Shipping securely on a budget
Free ways to check a site before and after launch — security headers, SSL, leaked secrets, and the launch checklist nobody hands you.
The website launch security checklist nobody hands you
You get a deploy button, not a checklist — so most sites launch with the cert valid and nothing else checked. The four things to test from your URL in seconds, plus the code-side items that cost the most.
Website down from an expired SSL certificate
An expired certificate is a full outage — every visitor hits a red warning, though the server's fine. Here's why auto-renewal still fails silently, why shrinking cert lifetimes make it likelier, and how to see it coming.
My website says "Not Secure" — what it means and how to fix it
The "Not secure" label looks like a hack but usually isn't — it means your site isn't using HTTPS properly. Here's what the browser is really saying, and the common causes in plain language, fixed one by one.
What are security headers? A plain-English guide
Security headers tell the browser how to behave safely — refuse HTTP, block framing, don't guess file types. Here's what each of the ones that matter actually does, and why almost every new site ships without them.
How to add security headers in Next.js (including CSP)
Next.js sends no security headers by default. The static ones are a config block; the hard part is a CSP that helps without blocking your own scripts. Here's the nonce approach, the report-only trick, and the version caveat.
SSL certificate expiry monitoring: why the calendar reminder fails
A calendar reminder assumes your renewal works. But auto-renewal is a background job that fails silently, and cert lifetimes are dropping to 47 days by 2029. Here's why manual SSL tracking breaks, and what to monitor instead.
Secure, HttpOnly, SameSite: the cookie flags that matter
Three small flags — Secure, HttpOnly, SameSite — decide whether your session cookie is a locked token or the easiest thing to steal on your site. Here's what each closes, and how to check which your cookies set.