Practical security guides and checklists
Start with the task in front of you. Finished guides come first, and anything still in progress says so.
Website baseline
Start here to review one website and keep the evidence.
-
Explore the baseline →
Website Security Baseline
See what the baseline covers, what it produces and what it does not do.
-
Use the checklist →
25-point checklist
Work through DNS, Cloudflare, security headers, WordPress and recovery on one site.
-
See the sample report →
Sample Baseline Report
See how findings, priorities, evidence and next actions can be laid out.
DNS recovery and backup
Prepare for a bad change before you need to undo one.
-
Review recovery →
DNS recovery checklist
Review ownership, backup coverage, off-platform storage and recovery preparation for DNS you manage.
-
Read setup →
Cloudflare DNS Backup
Keep dated DNS exports outside the source account and verify what they contain.
-
Read the article →
Cloudflare DNS Backup article
Read how a dated Cloudflare DNS export works and what to check afterwards.
-
Read setup →
GitHub Backup
Snapshot the repositories an account owns into a dated, checksummed archive outside GitHub.
Client sites
Repeat the same review across the sites you are responsible for.
-
See the agency workflow →
Agency baseline workflow
Run the same scope across client sites and hand over something the client can follow.
Investigation
A task-first guide for passive checks.
-
Open triage guide →
Passive Cyber OSINT Triage
Work through passive domain, URL and exposure questions using public sources.
AI agent security
Early material. Check the status on each item.
-
Preview the scope →
AI Agent Prompt Security checklistIn progress
See what the checklist will cover while it is being finished.
-
Browse prompt examples →
AI Agent System Prompts
Read ten example system prompts with guardrails and human sign-off rules.
Blog and news
News and archive content, kept apart from the task-focused guides.
-
Open the blog →
Blog
Written posts, including older lab notes.
-
Browse the archive →
Daily Security News
An automatically compiled digest of security headlines, filterable by vendor and severity.
-
Read the briefing →
Weekly Security Briefing
The last seven days of security news in one place.