The acronyms, explained in plain English.
You should not need a DNS degree to protect your own name. These are the controls that stop impersonation, what each one actually does, and the order to set them in.
Or skip the reading and check your domain, it takes about twenty seconds.
What a content security policy does for your website
A content security policy tells browsers what your pages may load and run. What it blocks, why it is only a second layer, and what to ask your developer.
Read the article →Two-factor authentication explained, and which kind to use
Two-factor authentication stops most account takeovers, but the kinds are not equal. What each one protects against and which to switch on first.
Business email compromise: how fake invoice emails work
Business email compromise tricks staff into paying a fake invoice or a changed bank account. How the scam works, the warning signs, and how to stop it.
What is HSTS and does my website need it?
HSTS tells browsers to only ever use the secure version of your website. What it protects against, when it can backfire, and what to ask your developer.
WordPress security checklist for small business owners
A plain-English WordPress security checklist for business owners: updates, logins, plugins, backups and HTTPS. What to check, and what to ask your developer.
How to share passwords with staff safely
Sharing a login over WhatsApp or a spreadsheet is risky. How to share passwords with staff safely, who should get access, and what to do when someone leaves.
What is DKIM, and how do you know it is working?
DKIM puts a hidden signature on your business email. What it does, why Gmail and Outlook care, and three simple ways to check it is really working.
Why is my website down? Your host, you or an attack
Your website will not load. How to tell in five minutes whether it is just you, your host, an expired domain or an attack, and who to call first.
How to make a strong password you can remember
Strong passwords are long, not tricky. Three random words, what to avoid, and why a password manager should hold the rest, explained for small business owners.
Email spoofing test: can someone fake your domain?
Can anyone send email that looks like it comes from your business? How to test for it in plain English, what the result means, and what to ask your IT person.
Website security scan: what it checks and what it misses
A website security scan looks at your site from the outside, like a stranger would. What it checks, what it cannot see, and what to do with the result.
Are password managers safe? What happens if one is hacked
Password managers are safer than reusing passwords, but they are not magic. What a breach really exposes, what to check before you choose, and how to use one well.
Why is my email going to spam? The three records that decide it
Your emails land in spam because the receiving server cannot prove they came from you. The three records that decide it, what else matters, and what to ask.
WordPress site hacked? What to do first, step by step
Your WordPress site has been hacked and you are not sure where to start. Seven steps in the right order, and what to ask your host or developer at each one.
Is my website hacked? How to tell, in plain English
Nine warning signs that a website has been hacked, the quick checks anyone can do in ten minutes, and what to ask your host or developer if you find one.
Is updating WordPress enough to stop PHP2Shell?
No. PHP2Shell sits in PHP on your server, underneath WordPress, so a WordPress update cannot fix it. Who does fix it, and what to ask your host this week.
Railway breach: which keys and passwords to change now
Railway, OpenCode and LiteLLM all lost secrets in October 2026. What a "key" is, whether your site is affected, and what to ask your developer to change.
eMudhra SSL certificate blocked: do you need to replace yours?
Browsers blocked certificates from the Indian authority eMudhra, and Chrome drops one of its roots on 27 October. Who is affected, how to check, what to ask.
UpdraftPlus hacked: how to check your WordPress site
Stolen UpdraftCentral keys let attackers add hidden admin accounts to WordPress sites. What happened, how to check yours, and what to ask your developer.
Moodle and PHP2Shell: what schools should do now
Running Moodle? The PHP2Shell flaw sits under it, and the Moodle environment check will not flag it. What to ask your host and what to check this week.
Black October hacks: what they mean for your website
A week of headline hacks was named Black October. Which ones can touch a small business website, which cannot, and what to check this week.
PHP2Shell: what the PHP flaw means for your website and what to do
Two critical PHP flaws let attackers take over websites without logging in. Who is affected, the fixed versions, the signs of a hack, and how to recover.
How to stop email spoofing: the complete sequence
The full path from an unprotected domain to one nobody can forge: inventory your senders, then SPF, DKIM, DMARC at none, the reports, quarantine, reject. In the order that does not take your own email down.
heylogin vs 1Password vs Bitwarden: choosing a team password manager
A straight comparison of what the three cost, how each one signs you in, and which team each actually suits. Written by a heylogin partner, with that stated up front.
Cloudflare WAF, DNSSEC and CAA: what to switch on
Most domains sit on Cloudflare half configured. What the WAF is really for, and the settings worth turning on before you pay for a plan.
The CAA record explained: who can issue your certs
Without a CAA record, any certificate authority on earth can issue an HTTPS certificate for your domain. It is free, takes minutes, and almost nobody has one.
DMARC policy: none, quarantine or reject
What p=none, p=quarantine and p=reject actually do, why most domains are stuck at none, and the staged path to enforcement that does not take your own email down.
SPF, DKIM and DMARC explained, without the acronyms
The three records that stop anyone sending email as your business, what each one does, and why two of them are not enough on their own.
What building a domain checker taught us
We built a tool to grade any domain on DMARC, SPF, DNSSEC and CAA. The first thing it caught was a fault in our own scoring.
What is DNSSEC, and why the order matters
DNSSEC signs your DNS answers so they cannot be forged in transit. What it protects against, and why enabling it in the wrong order takes a domain offline.
Stop impersonation. Control access. Protect your business.
Choose the service you need, or book a security review and we will help you identify the correct starting point.