Web Security
Security headers, TLS, HSTS and the passive hardening every public site should have.
HSTS Preload Without Regrets: A Staged Rollout Plan
HSTS preload is easy to submit and slow to undo. A staged rollout plan with max-age steps, a subdomain inventory and the gotchas that break real domains.
Shipping a Strict CSP Without Breaking Your Site
Why allowlist CSPs fail, how a nonce-based strict policy with strict-dynamic works, and a step-by-step Report-Only rollout that keeps production running.