Web Security

Read more about the article Nginx Rate Limiting and Bot Mitigation Without Blocking Real Users

Nginx Rate Limiting and Bot Mitigation Without Blocking Real Users

A limit_req block that parses cleanly can still be doing absolutely nothing, or throttling every visitor behind one CDN edge. This guide covers Nginx rate limiting and bot mitigation as they actually behave in production: getting the key right behind a proxy, what burst and nodelay do to your traffic shape, sizing zones correctly, rolling out in dry run mode, and layering bot handling from robots.txt through user agent maps to firewall escalation.

Continue ReadingNginx Rate Limiting and Bot Mitigation Without Blocking Real Users
Read more about the article Business Email DNS Done Right: MX, SPF, DKIM and DMARC

Business Email DNS Done Right: MX, SPF, DKIM and DMARC

Your domain has all four records. Every free checker shows green. It is still trivially spoofable, because publishing a record and enforcing a policy are different acts. A working guide to business email DNS: what MX, SPF, DKIM and DMARC each actually protect, the SPF lookup budget and the void-lookup limit nobody watches, why DKIM alignment decides whether you can ever reach p=reject, the domain architecture that stops the problem recurring, and a rollout order that gets you to enforcement without losing legitimate mail.

Continue ReadingBusiness Email DNS Done Right: MX, SPF, DKIM and DMARC
Read more about the article You Probably Didn’t Harden That Server: A VPS Setup and Hardening Checklist That Verifies Itself

You Probably Didn’t Harden That Server: A VPS Setup and Hardening Checklist That Verifies Itself

You set PasswordAuthentication no, restarted SSH, and moved on. Months later the logs show successful password logins, because a vendor drop-in file sorted earlier and won. A VPS setup and hardening checklist where every step comes with the command that proves it worked.

Continue ReadingYou Probably Didn’t Harden That Server: A VPS Setup and Hardening Checklist That Verifies Itself
Read more about the article It Works in My Browser: Debugging TLS Certificate Errors in Chains, SANs and Expiry

It Works in My Browser: Debugging TLS Certificate Errors in Chains, SANs and Expiry

Your browser shows a padlock and your partner's API client throws "unable to get local issuer certificate". Both are correct. A practical guide to the four things a TLS client actually checks, and to renewal automation that reaches the running server instead of just the disk.

Continue ReadingIt Works in My Browser: Debugging TLS Certificate Errors in Chains, SANs and Expiry
Read more about the article Your Deploy Key Is a Root Shell: GitHub Actions VPS Deployment Over SSH, Done Carefully

Your Deploy Key Is a Root Shell: GitHub Actions VPS Deployment Over SSH, Done Carefully

A deploy key in GitHub secrets is a shell on your production server, handed to a container you don't control, running code from maintainers you've never met. Here's how to build the pipeline so a leaked key isn't worth much: forced commands, scoped sudo, pinned actions and a real approval gate.

Continue ReadingYour Deploy Key Is a Root Shell: GitHub Actions VPS Deployment Over SSH, Done Carefully