Loading this page…
Fetching the writing. This should take a moment.
Loading this page…
Fetching the writing. This should take a moment.
Writing
Certificates expire, DNS records get edited in a hurry, and a security header disappears after a config reload. None of it announces itself. These are working notes on that class of problem — how it happens, how to check for it, and what to do about it.
We build a monitoring tool, so we are not neutral, and posts say so where it is relevant. Nothing here will claim a number we do not measure.
Most posts start from something that actually broke — a certificate that lapsed silently, a redirect loop introduced by a proxy change, a header that quietly stopped being sent after a framework upgrade — and work backward to the check that would have caught it. If a post references a tool or a finding page, it links to the specific one being discussed rather than a general product page.
"We have DMARC" usually means a record exists, not that anything is enforced. The gap between p=none and an actual policy, why SPF alone doesn't close it, and how to move without breaking mail.
The six response headers a scanner checks for, what each one actually prevents at the browser level, and the one honest caveat: none of them fix a vulnerability in your application code.
A practical path from a working app to a deployed one on a plain Linux server, and then the part most guides stop before: finding out when it breaks.