Web security

This series treats security settings as contracts with scope and failure modes. It covers transport, headers, certificate renewal, host keys, cookies, HSTS, and certificate-authority authorization records.

A DNS policy record authorizing one certificate authority while rejecting another.

CAA records should authorize the issuer you actually use

CAA narrows certificate issuance policy, but a mistaken record can block renewal as effectively as an expired certificate.

A browser cookie constrained by host, path, transport, and same-site boundaries.

Cookie scope should be narrower than the application boundary

A cookie sent to more hosts or paths than necessary enlarges the impact of every mistake at those boundaries.

An HSTS policy increasing through staged max-age steps before covering subdomains.

HSTS should be rolled out with a recovery plan

HSTS is cached browser policy, so a configuration mistake can outlive the server change that created it.

A certificate shield with a validity and expiry gauge.

Certificate expiry is a date, not a dashboard color

Use SNI, inspect the public certificate, and alert before renewal becomes an incident.

Transport, browser policy, and resource graph shown as security layers.

Security headers should describe the actual page

Start with a narrow policy, then expand it only when a documented feature needs another resource.

A recorded SSH host fingerprint connected to a key symbol.

SSH host keys are part of the deployment record

Record the expected fingerprint, use a deliberate StrictHostKeyChecking policy, and treat changes as an incident until explained.