Email authentication
DMARC without the panic
Moving from p=none to p=reject, one safe step at a time.
Security headers
A first Content-Security-Policy
How to write one that protects your visitors without breaking your site.
In the works
Blog
Plain-language writing on web security, from the team building Lycan.
HTTPS
What HSTS really commits you to
Max-age, subdomains and preload, before you turn them on.
DNS
CAA in five minutes
Tell the world which authorities may issue certificates for your domain.