Website Protection & Privacy articles

Website Protection & Privacy 427 Why your IP gets blocked by the firewall (and how to avoid it) The server firewall counts failed attempts and, after a few, cuts off that address. It is not punishment or...
Website Protection & Privacy 366 How to find your public IP address (and why we ask for it) When support asks for "your IP", we mean the address your connection presents to the internet. That is what the...
Website Protection & Privacy 387 Personal data protection: what applies to your website If your site has a contact form, a newsletter, a client area or a shop, you are processing personal data. This...
Website Protection & Privacy 327 Selling online: PCI, card data and what shared hosting is not Anyone setting up a shop eventually arrives at this question, often because a bank or a corporate customer asked it...
Website Protection & Privacy 373 The cookie notice and consent: what your site collects without you knowing That bar appearing on nearly every site asking you to accept cookies is neither decoration nor a European fashion....
Website Protection & Privacy 347 Blocking an IP address from visiting your site First, make sure this is the right article. This one is about you barring a visitor from your site. If your problem...
Website Protection & Privacy 227 File permissions explained: what 755, 644 and 777 mean The short answer: on an ordinary hosting account, folders should be 755 and files 644. Files holding secrets, such...
Website Protection & Privacy 253 ModSecurity and web application firewalls: what they do, and what to do when one blocks you The short answer: a web application firewall (WAF) reads every request reaching your site and refuses the ones...
Website Protection & Privacy 297 Security headers explained: what they do and how to add them in .htaccess The short answer: security headers are small instructions your site sends the browser with every page (“do not let...
Website Protection & Privacy 250 A website form that is safe and spam-free: honeypot, captcha and validation The short answer: a form is a door that anyone, and any robot, can try. To keep it spam-free, add a trap field (a...
Website Protection & Privacy 230 SQL injection and XSS in plain words: what to ask your developer The short answer: SQL injection and XSS are two of the oldest attacks on websites, and they still work because they...
Website Protection & Privacy 369 A security.txt file: telling researchers how to report a problem The short answer: security.txt is a small text file, in an agreed place on your site, that tells whoever discovers a...
Website Protection & Privacy 353 Files that must never be public: .git folders, .env, backups and database dumps The short answer: everything in the site folder can be requested by anyone who guesses the file name. Git folders,...
Website Protection & Privacy 209 Content Security Policy: a first policy, tried out in report-only mode The short answer: Content Security Policy (CSP) is a header that tells the browser where the site may load scripts,...
Website Protection & Privacy 232 Forgotten subdomains and DNS records that point nowhere: how they get hijacked The short answer: when you stop using a service but forget the DNS record that pointed to it (a CNAME to a shop, a...