Hardening

What this book is

Seven real configs, compared against each other

Writing a security header is a five-minute lookup. Knowing that seven real, independently deployed web properties disagree with each other about which headers exist at all is a different problem entirely — and it's the one this book is built around, checked directly against seven real configuration files rather than assumed from best-practice advice.

Of seven real properties reviewed, only one had a complete baseline security-header set already in place. Four others had none at all. A second real inconsistency sits between two sibling directories on the same site — one using a modern access-denial rule with a fallback for older server versions, the other using only the older syntax, which a server upgrade could silently stop honoring without anyone noticing. A third property demonstrates a real, specific technique worth teaching on its own: clearing a header before resetting it, rather than trusting a single assignment to win outright. A fourth comparison finds three genuinely different privacy-header values across three properties, never reconciled against each other, and one property using a meaningfully stricter framing policy than every other property reviewed — real differences in security posture that had simply never been compared side by side.

This book is as honest about what it did as about what it found: every gap it documents was real when found, and has since been fixed locally, not left open — the fixes and the findings are stated as two different, both-true claims, never blurred into one. None of it was deployed to a live server as part of writing this book, and the book says so plainly.

What you’ll learn

Seven chapters, from the missing baseline to the full comparison

• one-baseline-four-properties-missing-it — Five headers that cost nothing to serve and close real classes of attack. One property had all five. Four had none.
• two-ways-to-deny-a-directory — Two sibling directories on the same site, one using a modern access-denial rule with a fallback, the other quietly relying on syntax a server upgrade could stop honoring.
• unsetting-a-header-before-resetting-it — A real, specific technique for clearing a header before resetting it, rather than trusting a single assignment to win outright.
• fixing-the-gap-versus-writing-about-it — What actually got fixed as part of this research, what didn't reach a live server, and why the book states that distinction plainly every time it matters.
• one-property-one-header-four-gaps — The one header that wasn't extended everywhere during the fix, and the real reason a blanket copy-paste wasn't the right call for it.
• running-the-comparison — Three genuine, previously-unreconciled differences a deliberate comparison pass across several real configuration files actually surfaces.
• conclusion — This layer placed next to the four adjacent ones this series already covers — authentication, input validation, CORS and rate limiting, and credential handling.

From the book

A preview

Five headers, added to a web server's configuration, cost nothing to serve and close real, well-understood classes of attack. One real property in this audit already had all five. Checking the rest, independently, directly, one file at a time, found four more real properties with none of them.

Who it’s for

Anyone running more than one real web property

This is for anyone running more than one real web property who assumes a security baseline stays consistent without being checked — the actual discipline this book teaches is the comparison itself: diffing header sets across real deployments, telling an intentional choice apart from an unreconciled gap, and catching a claim about your own infrastructure before it goes to print.

A longer excerpt is available to newsletter subscribers.

Buy Ebook on Amazon