In-depth reference guides on the security headers, DNS and email records, and vulnerabilities behind every EzyAudit AI scan. Written for site owners and developers who want to understand exactly what a scan finds and how to fix it.
The HTTP response headers that tell browsers how to protect your visitors. Deep-dive explainers and step-by-step fixes for every header EzyAudit AI checks.
A missing CSP header leaves the browser with no allowlist to enforce. Here is how to add a Content-Security-Policy header on Apache,…
From a missing header to a browser blocking your site, HSTS errors have clear causes and fixes. Here is how to resolve…
Security headers are server instructions that tell the browser how to behave more safely. Here are the key website security headers, what…
X-Frame-Options controls whether other sites can embed your pages in a frame, stopping clickjacking attacks. Here is what it does and how…
A Content Security Policy tells the browser which scripts, styles and resources it may load, making it the single strongest defence against…
HSTS forces browsers to connect only over HTTPS, closing the gap that SSL stripping attacks exploit. Here is how the Strict-Transport-Security header…
Permissions-Policy lets you control which browser features, such as camera, microphone and location, your pages and embedded content can use. Here is…
Referrer-Policy controls how much of your URLs the browser reveals to other sites, preventing sensitive addresses from leaking. Here is how to…
SPF, DKIM, DMARC and the wider DNS records that stop attackers spoofing your domain and keep your email out of the spam folder.
From duplicate records to the ten-lookup limit, most SPF record problems are common and fixable. Here is how to fix an SPF…
A DMARC p=none policy reports spoofed email but stops none of it. Here is how to move safely from p=none to an…
SPF vs DKIM vs DMARC are not competing options but three layers that work together. Here is what each does, how they…
DKIM adds a cryptographic signature to your email that proves it is genuine and unaltered. Here is what DKIM is, how it…
DMARC stops criminals sending email that appears to come from your domain. Here is what DMARC is, how it works with SPF…
DNSSEC adds cryptographic signatures to DNS so forged answers are rejected, stopping hijacking and cache poisoning. Here is how DNSSEC works and…
MTA-STS forces inbound email to your domain to use encrypted, authenticated connections, closing the silent TLS downgrade gap. Here is how MTA-STS…
SPF is a DNS record listing the servers allowed to send email for your domain. Here is what SPF is, how the…
TLS-RPT asks sending servers to report how securely they delivered your email, exposing encryption failures. Here is what TLS-RPT is and how…
Plain-English guides to the vulnerabilities and industry standards behind every finding in your EzyAudit AI security report.
A CISA KEV vulnerability is one attackers are actively exploiting in the wild. Here is what the CISA KEV catalogue is, why…
A CVE is a unique public identifier for a known security vulnerability, giving everyone a common language for tracking flaws. Here is…
An exposed .env file lets anyone download your database passwords, API keys and secret keys. Here is why it is so dangerous…
CSRF tricks a logged-in user browser into making unwanted authenticated requests. Here is what CSRF is, how it works, and how tokens…
CVSS scores a vulnerability severity from zero to ten so you can decide what to fix first. Here is what CVSS is,…
Directory traversal lets attackers reach files outside the web root, such as config files with passwords. Here is how path traversal works…
SQL injection lets attackers manipulate the database queries behind your site to steal or destroy data. Here is how SQL injection works…
XML-RPC is a legacy WordPress remote interface often abused for brute-force amplification and pingback DDoS. Here is what XML-RPC is and how…
XSS, or cross-site scripting, lets attackers run malicious JavaScript in your visitors browsers. Here is what XSS is, the main types, and…