📊 Data & stats
2026-04-29 · 6 min · data
The web's most popular sites, scored. Average grade is C. Apple's Chinese mirror beats Stripe. Instagram and Baidu are at 20/100.
2026-04-29 · 8 min · data
Real numbers from our production database. Reputation listings + TLS 1.0 dominate. Each one explained with the fix.
2026-04-29 · 8 min · tutorial
Vanilla nginx on Debian 13, point UnveilScan at it. Score 54/D. Here's the fix-everything snippet that gets to 91/A in 5 minutes.
🔒 TLS & PKI
2026-04-29 · 6 min · TLS
Two openssl probes prove it. So does Cloudflare. Here's why the world's biggest CDNs still negotiate deprecated protocols.
2026-04-29 · 5 min · PKI
Mid-2025 LE shut down their OCSP responder. ssl_stapling on; on a fresh LE cert is now a silent no-op.
2026-04-29 · 5 min · DNS
A two-line DNS record that tells the world's CAs which one is allowed to issue certs for you. Cheap, simple, real protection.
2026-04-29 · 5 min · PKI
CA/B Forum voted, Apple and Google sponsored. By 2029, every public cert renews every 6 weeks. Here's the playbook.
2026-04-29 · 6 min · PKI
Every TLS cert ever issued for your domain is logged publicly. Attackers query crt.sh. Here's how to read your own logs.
✉ Email security
2026-04-29 · 6 min · DMARC
You set up DMARC, SPF and DKIM. You think you're done. Then a phishing campaign sails through anyway because adkim=r.
2026-04-29 · 6 min · SPF
RFC 7208 §4.6.4 caps SPF at 10 DNS queries. Cross it and your record permerrors silently. Here's how to count and flatten.
2026-04-29 · 6 min · DKIM
Industry guidance says rotate every 6 months. Modal age in our database: 4-7 years. Here's the dual-selector dance.
2026-04-29 · 5 min · MTA-STS
DMARC stops spoofing of From. MTA-STS stops downgrade attacks on the SMTP transport itself. ~3% of domains deploy it.
📜 Web security
2026-04-29 · 8 min · CSP
CSP looks like a wall of directives. Underneath there are exactly seven things that matter. Real examples from production.
2026-04-29 · 6 min · Spring
Spring Boot's actuator endpoints expose JVM heap, env vars, request logs to anyone. Two CRITICAL findings in our DB came from /actuator/heapdump.
2026-04-29 · 5 min · build
A .map file alongside your bundle.min.js gives anyone with browser dev tools your unminified source. Webpack/Vite default to this.
2026-04-29 · 5 min · SRI
The integrity attribute that protects you from compromised CDNs. Useful when, theatre when. Practical guide.
2026-04-29 · 5 min · cookies
Three flags should be on every auth cookie. Plus the __Host- prefix. Audit + fixes for nginx, Apache, Express, Django.
⚠ Attack surface
2026-04-29 · 7 min · DNS
Forgotten blog.example.com still points to a dead Heroku app. An attacker registers the freed slug and serves whatever they want.
2026-04-29 · 7 min · DNS
You put your site behind Cloudflare. Meanwhile mail.yourdomain.com still resolves to your real OVH IP, and your SPF lists it.
2026-04-29 · 6 min · brand
The 6 mutation strategies attackers use to register your domain typo'd. Detection, response, prevention.
2026-04-29 · 5 min · reputation
A curated list of ASNs that abuse researchers consistently flag as bulletproof. Sources, criteria, sanctioned countries.
🛡 Compliance
2026-04-29 · 5 min · compliance
A domain that gets A+ on SSL Labs can drop to D on UnveilScan. Same handshake, same cert. Different yardstick.
2026-04-29 · 6 min · compliance
The engineer's-eye summary of relevant PCI-DSS 4.0 deltas for web and email. TLS 1.2+, MFA enforced, CSP on payment pages.
2026-04-29 · 5 min · ANSSI
The French national cybersecurity agency's TLS recommendations, distilled for engineers. R1 through R20+ that matter.
2026-04-29 · 6 min · NIS-2
The EU NIS 2 directive expands cybersecurity obligations to medium and large entities across 18 sectors. Are you in scope?
🛠 Operations
2026-04-29 · 6 min · scoring
Weights (DNS 20 / TLS 30 / WEB 30 / EMAIL 20), severity penalties (5/15/30/60), what we ignore on purpose.
2026-04-29 · 9 min · walkthrough
A real production domain, every finding fixed live. Score 64 → 92 in two hours. Each fix is a copy-paste snippet.
2026-04-29 · 6 min · CI
unveilscan-cli + GitHub Action that blocks a PR if it introduces new HIGH+ findings. 5 minutes to set up.
2026-04-29 · 5 min · reporting
11 columns, structured, paste-into-spreadsheet ready. Mapping severity to priority, compliance, monthly trend tracking.
