--- title: Security description: 20 Security articles — guides and explainers from the WatchFor team. canonical: https://watchfor.io/blog/category/security --- [All posts](/blog) # Security Guides, how-tos, and updates on Security. [All](/blog)[Monitoring](/blog/category/monitoring)[Networking](/blog/category/networking)[Performance](/blog/category/performance)[Security](/blog/category/security)[Reliability](/blog/category/reliability)[Email](/blog/category/email)[DevOps](/blog/category/devops)[Engineering](/blog/category/engineering) [All articles](/blog/all) 20 article s [SecuritySep 01, 2026 ## Why we built our own SSL/TLS grade checker For over a decade, one free tool defined what a 'good' HTTPS setup looks like: the Qualys SSL Labs Server Test and its A+ to F grade. It's brilliant — and showing its age. Here's the short history of the SSL grade, what SSL Labs gets right, where it falls short in 2026, and why we built a faster, more modern grader of our own — including the post-quantum check SSL Labs doesn't have yet.WatchFor Team5 min read](/blog/ssl-grade-checker)[SecuritySep 08, 2026 ## Clickjacking Explained: how an invisible frame steals a click Any website can load yours inside an invisible frame and let someone click your buttons while they think they're clicking something else. One header stops it, and almost nothing can go wrong by adding it.WatchFor Team4 min read](/blog/clickjacking-explained)[SecuritySep 08, 2026 ## Content Security Policy Explained: what CSP actually stops Your site works perfectly and still runs any script it's told to, from anywhere on the internet. CSP is the list that says which ones you actually meant — here's what it prevents, and how to switch it on without breaking your own site.WatchFor Team6 min read](/blog/content-security-policy-explained)[SecuritySep 08, 2026 ## MIME Sniffing and nosniff: when the browser guesses what your file is Browsers don't always believe you about what a file is — they look inside and decide for themselves. That guess is how an uploaded 'image' occasionally ends up running as code. One header ends the guessing.WatchFor Team4 min read](/blog/mime-sniffing-explained)[SecuritySep 08, 2026 ## Permissions-Policy Explained: switching off what your site never uses Your page can ask for the camera, the microphone and the visitor's location — and so can every script and iframe you embed, in your name. Permissions-Policy is how you say which of those your site actually needs.WatchFor Team4 min read](/blog/permissions-policy-explained)[SecuritySep 08, 2026 ## Referrer-Policy Explained: what every outbound link tells strangers Click a link on your site and the browser quietly tells the destination which page you came from — the full URL, including whatever is in it. Sometimes that's a reset token. One header decides how much gets sent.WatchFor Team4 min read](/blog/referrer-policy-explained)[SecurityMay 06, 2026 ## How HTTPS Works: the TLS handshake, explained simply That little padlock does a lot of work. Here's what actually happens when you connect over HTTPS — the TLS handshake, certificates and encryption — without the cryptography headache.WatchFor Team3 min read](/blog/how-https-works)[SecurityFeb 26, 2026 ## SSL/TLS Handshake Failed: causes and how to fix it When the secure connection can't be agreed, you get a handshake failure — and the page never loads. Here's what goes wrong during the TLS handshake, and how to fix each cause.WatchFor Team3 min read](/blog/ssl-handshake-failed)[SecurityFeb 24, 2026 ## Mixed Content Warnings: what they are and how to fix them Your site is on HTTPS, but the padlock has a warning — or images won't load. That's mixed content: a secure page pulling in insecure resources. Here's how to find and fix it.WatchFor Team3 min read](/blog/mixed-content-warnings)[SecurityDec 28, 2025 ## What is a Firewall? A firewall is the gatekeeper that decides which network traffic gets through and which gets blocked. Here's what firewalls do, the main types, and the gotcha they create for monitoring.WatchFor Team3 min read](/blog/what-is-a-firewall)[SecurityDec 22, 2025 ## TLS 1.2 vs 1.3: what changed (and why it matters) TLS 1.3 made HTTPS both faster and more secure than 1.2 — by doing less, not more. Here's what changed in the handshake, why it matters, and what to make sure your servers support.WatchFor Team3 min read](/blog/tls-1-2-vs-1-3)[SecurityDec 20, 2025 ## HSTS Explained: forcing browsers to always use HTTPS You redirect HTTP to HTTPS — but that first insecure request is still a risk. HSTS closes that gap by telling browsers to never even try HTTP. Here's how it works and how to deploy it safely.WatchFor Team3 min read](/blog/hsts-explained)[SecurityDec 18, 2025 ## What is a DDoS Attack? (and how to defend against one) A DDoS attack drowns your service in traffic from thousands of sources until it buckles. Here's how these attacks work, the main types, and the practical layers of defence.WatchFor Team3 min read](/blog/what-is-a-ddos-attack)[SecurityDec 16, 2025 ## What is a WAF (Web Application Firewall)? A regular firewall guards the network; a WAF guards your application — inspecting web requests and blocking attacks like injection and bots. Here's how it works and what it does (and doesn't) cover.WatchFor Team3 min read](/blog/waf-explained)[SecurityDec 14, 2025 ## Zero Trust Explained The old security model trusted anyone inside the network. Zero Trust throws that out: trust nothing, verify everything, every time. Here's what it means in practice.WatchFor Team3 min read](/blog/zero-trust-explained)[SecurityDec 12, 2025 ## What is a CVE? Vulnerability basics When a security flaw is found in software, it gets a CVE — a global ID so everyone can track and fix it. Here's what CVEs are, how severity is scored, and how to stay on top of them.WatchFor Team3 min read](/blog/what-is-a-cve)[SecurityDec 10, 2025 ## Secrets Management Explained API keys, passwords and tokens are the keys to your kingdom — and they end up hard-coded, committed to git, and shared in chat far too often. Here's how to handle secrets properly.WatchFor Team3 min read](/blog/secrets-management)[SecurityDec 08, 2025 ## What is mTLS (Mutual TLS)? Normal HTTPS proves the server's identity to you. mTLS goes both ways — the client proves itself too. Here's what mutual TLS is, where it's used, and why it's a Zero Trust building block.WatchFor Team3 min read](/blog/mtls-explained)[SecurityDec 06, 2025 ## Domain Spoofing and How to Prevent It Scammers can send email that looks exactly like it's from your domain — phishing your customers and torching your reputation. Here's how domain spoofing works and how to lock it down.WatchFor Team3 min read](/blog/domain-spoofing)[SecurityDec 04, 2025 ## DNSSEC Explained: signing DNS so it can't be faked DNS was built without security — answers can be forged, sending users to fake servers. DNSSEC adds cryptographic signatures so resolvers can verify DNS answers are genuine. Here's how.WatchFor Team3 min read](/blog/dnssec-explained) --- Canonical page: https://watchfor.io/blog/category/security · Site guide: https://watchfor.io/llms.txt