With a constantly increasing traffic load to contend with, report-uri.io needs some support. Fortunately for us some help came from Imperva Incapsula who are now protecting report-uri.io with a free account on their DDoS mitigation and WAF platform. It's not just about security and availability though, there are…
CAA is a new mechanism that will allow site owners to specify which Certificate Authorities are authorised to issue certificates for their domain name. It's a simple DNS record so setup is a breeze and SSL Labs is now checking for it, so it's time to do it! Why we…
I've been running crawls of the Alexa Top 1 Million and publishing results every 6 months for the last 2 years. As promised I'm now opening up my daily crawl data to the wider community to see what awesome things you can do with it. The crawls I announced in…
With the October 2017 deadline approaching for compliance with Chrome's Certificate Transparency policy, sites can use the new Expect-CT header to determine if they're ready. It's easy to deploy and has a "report-only" mode so there's no risk involved. Here are the details. Certificate Transparency CT has been around for…
Up until now we've had to rely on GET parameters to identify whether CSP reports were enforced or sent as part of a report-only policy. This added friction for the host and on report-uri.io I've seen a lot of problems caused by this. Things are set to change. Sending…
