What is a firewall? Types and how they workA plain explanation of firewalls — what they filter, the main types, and what they cannot protect.HTTP vs HTTPS: what's the difference?The practical differences between HTTP and HTTPS — security, performance, SEO — explained simply.How HTTPS works: the lock icon explainedWhat actually happens when you see the padlock? Encryption, certificates and why every website should use HTTPS.What is a proxy server and how does it work?A plain explanation of proxy servers — forward vs reverse, what they do, the headers they add, and what they cannot protect.What is a VPN and how does it work?A plain explanation of VPNs — encryption, tunneling, what they protect, and what they don't.JWT explained: what a JSON Web Token is and how it worksWhat a JSON Web Token is, how the header.payload.signature structure works, which claims and algorithms exist, and how to validate JWTs safely.TLS versions explained: from SSL 3.0 to TLS 1.3Every TLS version from SSL 3.0 to TLS 1.3 explained — what changed, what broke, and why old versions are now disabled by default.SSH explained: how Secure Shell worksSSH explained: what Secure Shell is, how the protocol works end to end, and why it replaced telnet and rsh.What is authentication? Passwords, biometrics, SSO, and modern methods explainedAuthentication is the process of verifying who you are. Learn how passwords, multi-factor authentication, biometrics, SSO, OAuth, and password managers work — and which methods offer the best protection for your application.What is CSRF (Cross-Site Request Forgery)? How it works and how to prevent itCross-Site Request Forgery (CSRF) tricks a logged-in browser into sending unwanted requests to a trusted site. This guide explains how the attack works and the defenses that stop it.What is SQL injection? How it works and how to prevent itSQL injection is one of the most common web vulnerabilities — this guide explains how it works, the main attack types, and the secure coding practices that prevent it.What is SSRF (Server-Side Request Forgery)? How it works and how to prevent itServer-Side Request Forgery (SSRF) lets an attacker abuse a server's own URL-fetching feature to reach internal systems and cloud metadata. This guide explains the attack and the defenses that stop it.What is XSS (Cross-Site Scripting)? How it works and how to prevent itCross-Site Scripting (XSS) lets an attacker run their own JavaScript in another user's browser. This guide explains how the three types work and the defenses that stop them.What is a Content Security Policy (CSP)? How CSP works and how to deploy itA Content Security Policy (CSP) is an HTTP security header that tells a browser which resources a page is allowed to load. Learn how CSP works, what directives are available, and how to deploy it without breaking your site.Open source licenses explained: MIT, Apache, and GPL comparedOpen source licenses decide how others can use, modify, and distribute your code. This guide explains permissive licenses (MIT, Apache 2.0), copyleft licenses (GPL, AGPL), and how to choose the right one for your project.What is CORS? Cross-Origin Resource Sharing explainedCross-Origin Resource Sharing (CORS) is the mechanism browsers use to allow or block requests between different origins. This guide explains how CORS works, why it exists, common errors, and how to fix them.How to Use Environment Variables in Node.js: process.env, .env files, and secure secretsEnvironment variables are the standard way to configure a Node.js app without hardcoding values. Node reads them through process.env, you can load them from .env files with the built-in --env-file flag or the dotenv package, and secrets should stay out of your code and version control. This guide walks through each approach and when to use it.What is HSTS (HTTP Strict Transport Security)? How it works and why it mattersHTTP Strict Transport Security (HSTS) is a web security policy that forces browsers to only use HTTPS. Learn how the Strict-Transport-Security header works, what it protects against, and how HSTS preload lists eliminate the SSL-stripping window.How to add JWT authentication to a Node.js API: a practical guideStep-by-step implementation of JWT authentication on a Node.js/Express API: password hashing, login endpoint, token verification middleware, refresh tokens, and the common security pitfalls.What is OAuth 2.0? How OAuth works and how to secure itOAuth 2.0 is an open standard for delegated authorization defined in RFC 6749. It lets a user (the resource owner) grant a third-party application (the client) limited access to resources on another server without sharing their password. This guide explains the four roles, the main grant types, the recommended authorization-code flow with PKCE, and the security best practices from RFC 9700.How to implement rate limiting in Node.js: algorithms and practical examplesRate limiting protects Node.js APIs from abuse and overload. This guide explains fixed window, sliding window, and token bucket algorithms, shows how to add rate limiting to an Express API, and how to test it.How to set up SSH key authentication (GitHub + Linux)Set up SSH key authentication for GitHub and Linux servers: generate Ed25519 keys, add to ssh-agent, copy public key, and test connection — step-by-step with open-license sources.How to use the Web Crypto API in the browser: hashing, signing, and encryptionThe Web Crypto API gives every browser a built-in cryptography engine. Learn how to hash data, sign and verify messages, and encrypt or decrypt content using SubtleCrypto — with practical code examples and security notes. 