Website Protection & Privacy articles

Website Protection & Privacy 488 Why your IP gets blocked by the firewall (and how to avoid it) The server firewall counts failed attempts and, after a few, cuts off that address. It is not punishment or...
Website Protection & Privacy 512 How to find your public IP address (and why we ask for it) When support asks for "your IP", we mean the address your connection presents to the internet. That is what the...
Website Protection & Privacy 462 Personal data protection: what applies to your website If your site has a contact form, a newsletter, a client area or a shop, you are processing personal data. This...
Website Protection & Privacy 388 Selling online: PCI, card data and what shared hosting is not Anyone setting up a shop eventually arrives at this question, often because a bank or a corporate customer asked it...
Website Protection & Privacy 422 The cookie notice and consent: what your site collects without you knowing That bar appearing on nearly every site asking you to accept cookies is neither decoration nor a European fashion....
Website Protection & Privacy 328 Blocking an IP address from visiting your site First, make sure this is the right article. This one is about you barring a visitor from your site. If your problem...
Website Protection & Privacy 260 File permissions explained: what 755, 644 and 777 mean The short answer: on an ordinary hosting account, folders should be 755 and files 644. Files holding secrets, such...
Website Protection & Privacy 288 ModSecurity and web application firewalls: what they do, and what to do when one blocks you The short answer: a web application firewall (WAF) reads every request reaching your site and refuses the ones...
Website Protection & Privacy 286 Security headers explained: what they do and how to add them in .htaccess The short answer: security headers are small instructions your site sends the browser with every page (“do not let...
Website Protection & Privacy 251 A website form that is safe and spam-free: honeypot, captcha and validation The short answer: a form is a door that anyone, and any robot, can try. To keep it spam-free, add a trap field (a...
Website Protection & Privacy 246 SQL injection and XSS in plain words: what to ask your developer The short answer: SQL injection and XSS are two of the oldest attacks on websites, and they still work because they...
Website Protection & Privacy 325 A security.txt file: telling researchers how to report a problem The short answer: security.txt is a small text file, in an agreed place on your site, that tells whoever discovers a...
Website Protection & Privacy 292 Files that must never be public: .git folders, .env, backups and database dumps The short answer: everything in the site folder can be requested by anyone who guesses the file name. Git folders,...
Website Protection & Privacy 202 Content Security Policy: a first policy, tried out in report-only mode The short answer: Content Security Policy (CSP) is a header that tells the browser where the site may load scripts,...
Website Protection & Privacy 252 Forgotten subdomains and DNS records that point nowhere: how they get hijacked The short answer: when you stop using a service but forget the DNS record that pointed to it (a CNAME to a shop, a...