Most incidents on business websites do not come from sophisticated attacks but from small things nobody was checking: an outdated plugin, a subdomain pointing at a cancelled service, a domain that expires because the card on the auto-renewal ran out, a DMARC record that was never set up.
These guides show how to check each of those pieces and what the result means. The tools in this section only read public information: you do not have to grant access to anything to use them.
Articles10
Critical PHP and Node.js vulnerabilities: what happened and what to do
On October 21, PHP and Node.js shipped fixes for serious flaws that allow code to run on the server. What they mean in plain language, which versions fix them and what to do this week.
Why are forgotten subdomains a security risk?
How certificate transparency puts every subdomain you have used on public display, what a subdomain takeover is, and how to build an inventory so you can clean up what you no longer need.
What to do if Google flags your site as dangerous
Why Chrome's red screen appears over a website, what is usually behind it, how to clean the site properly and how to ask Google to lift the warning.
How to create strong passwords and actually manage them
Why length beats symbols, what a password manager does, which kind of two-step verification to choose and how to bring order to a team's passwords.
How to check if your password was leaked
What a password breach is, why a password stolen from one service puts all the others at risk, and how to check one without handing it to anyone.
Why does a DNS change take time to propagate?
Why a DNS change does not show up the same way everywhere, the role the TTL plays, how to prepare a change so the wait is minutes, and why your colleague sees the new site while you still see the old one.
What is a vulnerability, and why does your website need maintenance?
What a software vulnerability is, why small websites are exposed too, what happens between the day a flaw is published and the day someone exploits it, and what keeping a site up to date actually involves.
What happens when a domain expires?
What happens from the day a domain lapses until someone else can buy it, what stops working first, and how to make sure it never happens to you without warning.
HTTP security headers: which ones does your website need?
What HSTS, CSP, X-Frame-Options and the other security headers are, which attack each one stops, and in what order to switch them on without breaking anything.
What are SPF, DKIM and DMARC, and why do your emails land in spam?
The three DNS records that decide whether a mail server trusts your messages, how they fit together, and the configuration mistakes that send perfectly legitimate email to spam.
Check it on your site
Free tools, no sign-up, that run the checks these articles talk about.
- Security headers checkerHSTS, CSP, X-Frame-Options and friends: which ones you have, which are missing and what each protects.
- SPF, DKIM and DMARC checkerThe records that decide whether your email lands in the inbox or in spam, read and explained.
- Domain expiration checkerExpiry date, registrar, status and name servers of any domain, straight from RDAP.
- Safe Browsing checkerQuery Google’s Safe Browsing list: malware, phishing and unwanted software.
- Subdomain finderThe subdomains that appear in public TLS certificates, including the ones nobody remembers.
- Pwned password checkerCheck whether a password appears in known breaches without it ever leaving your browser.
Shall we talk about your project?
Send it in writing and we come back, within one business day, with a first read on scope.
We reply within one business dayBogotá · UTC−5