VULNEXUSAI · BLOG

Content hub

Practical web security guides for developers and website owners.

Why your emails go to SPAM (and how to configure SPF, DKIM and DMARC)

Emails going to spam even though they're legitimate? The cause is almost always a misconfigured SPF, DKIM or DMARC. See ready-to-use DNS records and the mistakes that kill deliverability.

Published on September 01, 2026Read article

CORS error: how to fix it in Node.js and Nginx without using a wildcard

CORS error blocking your API in production? Learn how to configure Access-Control-Allow-Origin correctly in Express, Nginx and Next.js — without * and without breaking CDN caching.

Published on September 01, 2026Read article

robots.txt and security.txt: files every website should have

robots.txt guides crawlers on what to index; security.txt tells researchers how to report vulnerabilities. See how to create a good file of each.

Published on August 17, 2026Read article

TLS: which version to use and why you should disable TLS 1.0 and 1.1

TLS 1.2 and TLS 1.3 are the secure versions of the protocol. See how they compare, why TLS 1.0 and 1.1 are obsolete and how to configure your server.

Published on August 14, 2026Read article

CORS explained: what it is and how to configure it safely

CORS decides whether a website can access resources from another origin. Understand how it works, which configurations are dangerous (origin reflection, wildcard with credentials) and how to configure it.

Published on August 13, 2026Read article

What is HSTS and why your site needs it

HTTP Strict Transport Security (HSTS) forces browsers to use HTTPS only for your domain. Learn how it works, how to configure it and which mistakes to avoid.

Published on August 11, 2026Read article

Content Security Policy explained for developers

CSP tells the browser exactly what your site can load. See the key directives, how to use nonces and hashes, and how to roll it out without breaking anything.

Published on August 08, 2026Read article

SPF, DKIM and DMARC: the complete email authentication guide

SPF, DKIM and DMARC stop third parties from forging emails with your domain. Understand each mechanism, how to configure them in DNS and the common mistakes.

Published on August 05, 2026Read article

Secure cookies: Secure, HttpOnly and SameSite explained

The Secure, HttpOnly and SameSite attributes control how cookies are sent and accessed. See what each one does, how to configure them and common mistakes.

Published on August 02, 2026Read article

Why files like .env and .git end up exposed (and how to prevent it)

Exposed .env files, .git directories and backups leak passwords, keys and the whole source code of a site. Understand why it happens and how to block it.

Published on July 30, 2026Read article