In-depth reference guides on the security headers, DNS and email records, and vulnerabilities behind every EzyAudit AI scan. Written for site owners and developers who want to understand exactly what a scan finds and how to fix it.
Step-by-step walkthroughs for scanning, auditing and fixing the most common website security issues - from first scan to final fix.
A website security audit no longer needs a consultant. Here is how to audit your site yourself in 2026, step by step,…
Broken padlock after installing SSL? That is mixed content. Here is how to find and fix it step by step in WordPress,…
A step-by-step walkthrough for scanning your WordPress site for malware, vulnerable plugins and misconfigurations in 2026.
The 12 tell-tale signs your website has been hacked, from mystery redirects to rogue admin accounts, plus what to do next.
The HTTP response headers that tell browsers how to protect your visitors. Deep-dive explainers and step-by-step fixes for every header EzyAudit AI checks.
How to add a Content-Security-Policy header the right way, with copy-paste examples for Apache, Nginx and WordPress.
From a missing header to a browser locking users out: the common HSTS errors, and how to resolve each one.
Missing security headers? Here is how to fix them in minutes - what each header does, copy-paste snippets for Apache, Nginx and…
Server instructions that tell the browser how to behave more safely - what each key security header does and why it matters.
X-Frame-Options controls whether other sites can embed your pages in a frame, stopping clickjacking attacks.
A Content-Security-Policy tells the browser which scripts, styles and resources it may load - the strongest defence against cross-site scripting.
HSTS forces browsers to connect only over HTTPS, closing the gap that SSL-stripping attacks exploit.
Permissions-Policy controls which browser features - camera, microphone, location - your pages and embedded content are allowed to use.
Referrer-Policy controls how much of your URLs the browser reveals to other sites, preventing sensitive addresses from leaking.
SPF, DKIM, DMARC and the wider DNS records that stop attackers spoofing your domain and keep your email out of the spam folder.
Duplicate records, the ten-lookup limit, syntax slips: the most common SPF record problems, and exactly how to fix each one.
A DMARC p=none policy reports spoofed email but blocks none of it. How to move safely to quarantine, then reject.
Missing or weak SPF and DMARC lets anyone spoof your domain. Here is how to fix SPF, DKIM and DMARC step by…
Set up SPF, DKIM and DMARC for WordPress with clear steps to stop spoofing and improve your email deliverability.
Not competing options but three layers that work together - what each does, how they differ, and why you need all three.
DKIM adds a cryptographic signature to your email that proves it is genuine and has not been altered in transit.
DMARC stops criminals sending email that appears to come from your domain, working alongside SPF and DKIM.
DNSSEC adds cryptographic signatures to DNS so forged answers are rejected, stopping hijacking and cache poisoning.
MTA-STS forces inbound email to your domain over encrypted, authenticated connections, closing the silent TLS-downgrade gap.
SPF is a DNS record listing which servers may send email for your domain - and the common pitfalls to avoid.
TLS-RPT asks sending servers to report how securely they delivered your email, exposing hidden encryption failures.
Plain-English guides to the vulnerabilities and industry standards behind every finding in your EzyAudit AI security report.
Vulnerable or outdated WordPress plugins are the number one cause of hacked sites. Here is exactly how to find and fix them,…
PHP2Shell lets attackers run code on any unpatched PHP server with one request. Here is how to check your website in a…
A vulnerability attackers are actively exploiting in the wild - what the CISA KEV catalogue is and why it matters.
A unique public identifier for a known security vulnerability, giving everyone a common language for tracking flaws.
An exposed .env file lets anyone download your database passwords, API keys and secrets - and why it is so dangerous.
CSRF tricks a logged-in user into making unwanted authenticated requests - and how tokens and SameSite cookies stop it.
CVSS scores how severe a vulnerability is, from zero to ten, so you know what to fix first.
Directory traversal lets attackers reach files outside the web root, such as config files that hold passwords.
SQL injection lets attackers manipulate the database queries behind your site to steal or destroy data.
A legacy WordPress interface often abused for brute-force amplification and pingback DDoS - and how to disable it safely.
Cross-site scripting lets attackers run malicious JavaScript in the browsers of your visitors - the main types and how to prevent it.