Try “SSH”, “passkeys”, “WordPress” or “Content-Security-Policy”.
CSP Builder · runs in your browser
Build a Content Security Policy step by step, see the risk of each choice and copy it as an Apache, Nginx or meta tag snippet.
Your policy
Start in report-only mode, watch the browser console for blocked resources, then enforce. Test Apache with apachectl configtest and Nginx with nginx -t.
Read the background
Four web servers, one question: which one leaves the fewest gaps once it is running? We compare defaults, automatic HTTPS, configuration risk, attack surface and how fast fixes reach you.
Medium impact6 min
When a WordPress site is broken into, the cause is rarely WordPress core. These steps close the usual gaps in order of impact, with settings and server rules you can copy.
High impact6 min
No database, no login page, no code running on each request: static sites are hard to break into directly. The risks move to the build pipeline, the accounts, the DNS and the scripts you embed.
Medium impact5 min
More tools
