Web Security Reference Guide
A free, comprehensive handbook organized in 7 layers of defense - from network infrastructure to application monitoring. Each layer builds on the one below, mirroring how real-world security works: defense in depth.
The 7-Layer Security Model
Security isn't a single product or setting - it's layers. Like the OSI network model, each layer addresses a specific attack surface. A weakness in any single layer can compromise everything above it.
Protect your domain infrastructure. Understand DNS resolution, uptime SLA math, and how silent outages happen.
Articles in this layer
Secure data in transit. Learn about TLS/SSL versions, certificate types, HSTS preloading, and mixed content risks.
Harden your server environment. VPS vs. managed hosting, web server hardening, WAF basics, and backup strategies.
Planned topics
- ○ VPS vs. Managed Hosting Security
- ○ Nginx & Apache Hardening
- ○ Web Application Firewalls (WAFs)
- ○ Backup & Disaster Recovery
Control browser behavior with response headers. Defend against XSS, clickjacking, and data leaks with CSP, X-Frame-Options, and CORP.
Secure your web applications and CMS. Harden WordPress, block user enumeration, scan outdated libraries, and manage redirects.
Optimize page speed and resource efficiency. Server-side caching (LiteSpeed, OPcache), CDN edge delivery, and Core Web Vitals budgets.
Planned topics
- ○ Why Caching Matters (PHP & Interpreted Languages)
- ○ LiteSpeed Cache & OPcache
- ○ CDN Edge Caching
- ○ Core Web Vitals Performance Budgets
Observe everything below. GDPR compliance through technical controls, outside-in scanning strategies, and alerting best practices.