SSL & Security

The handful of specific, checkable things that account for most of what a secure website setup actually needs, in the order to do them.

Yes, every site needs one now, including a small brochure site with no forms — here is what changes if you skip it.

The encryption is identical either way. What paying actually buys is a deeper identity check, a warranty, and features free certificates skip.

A convincing copy of something you already trust, built to make you act before you think. Here is how it works and where to report it.

A handful of response headers close off entire categories of attack for very little effort. Here is what each does and how to add them.

Two reliable ways to stop a specific address reaching your site, and why blocking one IP rarely stops a determined, repeated attacker for long.

Length beats complexity, reuse is the actual weakness, and a password manager quietly solves both problems at once.

Cleaning the site is only step one. The warning stays until you request a review and Google confirms the site is genuinely clear.

The warning always means one of three specific things: no certificate, an expired one, or a mismatch. Here is how to tell which and fix it.

A secure page quietly loading an image, script or stylesheet over plain HTTP. Here is how to find every instance and fix it properly.

A certificate being installed does not redirect anyone by itself. Here is the rule that sends every visitor to the secure version automatically.

Free SSL is already included and issues itself automatically. This covers how to confirm it, speed it up, and add a certificate you bought separately.

A request that well-behaved crawlers respect is very different from actually restricting access. Here is which setting does which job.

Add a login prompt in front of a folder in a few minutes, using either your control panel directly or an .htpasswd file underneath it.

The free certificate on your hosting renews itself. A certificate you bought separately does not, and needs renewing before it expires.

The practical ways to actually check your files for malicious code, and how to read the results without missing what matters.

The two numbers that cover almost every case on a website: 755 for folders, 644 for files, and why 777 always creates a worse problem.

Automated tools quietly try thousands of guesses against your login form. A few layered defences make that approach stop being worthwhile.

The specific, checkable signs of a genuine compromise, and how to tell them apart from an unrelated glitch before you act.

A second, independent check beyond the password, so a leaked or guessed password on its own is no longer enough to get in.

Yes, accounts are kept isolated from each other. In practice, the biggest risk on shared hosting comes from your own setup, not your neighbours.

A header that tells browsers to never even attempt the insecure version of your site again, closing a gap a redirect alone leaves open.

One certificate that covers a domain and every first-level subdomain under it, instead of issuing and managing one for each.

A flood of traffic from many sources at once, aimed at overwhelming a site rather than breaking into it. Here is what it actually looks like.