RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 1 of 20
Vulnerabilities · Aug 31, 2026
yarn.lock vs package.json on a production origin is two Node inventory files that must not sit next to index.html. /package.json donates names and versions — the roast signatures a JSON body with a name field. yarn.lock…
Read guide →Safety · Aug 22, 2026
X-XSS-Protection vs CSP is not a close race. X-XSS-Protection enabled the old IE/Chrome XSS auditor. That filter is retired, inconsistent, and has caused bypass-and-worse stories. Content-Security-Policy (enforcing,…
Read guide →News · Aug 13, 2026
X-Robots-Tag vs meta robots for public sites is a delivery-channel decision: the HTTP header works on HTML and non-HTML, while the robots meta tag only exists on HTML documents. Pick the header for PDFs, images, and…
Read guide →Safety · Aug 5, 2026
X-Content-Type-Options nosniff vs MIME sniffing is a one-line header decision with a content-type homework assignment. nosniff tells supporting browsers not to guess a different MIME type than the server declared. That…
Read guide →Safety · Jul 27, 2026
www vs apex canonical host for HTTPS marketing sites is a single-source-of-truth decision, not a branding argument. Choose example.com or www.example.com, serve TLS on both if you must, and 301/308 the loser to the…
Read guide →Vulnerabilities · Jul 19, 2026
wp-config.php.bak vs .env on production origins is two costumes of live secrets in the document root. /.env holds framework secrets. wp-config.php is supposed to be executed as PHP, not served as text — but editors…
Read guide →Vulnerabilities · Jul 10, 2026
WordPress XML-RPC vs wp-login.php is a two-door problem on a lot of marketing CMSs. wp-login.php is the browser form. xmlrpc.php is a legacy remote-procedure endpoint that can still authenticate users if it is enabled.…
Read guide →Vulnerabilities · Jul 2, 2026
WordPress debug.log vs framework debug on production is two leftover operator surfaces. WP_DEBUG plus WP_DEBUG_LOG writes PHP notices and often paths into wp-content/debug.log — a file that too often is fetchable as a…
Read guide →News · Jun 23, 2026
change-password well-known vs a custom /reset URL is a pointer versus the actual form. WICG / RFC 8615 well-known URIs put a redirect at https://example.com/.well-known/change-password so browsers and password managers…
Read guide →Vulnerabilities · Jun 15, 2026
WebSockets vs CORS for browser APIs is two different browser gates. CORS decides whether fetch/XHR may read a cross-origin HTTP response. A WebSocket starts as HTTP Upgrade; after the handshake, frames are not…
Read guide →