RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 11 of 20
News · May 1, 2024
HTTP/2 vs HTTP/3 for public marketing sites is which application protocol the edge offers after TLS, not whether the URL is HTTPS. HTTP/2 (h2) multiplexes streams over TLS/TCP. HTTP/3 (h3) multiplexes over QUIC/UDP.…
Read guide →Vulnerabilities · Apr 23, 2024
HTTP TRACE vs least-privilege methods is a verb-surface choice. TRACE (and the old TRACK alias) should not be on the menu for a public origin. OPTIONS may advertise Allow or Access-Control-Allow-Methods; listing…
Read guide →News · Apr 14, 2024
HTTP 103 Early Hints vs Content-Security-Policy is a speed header versus an allowlist. 103 (RFC 8297) lets a CDN or origin send Link: rel=preload (and similar) while the document is still generating. That is not a…
Read guide →Vulnerabilities · Apr 6, 2024
.htaccess vs web.config on a public origin is Apache per-directory config versus IIS/ASP.NET config sitting in the document root. Both are meant for the server, not for browsers. If GET /.htaccess or /web.config returns…
Read guide →Safety · Mar 28, 2024
HSTS vs HTTPS redirects is not a contest with one winner. A redirect sends this visit to HTTPS. HTTP Strict-Transport-Security tells supporting browsers to remember HTTPS for a max-age, cutting off later cleartext first…
Read guide →Safety · Mar 20, 2024
HSTS preload vs includeSubDomains for public sites is a first-visit commitment versus a header bit on later visits. includeSubDomains tells a browser that already learned HSTS from this host to apply it to subdomains…
Read guide →Safety · Mar 11, 2024
HSTS max-age six months vs two years is how long supporting browsers remember to skip HTTP after they see Strict-Transport-Security on HTTPS: six months is 15552000 seconds — the bar RoastMyOpsec uses when it flags a…
Read guide →News · Mar 3, 2024
hreflang vs canonical on a single-language public site is an international-targeting decision versus a duplicate-URL decision: skip hreflang until you ship real language or region variants, and use canonical (plus 301s)…
Read guide →News · Feb 23, 2024
How to read an OPSEC score (1–10) on a public URL: start at the top of the scale and subtract for evidence-backed misses on that response — headers, TLS, cookies, exposed paths, client-side secrets, and the rest of the…
Read guide →Safety · Feb 15, 2024
__Host- vs __Secure- cookie prefixes is how you stop a weaker Set-Cookie from impersonating your session name. Browsers that honor prefixes refuse to store __Secure- unless Secure is set, and refuse __Host- unless…
Read guide →