--- title: Security description: 26 Security articles — guides and explainers from the WatchFor team. canonical: https://watchfor.io/blog/category/security --- [All posts](/blog) # Security Guides, how-tos, and updates on Security. [All](/blog)[Monitoring](/blog/category/monitoring)[Networking](/blog/category/networking)[Performance](/blog/category/performance)[Security](/blog/category/security)[Reliability](/blog/category/reliability)[Email](/blog/category/email)[DevOps](/blog/category/devops)[Engineering](/blog/category/engineering)[Guides](/blog/category/guides) [All articles](/blog/all) 26 article s · page 1 of 2 [SecuritySep 01, 2026 ## Why we built our own SSL/TLS grade checker For over a decade, one free tool defined what a 'good' HTTPS setup looks like: the Qualys SSL Labs Server Test and its A+ to F grade. It's brilliant — and showing its age. Here's the short history of the SSL grade, what SSL Labs gets right, where it falls short in 2026, and why we built a faster, more modern grader of our own — including the post-quantum check SSL Labs doesn't have yet.WatchFor Team5 min read](/blog/ssl-grade-checker)[SecurityOct 22, 2026 ## Free PHP Version and Software Exposure Checkers Two new free tools: check the PHP version of any website against php2shell (CVE-2026-109618, CVE-2026-109619), end of life and known CVEs, and see every software version a site reveals, graded A+ to F with the fix.WatchFor Team14 min read](/blog/free-php-version-checker-and-software-exposure-checker)[SecurityOct 20, 2026 ## How to monitor a login page without leaking the password A monitor behind a login needs a password or token. Where it lives, who can read it back and what shows up in results decides whether it leaks.WatchFor Team6 min read](/blog/monitor-login-page-without-leaking-credentials)[SecurityOct 20, 2026 ## Website defacement monitoring: would you notice before your customers do? Your uptime check said 200 OK all weekend while the page served spam links. How website defacement works today, and how to catch it within minutes.WatchFor Team7 min read](/blog/website-defacement-monitoring)[SecurityOct 03, 2026 ## How to detect DNS hijacking before your customers do A hijacked DNS record doesn't take your site down. It sends your users somewhere else, often behind a valid padlock. Four real incidents, the records worth watching, how to lock down your registrar, and how to get an alert the moment an answer stops matching what you expect.WatchFor Team12 min read](/blog/detect-dns-hijacking)[SecurityOct 03, 2026 ## Magecart and injected scripts: how to catch a tampered page A skimmer doesn't break your checkout. It copies every card number typed into it and lets the payment go through, which is why the people who notice are usually a bank, a researcher or a stranger on social media. What happened at British Airways, Ticketmaster and polyfill.io, how the code gets in, what PCI DSS 4.0 now requires, and how to detect a tampered page yourself.WatchFor Team13 min read](/blog/magecart-injected-scripts)[SecurityOct 03, 2026 ## Security headers checklist (and how to keep them from silently disappearing) Seven response headers, the values worth sending, copy-paste config for nginx, Caddy, Cloudflare and Vercel/Next.js, the headers to stop sending, and the boring ways they vanish after you set them: a new location block, a 404 page, a redirect, a CDN migration. Plus how to notice the day one goes missing.WatchFor Team14 min read](/blog/security-headers-checklist)[SecuritySep 08, 2026 ## Clickjacking Explained: how an invisible frame steals a click Any website can load yours inside an invisible frame and let someone click your buttons while they think they're clicking something else. One header stops it, and almost nothing can go wrong by adding it.WatchFor Team4 min read](/blog/clickjacking-explained)[SecuritySep 08, 2026 ## Content Security Policy Explained: what CSP actually stops Your site works perfectly and still runs any script it's told to, from anywhere on the internet. CSP is the list that says which ones you actually meant — here's what it prevents, and how to switch it on without breaking your own site.WatchFor Team6 min read](/blog/content-security-policy-explained)[SecuritySep 08, 2026 ## MIME Sniffing and nosniff: when the browser guesses what your file is Browsers don't always believe you about what a file is — they look inside and decide for themselves. That guess is how an uploaded 'image' occasionally ends up running as code. One header ends the guessing.WatchFor Team4 min read](/blog/mime-sniffing-explained)[SecuritySep 08, 2026 ## Permissions-Policy Explained: switching off what your site never uses Your page can ask for the camera, the microphone and the visitor's location — and so can every script and iframe you embed, in your name. Permissions-Policy is how you say which of those your site actually needs.WatchFor Team4 min read](/blog/permissions-policy-explained)[SecuritySep 08, 2026 ## Referrer-Policy Explained: what every outbound link tells strangers Click a link on your site and the browser quietly tells the destination which page you came from — the full URL, including whatever is in it. Sometimes that's a reset token. One header decides how much gets sent.WatchFor Team4 min read](/blog/referrer-policy-explained)[SecurityMay 06, 2026 ## How HTTPS Works: the TLS handshake, explained simply That little padlock does a lot of work. Here's what actually happens when you connect over HTTPS — the TLS handshake, certificates and encryption — without the cryptography headache.WatchFor Team3 min read](/blog/how-https-works)[SecurityFeb 26, 2026 ## SSL/TLS Handshake Failed: causes and how to fix it When the secure connection can't be agreed, you get a handshake failure — and the page never loads. Here's what goes wrong during the TLS handshake, and how to fix each cause.WatchFor Team3 min read](/blog/ssl-handshake-failed)[SecurityFeb 24, 2026 ## Mixed Content Warnings: what they are and how to fix them Your site is on HTTPS, but the padlock has a warning — or images won't load. That's mixed content: a secure page pulling in insecure resources. Here's how to find and fix it.WatchFor Team3 min read](/blog/mixed-content-warnings)[SecurityDec 28, 2025 ## What is a Firewall? A firewall is the gatekeeper that decides which network traffic gets through and which gets blocked. Here's what firewalls do, the main types, and the gotcha they create for monitoring.WatchFor Team3 min read](/blog/what-is-a-firewall)[SecurityDec 22, 2025 ## TLS 1.2 vs 1.3: what changed (and why it matters) TLS 1.3 made HTTPS both faster and more secure than 1.2 — by doing less, not more. Here's what changed in the handshake, why it matters, and what to make sure your servers support.WatchFor Team3 min read](/blog/tls-1-2-vs-1-3)[SecurityDec 20, 2025 ## HSTS Explained: forcing browsers to always use HTTPS You redirect HTTP to HTTPS — but that first insecure request is still a risk. HSTS closes that gap by telling browsers to never even try HTTP. Here's how it works and how to deploy it safely.WatchFor Team3 min read](/blog/hsts-explained)[SecurityDec 18, 2025 ## What is a DDoS Attack? (and how to defend against one) A DDoS attack drowns your service in traffic from thousands of sources until it buckles. Here's how these attacks work, the main types, and the practical layers of defence.WatchFor Team3 min read](/blog/what-is-a-ddos-attack)[SecurityDec 16, 2025 ## What is a WAF (Web Application Firewall)? A regular firewall guards the network; a WAF guards your application — inspecting web requests and blocking attacks like injection and bots. Here's how it works and what it does (and doesn't) cover.WatchFor Team3 min read](/blog/waf-explained) --- Canonical page: https://watchfor.io/blog/category/security · Site guide: https://watchfor.io/llms.txt