Articles & Guides
Useful resources for web developers and system administrators
SSL/TLS
Self-Signed Certificates: When to Use and Avoid Warnings
Self-signed SSL certificates: when they're appropriate, how to create them with openssl, trust them system-wide, and when to use Let's Encrypt or internal PKI instead.
SSL/TLS
Mixed Content: How to Find and Fix HTTP on HTTPS Sites
Mixed content blocks scripts, styles and iframes on HTTPS pages. Active vs passive, finding every http URL in code and database, CSP reports, regression control.
SSL/TLS
SSL Handshake Failed: What Causes It and How to Fix It
Client and server could not agree on the TLS version, cipher, SNI or certificate. Find the failing step with openssl and curl, then fix that step.
SSL/TLS
Expired SSL Certificate: How to Fix NET::ERR_CERT_DATE_INVALID
Renewing is rarely where the time goes: the certificate is often already renewed and the server still serves the old one. Find which failure you actually have.
Security
SQL Injection Prevention: Prepared Statements and ORM
SQL injection types, prepared statements, PDO, ORM safety, least privilege DB users, WAF. Examples in PHP, Node.js, Python.
Security
WAF (Web Application Firewall): A Practical Guide
Web Application Firewall basics: mod_security, cloud WAFs (Cloudflare, AWS), OWASP CRS, when you need one, and avoiding false positives.
Security
Subresource Integrity (SRI): Protecting CDN Scripts
Subresource Integrity (SRI) — integrity attribute for <script> and <link>. CDN compromise protection, hash generation, CSP require-sri-for.
Security
API Rate Limiting: Token Bucket, 429, Retry-After
API rate limiting: token bucket vs sliding window, HTTP 429, Retry-After. Implementation on Redis, nginx, Express, NestJS.
Security
HTTP to HTTPS Migration: Redirects, Mixed Content, HSTS
HTTP to HTTPS migration guide: certificate, 301 redirect, fixing mixed content, HSTS, canonical URLs, SEO without traffic loss.
Security
Prevent XSS Attacks: Escaping, CSP and Trusted Types
XSS types — stored, reflected, DOM-based — and how to stop them with context-aware escaping, CSP, Trusted Types, and HttpOnly cookies.