Resources
Every web security answer, one click away.
Per-check explainers, step-by-step fix guides, long-form articles, side-by-side tool comparisons, free scanners, and compliance prep. Built for engineers shipping real products, not for security theater.
Per-check explainers
What every Barrion check actually looks at.
The /learn library covers each check we run: what it is, why it matters, and how the scan works. Read the explainer first, then jump to the fix.
Transport
TLS security monitoring
What TLS 1.2 and 1.3 actually require, why weak ciphers still ship, and how Barrion validates protocol and certificate health.
Headers
Security headers, end to end
CSP, HSTS, X-Frame-Options, Permissions-Policy, COEP, COOP, all in one place. Each header gets its own explainer plus a fix guide.
Sessions
Cookie security attributes
Secure, HttpOnly, SameSite, and the Set-Cookie patterns that prevent session theft and CSRF. With framework defaults.
Cross-origin
CORS done right
When wildcards are safe, when they aren't, and how to scope Access-Control-Allow-Origin so legitimate clients still work.
Email
SPF, DKIM, DMARC, DNSSEC
The four records every domain should publish, the order to roll them out, and how Barrion checks each one passively.
Catalog
Every check we run
Browse the full /learn catalog for explainers on certificate validity, clickjacking, CAA records, referrer policy, and more.
Fix guides
How to actually patch it.
Every vulnerability page is a hands-on remediation guide: config snippets for Nginx, Apache, Node, Next.js, Django, Laravel, plus the verification step that proves the fix held.
Headers
Fix a missing HSTS header
Set max-age, includeSubDomains, and preload safely. Configs for Nginx, Apache, Node, and Next.js with verification steps.
Headers
Add a Content Security Policy
Roll out CSP in Report-Only first, use nonces and strict-dynamic, and avoid breaking your app on the first deploy.
Transport
Resolve mixed content on HTTPS
Find every HTTP asset in code, CSS, and CMS content. Use upgrade-insecure-requests and CI checks to stop regressions.
Sessions
Lock down insecure cookies
Add Secure, HttpOnly, and SameSite to session cookies. Framework snippets for Express, Django, Rails, Laravel, and Next.js.
Transport
Upgrade weak TLS protocols
Disable TLS 1.0 and 1.1, keep 1.2 for compatibility, and turn on 1.3. With cipher allow-lists and rollback steps.
Catalog
All fix guides
Browse every guide under /vulnerabilities: clickjacking, referrer policy, SPF/DKIM/DMARC, server info disclosure, and more.
Long-form guides
When you want the full story.
Articles on the Barrion blog go deeper than the per-check pages: implementation checklists, framework-specific walkthroughs, and the engineering trade-offs behind each decision.
Implementation
Complete security implementation checklist
End-to-end checklist covering TLS, headers, authentication, cookies, CORS, DNS, and email. Use it as a release-readiness gate.
Headers
Developer's guide to HTTP security headers
What each header does, the attacks it stops, and the safe defaults to ship. Built for engineers, not for auditors.
Transport
HTTPS implementation guide
Certificates, redirects, HSTS, and mixed-content cleanup, with practical steps for Nginx, Apache, IIS, Next.js, and CDNs.
Monitoring
Why regular security scans matter
The cadence that catches drift without flooding inboxes, plus playbooks for getting back to a clean baseline fast.
Email
SPF, DKIM, DMARC, the full guide
Configure email authentication end to end. Improve deliverability and block spoofing with clear DNS examples.
Catalog
All long-form guides
Browse every article on the blog: API security, vulnerability remediation, cloud security, cookie hardening, and more.
Comparisons
Barrion vs everyone else.
Honest, side-by-side breakdowns. We tell you when a competitor is the better fit, when an open-source tool is enough, and when you should run both.
DAST
Barrion vs OWASP ZAP
ZAP is the engine; Barrion is the operations layer around it. When the open-source option is enough and when it isn't.
DAST
Barrion vs Burp Suite
Burp is a manual testing toolkit; Barrion is a continuous scanner. Different jobs, often used side by side.
SaaS scanner
Barrion vs Detectify
Passive, production-safe monitoring vs active EASM-style scanning. Where each fits in your engineering stack.
Cadence
Continuous monitoring vs one-off scan
Why a snapshot misses misconfiguration drift, and what changes when scans run on a weekly or daily cadence.
Cadence
Barrion vs annual pentests
Pentests catch deep findings once a year. Continuous monitoring catches everything else the other 364 days. How to pair them.
Catalog
All comparisons
Side-by-side breakdowns vs Snyk, Nessus, Qualys, Acunetix, Invicti, Probely, HostedScan, Wiz, and Mozilla Observatory.
Free tools
Run a real check, right now.
The /tools catalog runs the same engine as the paid product, one check at a time, against your live URL. No signup to see a single result.
Full scan
Website security scanner
Run all 35+ checks at once: TLS, headers, cookies, CORS, DNS, email auth, and network surface. No signup to see the score.
Headers
Security headers test
Audit your HTTP security headers and get copy-paste fixes for the gaps that matter, in seconds.
Transport
TLS/SSL configuration test
Validate certificate, TLS version, HSTS, and cipher suites. Catches expiry and weak protocols before browsers complain.
Cross-origin
CORS policy checker
Inspect Access-Control headers, test preflight responses, and confirm your origin allow-list isn't wide open.
Email
Email security (SPF/DKIM/DMARC)
Check your domain's email authentication records and flag the gaps that let spoofed mail through.
Catalog
All free tools
Browse the full /tools index: CSP checker, cookie security, OCSP stapling, WAF detector, open-port scan, and more.
Compliance resources
Evidence your auditor will accept.
Each compliance page maps Barrion's continuous monitoring to the specific controls in SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, and FedRAMP, with downloadable PDF and CSV evidence.
SOC 2
SOC 2 continuous monitoring
Which CC6.x controls Barrion's monitoring covers, and the evidence pack auditors actually accept.
ISO 27001
ISO 27001 monitoring
Annex A 8.x controls satisfied by continuous DAST monitoring, mapped to your statement of applicability.
PCI DSS
PCI DSS monitoring
Requirements 6 and 11 evidence: vulnerability scanning cadence, change detection, and audit-ready logs.
HIPAA
HIPAA technical safeguards
Access control, integrity, and transmission-security checks that map to the HIPAA Security Rule.
GDPR
GDPR Article 32 monitoring
Demonstrate ongoing technical measures for personal-data protection, with timestamped scan history.
FedRAMP
FedRAMP continuous monitoring
Evidence aligned with FedRAMP's ongoing assessment expectations, ready to attach to your POA&M.
FAQ
Resources, answered.
Where should I start if I'm new to web security?
Run a free scan against your live site at /tools/website-security-scan, then read the per-check explainers under /learn for the findings you got. Each explainer links to a step-by-step fix guide under /vulnerabilities, so the path from "what's wrong" to "how to fix it" is two clicks.
Are the free tools really free, or a teaser?
Really free. The scanners at /tools run real checks against your live URL and return the same data the paid product surfaces. No signup needed to run a single tool. Sign up only if you want history, scheduled scans, exports, or the unified report across all 35+ checks.
What's the difference between /learn and /vulnerabilities?
/learn is the per-check explainer (what the check is, why it matters, how Barrion runs it). /vulnerabilities is the per-finding fix guide (how to actually patch the issue on Nginx, Apache, Node, Next.js, Django, Laravel). Most learn pages link to the matching fix guide and vice versa.
Do the compliance pages map to specific controls?
Yes. Each compliance page (SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, FedRAMP) lists the exact control families Barrion's continuous monitoring satisfies, plus the PDF and CSV exports your auditor will accept as evidence.
How fresh are the comparison pages?
We refresh /compare entries when product or pricing details shift on either side. Each comparison is factual and side-by-side: scan type, primary use case, remediation flow, pricing posture, and who the tool is built for. No marketing hand-waving.
Skip the reading. Run a scan.
The fastest path to a real answer is a real scan. 60 seconds, no credit card, real findings against your live app.