Vulnerability Fix Guide

Step-by-step guides to fix common web security findings. Each guide explains what the issue is, why it matters, and how to fix it, with examples for Nginx, Apache, Node, and more. Run a free scan to see which findings apply to your site.

Security Headers

How to fix a missing HSTS header

Step-by-step guide to enable HTTP Strict Transport Security (HSTS) on your web server. Prevents downgrade attacks and enforces HTTPS. Nginx, Apache, Node, and Next.js examples.

Security Headers

How to fix a missing or weak Content Security Policy (CSP)

Step-by-step guide to implement Content Security Policy (CSP) to prevent XSS and injection. Nginx, Apache, and framework examples with safe defaults.

TLS / HTTPS

How to fix mixed content (HTTP on HTTPS pages)

Fix mixed content errors: resources loaded over HTTP on an HTTPS page. Step-by-step guide to find and fix scripts, images, and iframes.

Cookie Security

How to fix insecure cookies (missing Secure, HttpOnly, or SameSite)

Fix cookie security: add Secure, HttpOnly, and SameSite attributes to prevent theft and cross-site attacks. Set-Cookie examples for Node, Rails, and server config.

Security Headers

How to fix missing X-Frame-Options or frame-ancestors (clickjacking)

Prevent clickjacking: add X-Frame-Options or CSP frame-ancestors so your site cannot be embedded in a malicious iframe. Nginx, Apache, and framework examples.

TLS / HTTPS

How to fix SSL/TLS certificate expiry or expiring soon

Prevent certificate expiry: renew and install SSL/TLS certificates before they expire. Automation with Let's Encrypt and monitoring tips.

Security Headers

How to add Referrer-Policy header

Step-by-step guide to set Referrer-Policy to control how much referrer information is sent. Reduce information leakage. Nginx, Apache, and framework examples.

Security Headers

How to add X-Content-Type-Options header

Prevent MIME sniffing: set X-Content-Type-Options: nosniff so browsers use the declared Content-Type. Nginx, Apache, and framework examples.

Security Headers

How to add Permissions-Policy header

Restrict browser features (camera, mic, geolocation) with Permissions-Policy. Step-by-step guide with Nginx, Apache, and Node examples. Reduces attack surface.

Information Disclosure

How to fix server information disclosure (Server, X-Powered-By)

Stop leaking server and platform details in HTTP headers. Remove or genericize Server, X-Powered-By, and similar. Nginx, Apache, Node, and PHP examples.

TLS / HTTPS