Blog
Practical, no-hype articles on the security issues we scan for — what they are, how attackers actually use them, and how to fix them.
HTTP security headers explained: the six that matter
What Content-Security-Policy, HSTS, X-Frame-Options and friends actually protect against — and how to deploy them without breaking your site.
readSubdomain takeover: how a forgotten DNS record gets hijacked
A dangling CNAME to a deleted cloud resource lets an attacker publish content on your subdomain. How takeovers happen and how to prevent them.
readExposed .git directories: how source code leaks from production
A deploy that copies your repository into the web root can expose its entire history — source, config, credentials. How attackers find and download it.
readHow attackers find your vulnerable WordPress plugins
Most WordPress compromises start with an outdated plugin, not core. How version fingerprinting and user enumeration work, and the hardening that helps.
readCORS misconfiguration: when Allow-Origin becomes a data leak
Wildcard and reflected-origin CORS policies can hand authenticated API responses to any site a victim visits. The risky patterns and the correct configs.
readInfostealer malware: stolen browser sessions that bypass MFA
Infostealers lift saved passwords and session cookies from infected browsers and sell them in bulk. Why MFA alone does not stop them — and what does.
readBehind Cloudflare but still exposed: finding the origin IP
A WAF or CDN only protects traffic that goes through it. Certificate transparency, DNS history and stray records reveal origin servers every day.
readStill serving TLS 1.0 or 1.1? What deprecated protocols cost you
Browsers dropped TLS 1.0 and 1.1 in 2020 and PCI DSS forbids them. What old protocol versions expose, how to check yours, and how to retire them safely.
readWondering how your own site scores on these checks? Cyber Report runs the same external, non-intrusive probes against your domain and hands you a prioritised report.
run a scan