CSRF: a form submitted from somewhere else
Your visitor is logged in, and another site makes their browser send a request to yours. One token per form stops it.
4 min read
fail2ban: what it stops and what it does not
It reads logs and bans addresses that repeat a pattern. Useful, narrow, and easy to configure into banning your own office.
5 min read
Permissions that are correct, not just working
777 makes the error go away and opens the site to anyone who can write a file. What the numbers mean and what a web site actually needs.
5 min read
Cleaning a compromised site
The order that gets a hacked site clean and keeps it clean - and the step almost everyone skips.
8 min read
Rate-limiting a login page
Password guessing is thousands of attempts an hour. A limit makes it useless, and it costs one block in the server config.
4 min read
SQL injection, in plain terms
The data was read as part of the question. One habit removes the whole class, and escaping is not it.
5 min read
SSH keys instead of passwords
A key ends brute-force attempts entirely. Generate one, install it, test it in a second window, and only then turn passwords off.
5 min read
Two-factor, and where to keep the recovery codes
It stops a stolen password being enough. The setup takes two minutes; the part people get wrong is what happens when the phone is lost.
4 min read
The four things that get WordPress sites hacked
Not obscure exploits. Four ordinary omissions account for almost every compromised site, and each takes minutes to close.
6 min read
Cross-site scripting, in plain terms
Someone else's code running on your page, in your visitor's session. One habit prevents almost all of it.
5 min read