SecurityWhat Are HTTP Security Headers? A Complete 2026 Guide
HTTP security headers are the cheapest, fastest win in web security. Learn what each one does, which to set first, and how to reach an A grade.
3 min readJan 14, 2026
Knowledge Base
Learn to scan, fix & monitor.
Practical, jargon-free guides on website security, scans, uptime monitoring and AI — written by the team behind PatchPings.
Guides
Security, scans, monitoring, and AI guides
Browse every PatchPings knowledge-base article, or filter by topic.
Security
SecuritySSL vs TLS Explained: Certificates and the Chain of Trust
The padlock is only the beginning. Understand certificates, TLS versions, and the chain of trust — concepts first, before you chase a grade.
2 min readJan 9, 2026
SecurityWhat Is Clickjacking? XSS and CSRF Explained
What clickjacking is, how XSS and CSRF work, and the concrete defences that shut each one down — without the jargon.
2 min readDec 18, 2025
ScansHow to Read Your Website Security Scan Report
Grades, scores and findings can be overwhelming. Here is how to interpret a security scan and decide what to fix first.
2 min readJan 21, 2026
ScansWhat Is DMARC? SPF, DKIM and Email Authentication
What DMARC is, how SPF and DKIM support it, and the concepts behind email trust — before you publish a step-by-step DMARC policy.
2 min readJan 5, 2026
ScansHTTP to HTTPS Redirects: Fixing Mixed Content and Redirect Chains
Serving HTTPS is not enough if visitors can still reach the insecure version. Learn to fix redirects, chains and mixed content the right way.
2 min readDec 11, 2025
MonitoringWebsite Uptime Monitoring: Everything You Need to Know in 2026
What uptime monitoring really measures, how often to check, and how to be the first to know about downtime instead of the last.
3 min readJan 19, 2026
MonitoringSSL Certificate Monitoring: Never Get Caught by Expiry
SSL certificate monitoring catches expiry before visitors do. Here is why careful teams still get burned and how to make it impossible.
2 min readJan 2, 2026
MonitoringReducing False Alerts: How Multi-Region Monitoring Works
Alert fatigue is the silent killer of monitoring. Learn how checking from multiple regions turns noisy alerts into ones you can trust.
2 min readDec 4, 2025
AIHow AI Is Changing Website Security Scanning
Traditional scanners hand you raw data. AI-powered scanning reads it, ranks it by real-world risk and tells you what to do in plain English.
3 min readJan 23, 2026
AIAI Anomaly Detection for Uptime Monitoring, Explained
Static thresholds cannot tell a real outage from ordinary variation. Here is how AI may help flag unusual patterns and alert when it matters.
2 min readJan 12, 2026
AIHow AI Writes Your Security Fixes
Knowing what is wrong is only half the battle. See how an AI Fix Assistant turns each finding into a copy-paste-ready solution for your exact stack.
2 min readDec 29, 2025
Dev guidesContent Security Policy Setup: Staged Rollout Without Breaking Your Site
A content security policy (CSP) tells browsers what your pages may load. Deploy it safely: inventory, report-only, refine, then enforce.
2 min readJan 16, 2026
Dev guidesWhat Is HSTS and How to Enable It Safely
What HSTS is, why it matters, and how to enable it safely with a short max-age ramp — not the misconfiguration rescue playbook.
2 min readDec 22, 2025
Dev guidesHow to Fix Content-Security-Policy Errors
Troubleshoot CSP console errors and violation reports after deploy — the fix playbook once a policy is already in place.
2 min readJun 18, 2026
Dev guidesDMARC Setup Step-by-Step
Publish DMARC from p=none to p=reject: DNS record, report inbox, and policy upgrades — the hands-on walkthrough after the concepts guide.
2 min readJun 16, 2026
SecurityHow to Get an SSL Grade A+
An actionable checklist for TLS 1.3, strong ciphers, complete chains and HSTS — the concrete steps between a passing grade and A+.
1 min readJun 14, 2026
MonitoringWebsite Downtime Checklist: What to Check First
When your site goes dark, minutes matter. Follow this ordered checklist to find the cause fast: DNS, hosting, SSL, CDN and application layers.
2 min readJun 12, 2026
Dev guidesHSTS Misconfiguration Fixes
Diagnose and recover from HSTS lockouts, broken subdomains, and preload mistakes — troubleshooting after a bad rollout.
2 min readJun 10, 2026
AIWhat Is llms.txt? A Practical Guide for Site Owners
llms.txt is a plain-text file at your site root that tells AI systems which pages to prefer for accurate answers. Learn the format, how it differs from robots.txt, and how to publish one.
4 min readOct 19, 2026
AIWhat Is Answer Engine Optimization (AEO)?
Answer engine optimization helps AI assistants and answer boxes cite your pages accurately. Learn how AEO differs from classic SEO and which on-site signals matter most.
4 min readOct 19, 2026
Dev guidesSPF Record Guide: Publish, Align, and Avoid Lookup Limits
Sender Policy Framework (SPF) lists which servers may send mail for your domain. Learn how to write an SPF TXT record, stay under ten DNS lookups, and pair it with DKIM and DMARC.
4 min readOct 19, 2026
SecurityWhat Is security.txt? Responsible Disclosure for Your Domain
security.txt is a well-known file that tells researchers how to report vulnerabilities on your domain. Learn the RFC 9116 fields, where to host it, and what to include.
3 min readOct 19, 2026
SecurityX-Frame-Options Header Guide: Stop Clickjacking
X-Frame-Options tells browsers whether your pages may be embedded in frames. Learn DENY vs SAMEORIGIN, how it relates to CSP frame-ancestors, and how to verify the header.
3 min readOct 19, 2026
ScansDMARC Policy Explained: none, quarantine, and reject
DMARC p=none, p=quarantine, and p=reject tell receivers what to do when authentication fails. Learn what each policy means and when to move between them.
4 min readOct 19, 2026
Dev guidesDKIM Record Guide: Selectors, Keys, and Alignment
DomainKeys Identified Mail (DKIM) signs outbound messages so receivers can verify integrity. Learn how selectors, public keys, and DMARC alignment fit together.
4 min readOct 19, 2026
SecurityCross-Origin-Opener-Policy (COOP) Explained
Cross-Origin-Opener-Policy isolates your browsing context from cross-origin popups. Learn same-origin vs same-origin-allow-popups and when COOP helps.
3 min readOct 19, 2026
SecurityReferrer-Policy Header: Control What URLs You Leak
Referrer-Policy controls how much of the current URL is sent in the Referer header on navigations and requests. Learn practical values and privacy trade-offs.
3 min readOct 19, 2026
ScansHow to Check HTTP Security Headers on a Live Site
Learn practical ways to inspect HTTP security headers: browser DevTools, command-line fetches, and automated scanners that grade missing or weak policies.
4 min readOct 19, 2026
ScansHow to Read DMARC Reports Without Getting Lost
DMARC aggregate reports show who sent mail as your domain and whether SPF and DKIM passed. Learn how to read the XML, spot unknown senders, and decide when to tighten policy.
4 min readOct 19, 2026
AIWhat Is ai.txt? AI Crawler Guidance for Your Site
ai.txt is a machine-readable file that shares AI crawler preferences and citation guidance. Learn how it differs from llms.txt and robots.txt, and how PatchPings publishes ai.txt.
3 min readOct 19, 2026
SecurityX-Content-Type-Options: nosniff Explained
X-Content-Type-Options: nosniff stops browsers from MIME-sniffing responses into executable types. Learn why the header matters and how to verify it.
3 min readOct 19, 2026
SecurityPermissions-Policy Header: Turn Off Powerful Browser Features
Permissions-Policy lets you disable camera, microphone, geolocation, and other powerful browser features your site does not need. Learn a safe baseline and how to extend it.
3 min readOct 19, 2026
Dev guidesCSP Nonces Explained: Safer Inline Scripts
Content-Security-Policy nonces let you allow specific inline scripts without opening unsafe-inline. Learn how nonces work, how they differ from hashes, and rollout tips.
4 min readOct 19, 2026
Dev guidesCAA Record Guide: Control Who Can Issue Certificates
A CAA DNS record lists which certificate authorities may issue TLS certificates for your domain. Learn issue, issuewild, and iodef tags and how CAA fits a PatchPings-style DNS/TLS posture check.
4 min readOct 26, 2026
Dev guidesMTA-STS and TLS-RPT: Encrypt Mail Between Servers
MTA-STS publishes a policy that requires TLS for inbound SMTP. TLS-RPT reports delivery failures. Learn policy hosting, DNS records, and how this layer complements DMARC without replacing it.
4 min readOct 26, 2026
SecurityWhat Is BIMI? Brand Logos in Supporting Inboxes
BIMI lets supporting mailbox providers show your brand logo next to authenticated mail. Learn DNS requirements, SVG constraints, and why DMARC enforcement comes first.
3 min readOct 26, 2026
Dev guidesDNSSEC Explained: Authenticated DNS Answers
DNSSEC adds cryptographic signatures to DNS so resolvers can detect forged answers. Learn what it validates, common failure modes, and how DNS health checks relate — without a separate interactive DNSSEC tool.
4 min readOct 26, 2026
Dev guidesHSTS Preload Guide: Browser List Requirements and Rollback Risk
HSTS preload submits your domain to browsers’ built-in HTTPS-only lists. Learn includeSubDomains, preload token requirements, submission criteria, and why removal is slow.
4 min readOct 26, 2026
MonitoringCertificate Transparency Monitoring: Watch Issuance, Not Just Expiry
Certificate Transparency logs public TLS issuances. Learn why operators watch CT, how it differs from SSL expiry monitoring, and how to react to unexpected certificates for your domains.
4 min readOct 26, 2026
Dev guidesSPF Softfail Explained: What ~all Really Means
SPF softfail (~all) marks unauthorised senders without hard-failing them. Learn how receivers treat softfail, when to use it during migration, and how to move to -all without breaking mail.
3 min readOct 26, 2026
SecurityCross-Origin-Embedder-Policy (COEP) Explained
COEP controls whether a document can load cross-origin resources that do not explicitly opt in. Learn require-corp vs credentialless, pairing with COOP, and why many sites ship COOP without COEP.
3 min readOct 26, 2026
SecurityCross-Origin-Resource-Policy (CORP) Explained
CORP tells browsers which cross-origin contexts may load a resource. Learn same-origin, same-site, and cross-origin values and how CORP supports COEP and COOP isolation.
3 min readOct 26, 2026
