10 min read
Remove the X-Powered-By Header
Turn off X-Powered-By at the source in PHP, Express and Next.js, strip it at an nginx or Apache proxy, and check your response headers with a paste-in checker.
Read more
Blog
Practical, plain-language notes on penetration testing, web and network security, and hardening.
8 min read
Hide the Apache Server Header
Set ServerTokens Prod and ServerSignature Off, remove X-Powered-By with mod_headers, and check your Apache response headers with a paste-in checker.
Read more9 min read
How to Scope an AI or LLM Application Penetration Test
Scope an AI or LLM application test with a layer-by-layer worksheet, authorization boundaries, test tenants, resource limits, and a filled support-assistant example.
Read more10 min read
How to Prepare for a Penetration Test
What to have ready before an authorized penetration test: access, test accounts, the testing window, named contacts, and written authorization.
Read more11 min read
How to Read a Penetration Test Report
A usable penetration test report names the agreed scope, rates each confirmed finding, and gives evidence, business impact, and a fix a developer can follow.
Read more11 min read
What Is Infrastructure Penetration Testing?
Infrastructure penetration testing evaluates your networks and systems through external and internal assessments. Here is what it covers.
Read more4 min read
Microsoft's Windows 365: An Option to Consider for Remote Workers
Windows 365 offers cloud PCs for remote and hybrid teams. Here is a quick overview and a few points to weigh.
Read more4 min read
FTC Says Predatory Schools Have Been Targeting Active Duty Military and Veterans
A summary of a Federal Trade Commission consumer protection post about for-profit schools targeting service members and veterans.
Read more13 min read
Hide the Nginx Server Header
How to hide or remove the Nginx Server header: server_tokens off, the headers-more module, and a curl check to confirm the change.
Read more9 min read
Penetration Testing vs Bug Bounty
Penetration testing and bug bounty programs solve different problems. Here is how they compare and when each makes sense.
Read more8 min read
Using X-Frame-Options to Avoid Clickjacking in Your Web Application
Clickjacking uses hidden frames to trick users into clicking. X-Frame-Options and CSP frame-ancestors let you control who can frame your pages.
Read more10 min read
The Dangers of Misconfiguring CORS Headers on a Web API Server
How CORS works, why a misconfigured policy creates risk, and how to set Access-Control-Allow-Origin safely.
Read more