RoastMyOpsecBlog
Defensive defaults that keep browsers, cookies, email, and TLS from doing attackers' homework. Ten guides per page.
Page 1 of 7
Safety · Aug 22, 2026
X-XSS-Protection vs CSP is not a close race. X-XSS-Protection enabled the old IE/Chrome XSS auditor. That filter is retired, inconsistent, and has caused bypass-and-worse stories. Content-Security-Policy (enforcing,…
Read guide →Safety · Aug 5, 2026
X-Content-Type-Options nosniff vs MIME sniffing is a one-line header decision with a content-type homework assignment. nosniff tells supporting browsers not to guess a different MIME type than the server declared. That…
Read guide →Safety · Jul 27, 2026
www vs apex canonical host for HTTPS marketing sites is a single-source-of-truth decision, not a branding argument. Choose example.com or www.example.com, serve TLS on both if you must, and 301/308 the loser to the…
Read guide →Safety · Apr 8, 2026
upgrade-insecure-requests vs HSTS for mixed content is a page-level rewrite versus a host-level memory. Content-Security-Policy: upgrade-insecure-requests tells supporting browsers to try HTTPS for http:// subresources…
Read guide →Safety · Mar 30, 2026
Trusted Types vs CSP for DOM XSS is two layers, not a replacement. Content-Security-Policy script-src (nonces, hashes, no unsafe-inline) limits which scripts load. Trusted Types (CSP trusted-types and…
Read guide →Safety · Mar 13, 2026
TLS-RPT vs MTA-STS for SMTP failure reports is telemetry versus policy. MTA-STS (RFC 8461) publishes how sending MTAs should use TLS to your MX. TLS-RPT (RFC 8460) is a DNS TXT on _smtp._tls that names a mailbox or…
Read guide →Safety · Jan 4, 2026
Storage Access API vs partitioned cookies for embeds is two answers to third-party cookie restrictions. Partitioned cookies (CHIPS) keep a SameSite=None cookie in a jar keyed by the top-level site, so site A and site B…
Read guide →Safety · Dec 18, 2025
SPF vs DKIM vs DMARC is a stack decision, not a pick-one DNS beauty contest. SPF lists which servers may send mail for the domain. DKIM signs messages so receivers can verify they were not altered in transit. DMARC…
Read guide →Safety · Dec 10, 2025
Speculation Rules vs dns-prefetch for marketing sites is how aggressively the browser prepares the next hop. dns-prefetch (and preconnect) resolve or warm a host. Speculation Rules (JSON in a script type or a…
Read guide →Safety · Nov 6, 2025
Set-Cookie Priority vs Max-Age is two different clocks on the same cookie, and only one is a web standard: Max-Age (or Expires) is how long the cookie should live, while Priority=High|Medium|Low is a Chromium eviction…
Read guide →