Security Headers
Mixed content: the HTTPS padlock that is lying to your users
Your page loads over HTTPS, the padlock shows, everything looks secure. Then one script loads over plain HTTP — and the secure channel you paid for has a hole in it.
Tag
#https
Concepts
HTTPS vs. SSL vs. TLS: the terms, untangled
People say SSL, TLS and HTTPS as if they are the same thing. They are related but distinct — and one of them has been retired for years. Here is the clean version.
TLS/SSL
TLS 1.0 and 1.1 are dead: why your old protocols are a liability
TLS 1.0 and 1.1 were retired years ago, but plenty of hosts still accept them. Leaving them on is a quiet liability — here is what to support instead.
TLS/SSL
Is my SSL/TLS actually secure? A plain-English checklist
The padlock only means encrypted, not strong. Real TLS security depends on three things: which protocols you accept, which ciphers you offer, and your certificate's health.
Security Headers
HSTS explained: why HTTPS alone is not enough
You have HTTPS — but the first plain-HTTP request is still a weak point. HSTS closes it by telling the browser to never speak HTTP to your site again.