needs one, and how to fill it out honestly.
Published September 14, 2026What an audit really involves, the automated-vs-manual split, real costs, and what you can do yourself first.
Published September 11, 2026Enforceable since June 2025 — and it covers you even from outside the EU if you sell to EU consumers.
Published September 9, 2026~23% of 2025 web accessibility suits hit sites that had a widget installed. Why they fail, and what to do.
Published September 8, 2026Who's really getting sued, the standard courts use, and the fixes that actually reduce risk.
Published September 8, 2026The Level AA checks that matter for a normal site, plus the nine new 2.2 criteria in plain terms.
Published September 8, 2026What HIPAA expects of your TLS today, the proposed 2025 change, and how to prove it held.
Published August 24, 2026Non-compliant bulk mail now bounces, not just goes to spam. The SPF/DKIM/DMARC checklist.
Published August 24, 2026The real CA/Browser Forum schedule, and why shorter certs mean more silent failures.
Published August 24, 2026What Requirement 4 really asks of your TLS, and how to keep — and prove — you stay compliant.
Published August 24, 2026Why auto-renewal fails quietly, and the boring habit that prevents the 9pm outage call.
Published August 24, 2026Get the site back up in minutes, then stop it ever happening again.
Published August 24, 2026p=none doesn't protect anything. How to climb to reject without blocking your own mail.
Published August 24, 2026Which Annex A controls this covers, and the dated evidence auditors accept.
Published August 24, 2026Never miss a client's expired cert — watch every client domain from one place.
Published August 24, 2026Copy-paste configs for HSTS, CSP and the rest — and how to keep them from regressing.
Published August 24, 2026The real server-side causes of the browser warning — and the fix for each.
Published August 24, 2026Force HTTPS the right way, roll out max-age safely, and decide on preload.
Published August 24, 2026Find your record, decode every tag, and know what p=none really costs you.
Published August 24, 2026The three layers of external security posture — TLS, headers and DNS — and how to check each.
Published August 24, 2026Four ways to check expiry, from a browser click to hands-off monitoring.
Published August 24, 2026HSTS, CSP and the rest — what each protects against and how to add it.
Published August 24, 2026The three DNS records, in the right order — including the 2026 DMARCbis rewrite.
Published August 24, 2026Why a screenshot isn't enough, and what over-the-period evidence looks like.
Published August 24, 2026Grade your TLS, headers and DNS in seconds — no signup.