--- title: #security description: 31 articles about security — guides and explainers from the WatchFor team. canonical: https://watchfor.io/blog/tag/security --- [All posts](/blog) # #security Articles tagged "security". [All](/blog)[Monitoring](/blog/category/monitoring)[Networking](/blog/category/networking)[Performance](/blog/category/performance)[Security](/blog/category/security)[Reliability](/blog/category/reliability)[Email](/blog/category/email)[DevOps](/blog/category/devops)[Engineering](/blog/category/engineering) [All articles](/blog/all) 31 article s · page 1 of 2 [SecuritySep 01, 2026 ## Why we built our own SSL/TLS grade checker For over a decade, one free tool defined what a 'good' HTTPS setup looks like: the Qualys SSL Labs Server Test and its A+ to F grade. It's brilliant — and showing its age. Here's the short history of the SSL grade, what SSL Labs gets right, where it falls short in 2026, and why we built a faster, more modern grader of our own — including the post-quantum check SSL Labs doesn't have yet.WatchFor Team5 min read](/blog/ssl-grade-checker)[SecuritySep 08, 2026 ## Clickjacking Explained: how an invisible frame steals a click Any website can load yours inside an invisible frame and let someone click your buttons while they think they're clicking something else. One header stops it, and almost nothing can go wrong by adding it.WatchFor Team4 min read](/blog/clickjacking-explained)[SecuritySep 08, 2026 ## Content Security Policy Explained: what CSP actually stops Your site works perfectly and still runs any script it's told to, from anywhere on the internet. CSP is the list that says which ones you actually meant — here's what it prevents, and how to switch it on without breaking your own site.WatchFor Team6 min read](/blog/content-security-policy-explained)[SecuritySep 08, 2026 ## MIME Sniffing and nosniff: when the browser guesses what your file is Browsers don't always believe you about what a file is — they look inside and decide for themselves. That guess is how an uploaded 'image' occasionally ends up running as code. One header ends the guessing.WatchFor Team4 min read](/blog/mime-sniffing-explained)[SecuritySep 08, 2026 ## Permissions-Policy Explained: switching off what your site never uses Your page can ask for the camera, the microphone and the visitor's location — and so can every script and iframe you embed, in your name. Permissions-Policy is how you say which of those your site actually needs.WatchFor Team4 min read](/blog/permissions-policy-explained)[SecuritySep 08, 2026 ## Referrer-Policy Explained: what every outbound link tells strangers Click a link on your site and the browser quietly tells the destination which page you came from — the full URL, including whatever is in it. Sometimes that's a reset token. One header decides how much gets sent.WatchFor Team4 min read](/blog/referrer-policy-explained)[MonitoringAug 23, 2026 ## The agentic supply chain: monitoring MCP servers you host — and the ones you only consume Every MCP server your agents connect to is a live dependency — like an npm package that can change under you at runtime, with no lockfile and no changelog. Here's the monitoring playbook for both sides of that relationship: the servers you run, and the third-party ones you merely trust.WatchFor Team5 min read](/blog/mcp-agentic-supply-chain)[MonitoringAug 23, 2026 ## Who changed the monitor? Why your monitoring needs an audit trail The postmortem question that has no answer in most monitoring setups: who disabled that alert, when, and what did it look like before? Here's why an audit trail on your monitoring config is as important as one on your production data — for debugging, for teams, and for the SOC 2 auditor.WatchFor Team4 min read](/blog/monitoring-audit-trail)[MonitoringJul 30, 2026 ## MCP Server Monitoring: Why "HTTP 200" Means Nothing to an AI Agent MCP servers fail in ways no uptime check can see: the port answers 200 while the handshake breaks, tools vanish, or a tool description is silently rewritten under your agents. Here's how protocol-level MCP monitoring works — and why we built it.WatchFor Team5 min read](/blog/mcp-server-monitoring)[NetworkingJun 26, 2026 ## Advanced SSH: jump hosts, tunnels, and power-user tricks Once you know basic SSH, a whole toolbox opens up: jump hosts to reach private servers, port forwarding, SOCKS proxies, agent forwarding, and a config file that makes it all effortless. The power-user guide.WatchFor Team5 min read](/blog/advanced-ssh-tunnels-jump-hosts)[NetworkingJun 26, 2026 ## FTP vs FTPS vs SFTP: file transfer protocols explained FTP, FTPS, and SFTP all move files — but only two are safe, and they work in completely different ways. Here's how each protocol works, active vs passive mode, the best clients per OS, and which to use.WatchFor Team6 min read](/blog/ftp-ftps-sftp-explained)[NetworkingJun 26, 2026 ## SSH explained: secure remote access, keys, and sessions SSH is how you securely log into and control machines anywhere in the world. Here's what it is, how password vs public-key auth really works, how to run remote commands, and the best clients for every OS.WatchFor Team5 min read](/blog/ssh-explained)[NetworkingJun 16, 2026 ## How to Never Get Caught by an Expired SSL Certificate An expired TLS certificate takes your whole site offline with a scary red warning — and it's 100% preventable. Here's why certificates expire, what it costs, and how to make sure it never catches you.WatchFor Team3 min read](/blog/ssl-certificate-expiry)[SecurityMay 06, 2026 ## How HTTPS Works: the TLS handshake, explained simply That little padlock does a lot of work. Here's what actually happens when you connect over HTTPS — the TLS handshake, certificates and encryption — without the cryptography headache.WatchFor Team3 min read](/blog/how-https-works)[EmailApr 25, 2026 ## Email Authentication Explained: SPF, DKIM & DMARC If your emails land in spam — or scammers send mail pretending to be you — these three records are why. Here's what SPF, DKIM and DMARC do, how they work together, and how to set them up right.WatchFor Team4 min read](/blog/spf-dkim-dmarc-explained)[EmailMar 25, 2026 ## Email Blacklists (RBLs): why you're blocked and how to get off If your email suddenly stops arriving, a blacklist may be the culprit. Here's what RBLs are, how you end up on one, and the step-by-step to get off — and stay off.WatchFor Team3 min read](/blog/email-blacklists-rbl)[SecurityFeb 26, 2026 ## SSL/TLS Handshake Failed: causes and how to fix it When the secure connection can't be agreed, you get a handshake failure — and the page never loads. Here's what goes wrong during the TLS handshake, and how to fix each cause.WatchFor Team3 min read](/blog/ssl-handshake-failed)[SecurityFeb 24, 2026 ## Mixed Content Warnings: what they are and how to fix them Your site is on HTTPS, but the padlock has a warning — or images won't load. That's mixed content: a secure page pulling in insecure resources. Here's how to find and fix it.WatchFor Team3 min read](/blog/mixed-content-warnings)[SecurityDec 28, 2025 ## What is a Firewall? A firewall is the gatekeeper that decides which network traffic gets through and which gets blocked. Here's what firewalls do, the main types, and the gotcha they create for monitoring.WatchFor Team3 min read](/blog/what-is-a-firewall)[SecurityDec 22, 2025 ## TLS 1.2 vs 1.3: what changed (and why it matters) TLS 1.3 made HTTPS both faster and more secure than 1.2 — by doing less, not more. Here's what changed in the handshake, why it matters, and what to make sure your servers support.WatchFor Team3 min read](/blog/tls-1-2-vs-1-3) --- Canonical page: https://watchfor.io/blog/tag/security · Site guide: https://watchfor.io/llms.txt