RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 4 of 20
Safety · Dec 18, 2025
SPF vs DKIM vs DMARC is a stack decision, not a pick-one DNS beauty contest. SPF lists which servers may send mail for the domain. DKIM signs messages so receivers can verify they were not altered in transit. DMARC…
Read guide →Safety · Dec 10, 2025
Speculation Rules vs dns-prefetch for marketing sites is how aggressively the browser prepares the next hop. dns-prefetch (and preconnect) resolve or warm a host. Speculation Rules (JSON in a script type or a…
Read guide →Vulnerabilities · Dec 1, 2025
Soft 404 vs hard 404 for sensitive paths is why status codes lie. A hard 404 (or 403/401) with a tiny generic body usually means the file is not there or is denied. A soft 404 is a 200 that returns your marketing HTML…
Read guide →Vulnerabilities · Nov 23, 2025
sitemap.xml vs robots.txt for hidden paths is an invitation versus a request. A sitemap is a list of URLs you want crawlers to fetch. robots.txt Disallow asks well-behaved bots not to crawl a prefix — it does not 403…
Read guide →News · Nov 14, 2025
Shared Storage API vs Topics API for marketing sites is two Privacy Sandbox ads channels. Topics lets participating sites observe coarse interest topics the browser computed. Shared Storage lets an origin write data…
Read guide →Safety · Nov 6, 2025
Set-Cookie Priority vs Max-Age is two different clocks on the same cookie, and only one is a web standard: Max-Age (or Expires) is how long the cookie should live, while Priority=High|Medium|Low is a Chromium eviction…
Read guide →News · Oct 28, 2025
Service workers vs Cache-Control for personalized pages is two caches. Cache-Control tells browsers and shared CDNs whether HTTP may store the response. A service worker sits in the page origin and can cacheRequest even…
Read guide →News · Oct 20, 2025
Server-Timing vs Server banners for stack fingerprints is two ways the origin writes its résumé into HTTP. Server and X-Powered-By are explicit product strings. Server-Timing is a performance header (metric name,…
Read guide →Vulnerabilities · Oct 11, 2025
Apache server-status vs phpinfo() on production is two operator pages that must not be world-readable. mod_status /server-status lists workers, vhosts, and request lines. phpinfo() lists the PHP runtime. nginx…
Read guide →News · Oct 3, 2025
Server banners vs stack fingerprinting is a disclosure choice, not a cloak of invisibility. A versioned Server or X-Powered-By header hands strangers a tech résumé with every response. Removing those banners at the…
Read guide →