Goran Štimac 
Security Headers and CSP in 2026: Practical Reset for Static Sites
W3C CSP3 is still a Working Draft, Reporting-Endpoints became baseline, and teams can enforce strict policies safely by collecting reports first.
Tag
#Security
23 matching blog articles with repeat coverage under this topic.
Tag wiki
#Security is a system protection practice used directly in these articles.
Definition
Security encompasses practices and technologies to protect systems and data from unauthorized access, attacks, and vulnerabilities.
Why it matters
It matters because security breaches have serious consequences including data loss, financial damage, and regulatory penalties.
In this archive
In this archive security shows up in HTTPS, authentication, authorization, vulnerability management, headers, and decisions about protecting systems and users. It currently appears in 23 articles and crosses 5 categories.
Nearest categories
Security & Privacy , Infrastructure & DevOps , Updates & Announcements , CMS & Content Systems
Reference
Often appears with
YouTube Video Spotlight: OWASP Top 10:2025 — What Changed and Why It Matters
A practical commentary on the OWASP Foundation's 45-minute Top 10:2025 announcement and what its updated risks mean for web teams.
Infrastructure Secrets Management Without Complexity
A practical, low-drama approach to infrastructure secrets: keep credentials out of Git, use least privilege, rotate deliberately, and introduce Vault when the operational need is real.
Supply Chain Security: Software Bill of Materials in Practice
CISA refreshed the SBOM baseline in July 2026, while the EU Cyber Resilience Act makes machine-readable software inventories a practical roadmap item for teams building or buying digital products.
Vulnerability Management for Small Ops Teams in 2026
The 2026 vulnerability-management reset: NVD now triages CVEs by risk, CISA's KEV list is the priority signal, and small ops teams can patch what matters in days instead of drowning in CVSS scores.
eBPF Beyond Observability: Networking, Security, and Scheduling
While eBPF is often synonymous with observability, its capabilities extend deeply into Linux kernel networking, security, and scheduling optimizations.
DNS Security: DNSSEC, CAA Records, and DDoS Protection
DNSSEC authenticates DNS data, CAA records constrain certificate issuance, and layered DDoS protection keeps DNS and applications available — plus the 11 October 2026 root KSK rollover deadline every resolver operator should check.
Zero Trust Networking for Small and Medium Teams: A Practical 2026 Update
Zero trust is now practical for small teams. NIST and NSA published phased 2025–2026 guidance; the on-ramp is MFA, identity-based access, and WireGuard as transport.
YouTube Video Spotlight: DevSecOps Course for Beginners – API Security
A two-hour freeCodeCamp course on DevSecOps and API security, and why baking security into every stage of delivery matters more than a final security gate for modern engineering teams.
Linux Security Hardening: Beyond the Basics
Beyond updates and strong passwords: least privilege, service minimization, firewalling, auditing, and AppArmor — the practical hardening layers that protect a Linux server.
Post-Quantum Cryptography Migration: A Practical Guide
A practical guide to migrating from classical to post-quantum cryptography: NIST-standardized algorithms, hybrid TLS key exchange deployment, OpenSSL/oqs-provider configuration, the White House 2030 deadline, and a phased migration strategy rooted in crypto-agility.
Cloudflare Precursor: One-Click Behavioral Defense When 57% of Web Traffic Is Bots
Cloudflare launches Precursor — a one-click continuous behavioral validation engine that replaces CAPTCHAs with real-time session-wide analysis. 57% of web traffic is now automated.
WordPress in 2026: When It Still Makes Sense
WordPress still matters in 2026, but only when it is treated as a managed publishing system with clear workflows, security discipline, and automation.
The Rise of Pure Data-Theft Extortion: Why Encryption Is No Longer the Point
June 2026 marked a shift from ransomware to pure data-theft extortion. Breaches at One Medical, NAIC, and Novo Nordisk show that encryption is no longer the weapon — data exfiltration is.
The agentic edge: why Cloudflare’s 2026 updates matter for AI apps and content sites
Cloudflare’s 2026 announcements show the edge becoming a runtime for agent workflows, with more focus on isolation, speed, and safer automation.
Apple Expands Private Cloud Compute to Google Cloud — A New Standard for Confidential Computing
Apple extends Private Cloud Compute to Google Cloud with NVIDIA GPUs, using three-layer hardware trust and a verifiable transparency ledger. A new benchmark for confidential computing at hyperscale.
How to Balance Security, Authoring, and Frontend Speed with Magnolia and Alpine.js
Magnolia and Alpine.js can complement each other when a team needs strong governance and compliance on the CMS side while keeping the frontend interaction layer intentionally small.
How Ubuntu 26.04 Is Fixing AI Development
Ubuntu 26.04 LTS improves the security, container, and retrieval layers that AI teams keep fighting during development and deployment.
How to Run Security and Accessibility Reviews With OWASP ZAP, WAVE, and SSL Labs
OWASP ZAP, WAVE, and SSL Labs cover different risk layers, and together they give a more realistic review of a website.
OpenClaw Security Checklist for Personal and Team Use
A practical security checklist for OpenClaw deployments, including allowlists, sandboxing, reverse proxies, secrets, and trust boundaries.
How To Add HTTP Security Headers in WordPress
Learn which HTTP security headers strengthen a WordPress site and how they help reduce common browser-side risks without relying on plugin bloat.
4 Ways to Mitigate Pass-the-Cookie Attacks
Pass-the-cookie attacks let attackers reuse stolen session cookies. These four defenses help reduce that risk in cloud and web environments.
Enable MFA Before an Attacker Locks You Out
Enable multi-factor authentication before an attacker does. MFA makes account takeovers harder and recovery far less painful.