Guides

Website security guides

Short, practical explanations with examples you can copy. Each guide links to a free tool so you can check your own site straight away.

• What is X-Frame-Options?

  X-Frame-Options explained: what clickjacking is, DENY vs SAMEORIGIN, why ALLOW-FROM no longer works, and how CSP frame-ancestors replaces it, with snippets for common servers.

• What is HSTS, and should you turn it on?

  HSTS explained in plain English: how Strict-Transport-Security stops SSL stripping, safe max-age values, includeSubDomains, preload pitfalls and how to enable it on popular hosts.

• SPF, DKIM and DMARC explained

  A plain-English guide to SPF, DKIM and DMARC: what each does, how they work together, the records to publish, and a step-by-step path to p=reject without losing real email.

• Security headers explained

  Every security header in plain English, with what to set and why.

Prefer to check first? See all free tools.