Security Announcements
News from Security Announcements
Hotlink Protection: Worth Enabling, Easy to Overdo
Other sites displaying your images from your server costs you bandwidth and gives away your product photography. Blocking it is a checkbox, and breaking your own Google Images traffic is just as easy.
Website Security: The Measures That Actually Matter
Almost nobody attacking your site has chosen you. That is good news, because the defences that stop automated attacks are unglamorous, mostly free, and take an afternoon.
Argon2id Password Hashing in CubeCart: What It Means for Your Store
CubeCart now hashes passwords with Argon2id and migrates existing accounts transparently on login. Why memory-hard hashing matters, and the hosting requirement that could mean you are not getting it.
Is Your WordPress Website Being Used in a DDoS Attack?
WordPress sites are recruited into attacks on other people constantly, and the owner usually notices nothing beyond the site feeling slow. How to check your logs, and the two-minute fix.
SPF, DKIM and DMARC: Getting Your Email Delivered
If your order confirmations land in spam, the cause is usually not your mail server. It is that receiving servers cannot verify you are allowed to send for your domain. Here is how to fix that properly.
Two-Factor Authentication in CubeCart: Why You Should Turn It On Today
Nearly every CubeCart vulnerability fixed this year requires an existing admin session. Two-factor authentication is the control that breaks that chain, and it takes five minutes per account.
The End of Passwords: How Passkeys Actually Work
We first wrote about the end of passwords in 2013 and the candidates all failed. Passkeys are different, because the browser and operating system makers built it in themselves. How they work, and where they still fall short.
How to Secure Your Email Accounts
Your email account can reset almost every other account you own, which makes it the most valuable thing you have online. The checks that matter, including the one almost everyone misses.
What a VPN Is Actually Good For
Most VPN marketing is built on a public Wi-Fi threat that near-universal HTTPS has largely removed. The genuine reasons to run one are less exciting and more useful, starting with a fixed IP address.