Learning Center

Web Security Guides

Practical, in-depth articles covering every security check WebAudit runs — written for developers and pentesters.

Content Security Policy (CSP) Complete Guide

Stop XSS attacks at the browser level — learn every CSP directive, nonce-based policies, and real-world examples.

8 min read · Headers

HTTP Strict Transport Security (HSTS) Guide

Force HTTPS permanently, avoid SSL stripping attacks, and get on the browser preload list safely.

6 min read · Headers

Preventing Clickjacking with X-Frame-Options

Understand clickjacking attacks, DENY vs SAMEORIGIN, and when to use CSP frame-ancestors instead.

5 min read · Headers

SPF, DKIM & DMARC: Complete Email Security Guide

Stop domain spoofing and phishing — set up SPF, DKIM selectors, and DMARC policies in the right order.

8 min read · DNS

TLS/SSL Security: What to Check and Why

TLS 1.0/1.1 are broken — learn which versions, cipher suites, and cert configurations to look for.

6 min read · TLS

security.txt: The RFC 9116 Standard Explained

Make it easy for security researchers to report vulnerabilities — set up security.txt in 5 minutes.

5 min read · Disclosure

See how your site scores right now

Run a free scan and get an instant security report covering all the topics above — no login required.

Check your site's security now →