Website security guides

Practical write-ups on the issues our scanner finds most often. Each one tells you what the problem is, why it matters, and exactly how to fix it.

• The OWASP Top 10 for small businesses — what actually applies to you

  Ten abstract category names translated into what to do on Monday morning. Four of them you can fix this week without a developer.

• How to fix a missing Content-Security-Policy header

  Write a CSP that actually works, roll it out in report-only mode so you don't break production, and handle inline scripts with a nonce instead of unsafe-inline.

• SPF, DKIM and DMARC: stop anyone spoofing your domain

  All three records, in the right order, with the alignment rule that catches most people out — and why going straight to p=reject black-holes your own invoices.