RoastMyOpsecBlog
OPSEC signal for public sites and apps — what changed, what still leaks, and what to scan first. Ten guides per page.
Page 4 of 7
News · Oct 18, 2024
noindex vs robots.txt Disallow for public sites is an indexing decision versus a crawl-budget hint: noindex asks cooperating engines not to index a URL they can still fetch, while Disallow asks them not to crawl a path…
Read guide →News · Oct 1, 2024
NEL vs CSP reports is a telemetry split, not a ranking of which header 'is more secure.' Network Error Logging (NEL) plus Report-To / Reporting-Endpoints tells supporting browsers to report certain network failures to a…
Read guide →News · Aug 20, 2024
llms.txt vs robots.txt on public marketing sites is two text files that talk to crawlers, not to your WAF. robots.txt (now RFC 9309) tells well-behaved crawlers which paths to skip. llms.txt is a community convention…
Read guide →News · Aug 11, 2024
rel=describedby vs llms.txt for public sites is a per-resource description decision versus a site-level AI brochure decision: describedby (an IANA link relation) points a document at a description of that resource,…
Read guide →News · Aug 3, 2024
Last-Modified vs sitemap lastmod for public sites is a cache-validator decision versus a crawler-hint decision: Last-Modified (and ETag) help clients skip a body they already have, while <lastmod> in sitemap.xml tells…
Read guide →News · Jul 8, 2024
JSON-LD vs Microdata for public sites is an encoding decision for the same Schema.org types: JSON-LD is a script block you can maintain beside the template, while Microdata weaves itemprop attributes into the visible…
Read guide →News · Jun 30, 2024
IPv6 AAAA vs origin IP exposure on CDNs is the same bypass class as a leftover A record, in 128-bit clothing. Visitors should resolve your public hostname to the CDN or anycast edge. If AAAA (or A) still points at the…
Read guide →News · Jun 21, 2024
Integrity-Policy vs Subresource Integrity for CDN scripts is a header that demands hashes versus the hashes themselves. SRI is integrity= on a <script> or <link>. Integrity-Policy (and Integrity-Policy-Report-Only)…
Read guide →News · Jun 13, 2024
IndexNow vs Google sitemap ping for public sites is a crawl-notification decision, not a security control: IndexNow POSTs URLs you already publish to supporting engines, while Google stopped honoring the old sitemap…
Read guide →News · May 18, 2024
humans.txt vs security.txt on public marketing sites is two small text files with different jobs. humans.txt (usually /humans.txt) is an informal credits list: names, roles, tools, sometimes a 'last updated' line. It is…
Read guide →