Website problems

An endpoint returning records to an anonymous request is public by configuration. How these appear, why an empty list is not access control, and how to close one.

A failure returning a trace, a database error or a debug page hands a reader your framework, file layout and often your schema. What to return instead.

A response about one person sent with a directive a shared cache may store will be re-served to the next caller. How the directive gets there and what to send instead.

Allowing any origin while also allowing credentials is refused by every browser. The call fails regardless of intent, and the pairing signals a guessed configuration.

A served wp-config file, backup copy or debug log publishes database credentials and authentication salts. Removal is the first step and rotation is the fix.

A PHP version past its security support window stops receiving fixes entirely. Why the deadline is absolute, and how to upgrade without breaking a site.

A cookie without Secure is sent over plain HTTP, where anyone on the path can read it. Why HTTPS alone does not protect it, and what HttpOnly adds.

SameSite decides whether a cookie is attached to requests from other sites. What each value does, what browsers default to now, and why None requires Secure.

A cookie set on the registrable domain is transmitted to every subdomain, including ones running software you do not control.

A measurement cookie with a multi-year expiry keeps identifying a visitor far beyond anything they agreed to. How lifetimes are set and which ones to shorten.

When the nameservers listed at the registry differ from the ones the zone publishes, changes take effect for some resolvers and not others — indefinitely.

A CNAME at a name where other record types exist makes those records unreachable. At the domain apex this is how pointing a website at a host stops the email.

An expired domain takes the website, the email and every service authenticated against it. The renewal failures that recur, and what to check beyond the date.

SPF evaluation stops after ten DNS lookups and returns a permanent error. Why includes are recursive, how to count them, and the three ways to get back under the limit.

A DMARC policy of none collects reports and blocks nothing. What alignment adds over SPF and DKIM, and how to reach enforcement without rejecting your own invoices.

DKIM signs a message so its origin can be verified after it has been relayed. Why SPF alone leaves a gap, how selectors work, and what makes a key adequate.

A domain with no SPF record gives receivers nothing to check a sending server against. What that costs, what to publish, and how to build the record safely.

Publishing more than one SPF record is a permanent error under the specification. Receivers treat the domain as unauthenticated. How it happens and how to merge them.

An SPF record ending in a neutral or pass-all qualifier parses correctly and authorises everyone. What each ending means and which one to publish.

A DMARC record with a syntax error, or duplicated at the same name, is ignored entirely. The domain is unprotected while appearing configured.

A DMARC percentage below full coverage leaves the rest of your mail unprotected. Why the tag exists, why it is so often left behind, and how to finish.

An MX record naming a host that no longer resolves loses incoming mail silently. The bounce happens at the sender's end, so the domain owner never sees it.

Many receivers reject or downgrade mail from an address with no PTR record. Why it is checked, who controls it, and what a correct configuration looks like.

An MTA-STS DNS record with no fetchable policy file provides no protection. Why both halves are required and why the web server's certificate decides it.

A banner that appears after the trackers have loaded consents to nothing. Which cookies are exempt, what a valid banner requires, and how to verify the gate actually works.

The same measurement tag installed through two routes counts every event twice. Revenue, conversions and cost figures all move by a factor of two.