TLS & Web Security
HTTPS and certificates, security headers, CORS, cookies, common attacks, trust scores and MCP security, with what each protects against and what it doesn’t.
Beginner
3 guidesSSL certificates: validation, chains and common errors
What an SSL/TLS certificate contains, how DV, OV and EV differ, why the chain matters, and how to fix expired, mismatched or incomplete certificates.
How website trust scores work and what they miss
How technical trust scores turn HTTPS, redirect, header and URL signals into a number, how Website Trust Inspector scores a site, and what no score can show.
What is HSTS? Strict-Transport-Security and preload
How the Strict-Transport-Security header forces HTTPS, what it prevents, the first-visit gap, preload list requirements and the risk of preloading too early.
Intermediate
6 guidesSame-origin policy and CORS: how cross-origin reads work
What counts as an origin, what the same-origin policy blocks, how CORS headers and preflight requests relax it, and why CORS is not server-side access control.
Zero trust security: principles and where to start
What zero trust means in practice: verify every request explicitly, grant least privilege and assume breach, plus first steps and what it does not promise.
HTTP security headers: which to send and why
Which HTTP security headers to send, what CSP, HSTS, nosniff, framing, Referrer-Policy, Permissions-Policy and COOP prevent, and which old headers to drop.
Cookie security: Secure, HttpOnly and SameSite explained
What Secure, HttpOnly and SameSite cookie attributes do, how __Host- and __Secure- prefixes and Domain and Path scope work, and safe session cookie settings.
MCP security: tools, prompt injection and least privilege
How MCP connects AI apps to tools and data, where its trust boundaries sit, and how prompt injection, broad permissions and risky tool pairs cause harm.
MCP tool annotations: what the hints mean and their limits
What MCP tool annotations such as readOnlyHint and destructiveHint declare, why clients must treat them as untrusted hints, and how to use them in approvals.
Advanced
3 guidesXSS, CSRF and SSRF: how they work and how to prevent them
How cross-site scripting, cross-site request forgery and server-side request forgery work, and the specific defenses that stop each one in a web application.
Content Security Policy (CSP): directives and rollout
How to write a Content-Security-Policy: the directives that matter, nonces, hashes and strict-dynamic, report-only rollout, and mistakes that weaken a policy.
MCP authorization and why token passthrough is forbidden
How remote MCP servers use OAuth 2.1, why each token must be issued for one specific server, and why forwarding a client's token to another API is banned.
Tools for this topic
Try what these guides describe on your own URLs, domains, code or files.
Sign in to check whether a URL's final page loads over HTTPS and whether any redirect drops it back to plain HTTP.
Sign in to check your homepage's certificate expiry, HTTPS and HTTP-to-HTTPS redirect before launch.
Sign in and enter a URL to see the CORS and cross-origin (COOP, COEP, CORP) headers it returns and what they allow.