Security
TLS, authentication and hardening - defensive, protective guidance, and the widely-repeated advice that quietly leaves you exposed.
Sub-topics
TLS & Certificates
22Let's Encrypt, certbot, renewals and chain problems.
Authentication
14JWT, OAuth, sessions and the token mistakes that hand over accounts.
Web App Security
5CORS, CSP, injection and the browser-facing attack surface.
Hardening & Secrets
11SSH, firewalls, secrets and locking down a server without locking yourself out.
53 articles · showing 1-9 (page 1 of 6)
Blocked by CORS Policy: Stop Reaching for Access-Control-Allow-Origin: *
The wildcard breaks the moment you send cookies, and reflecting the Origin header is worse. Here is the allowlist pattern, the nginx config and the curl test that proves it.
Your Cert Automation Should Default to Let's Encrypt Staging
Five test renewals can exhaust the duplicate certificate limit and block a real renewal for a week. Here is why certbot drifts to production, and the directory split that prevents it.
Certbot connection refused on http-01: diagnosing proxies, IPv6 and port 80
Connection refused is not the same as a timeout, and the difference tells you exactly where to look. A diagnostic order for failed Let's Encrypt http-01 challenges.
The Security Checklist Every Kenyan SME Running Its Own Server Should Finish This Week
You do not have a security budget problem, you have a completeness problem. Ten free controls with real commands, a cost table, and the weekly rhythm that keeps a self-hosted Kenyan SME system out of trouble.
Nginx Reverse Proxy, TLS and Rate Limiting: The Config You Should Actually Be Running
A one-line proxy_pass is not a reverse proxy. Real timeouts, correct forwarded headers, a Mozilla-grade TLS block and limit_req zones that stop credential stuffing without breaking your own app.
Kenya's Data Protection Act Is an Engineering Spec: What Sections 25, 31, 41 and 43 Demand From Your Code
The DPA 2019 is not a lawyer problem, it is a schema, retention and logging problem. Registration thresholds, the 72-hour breach clock, the encryption safe harbour, and the eight things to build this quarter.
How Kenyan Small Businesses Actually Get Hacked (Nobody Is Burning a Zero-Day on Your Duka)
Five real attack chains account for almost every SME breach: infostealers, credential stuffing, exposed admin panels, unpatched plugins and invoice fraud. With the log commands to check each one today.
Stop Committing Keys: A Secrets Workflow for Two-Person Teams Using SOPS and age
You do not need Vault. You need encrypted secrets in git, one age key per human, and a pre-commit hook that refuses the mistake. Full setup, offboarding in two commands, and when to actually upgrade.
Certbot http-01 Fails Behind Your Force-HTTPS Redirect: It Is Not HSTS
Let's Encrypt follows your 301 to HTTPS and ignores HSTS entirely. So the real cause of a failed http-01 renewal is one of four things, and disabling HSTS is not the fix.