The Curious Engineer

All blogs / Security

Scott Helme

scotthelme.co.uk

Hi, I'm Scott Helme, a Security Researcher, Entrepreneur and International Speaker. I'm the creator of Report URI and Security Headers, and I deliver world renowned training on Hacking and Encryption.

SecurityWeb developmentPHP

’15’20’25
Posts
465 from 30 Nov 2013 to 20 Oct 2026
Posting
weekly (39 in the last year)
Kind
personal blog
Feed
https://scotthelme.co.uk/rss/

2026 36

  1. Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
  2. Passkeys Are Not a Trap
  3. The First Reduction in Their History: 64-Day Let's Encrypt Certificates
  4. No Hacking Required: The Manchester Airports Group Data Breach
  5. The ultimate road trip combo: Starlink Mini + UniFi Travel Router
  6. Introducing dbsc.dev: Does Your Browser Support DBSC?
  7. Device Bound Session Credentials lands in Chrome on macOS
  8. Everything I Learned Shipping Device Bound Session Credentials
  9. Connection Allowlist: a network firewall, built into the browser
  10. Top 1 Million Analysis – June 2026: The State of Crypto
  11. Top 1 Million Analysis – June 2026: Ten Years of Web Security
  12. A dead CDN, a wildcard, and an attack waiting to happen: the netdna-ssl.com takeover
  13. Why No Passkeys? Naming the Top Sites That Still Don't Support Them
  14. The Instructure Canvas Breach (2026): How XSS in a Support Ticket Compromised 275 Million Students
  15. Open-Sourcing dbsc-php: a Server Library for Device Bound Session Credentials in PHP
  16. DBSC Beta at Report URI
  17. Device Bound Session Credentials: Making Stolen Cookies Useless
  18. Passkeys, Permissions Policy and Bug Hunting in 1Password's WebAuthn Wrapper
  19. Open-Sourcing passkeys-php: A Security-Focused WebAuthn Library for PHP
  20. XSS Is Deadly for Passkeys: The Hidden Risk of Attestation None
  21. Passkeys 101: An Introduction to Passkeys and How They Work
  22. Anatomy of a WooCommerce Skimmer: A Technical Deep-Dive
  23. Under Attack: Responding to the Rise of Info-Stealer Threats
  24. Security considerations when using Passkeys on your website
  25. Fighting an active Magecart Campaign
  26. Amazing Refresh — A Malicious Chrome Extension Running Malware in the Browser
  27. Bringing in the experts; Having our Passkeys implementation Security Tested
  28. Launching Passkeys support on Report URI! 🗝️
  29. When “One in a Billion” Happens Every Day: Scaling Redis at Report URI
  30. Leverage our treasure trove of Threat Intelligence data
  31. XSS Ranked #1 Top Threat of 2025 by MITRE and CISA
  32. DNS-PERSIST-01; Handling Domain Control Validation in a short-lived certificate World
  33. The European Space Agency got hacked, and now we own the domain used!
  34. Eating Our Own Dogfood: What Running Report URI on Report URI Taught Us
  35. Blink and you'll miss them: 6-day certificates are here!
  36. What a Year of Solar and Batteries Really Saved Us in 2025

2025 17

  1. Report URI Penetration Test 2025
  2. Report URI - outage update
  3. Integrity Policy - Monitoring and Enforcing the use of SRI
  4. CVE-2025-49844 - The Redis CVSS 10.0 vulnerability and how we responded
  5. Capture JavaScript Integrity Metadata using CSP!
  6. We're going High Availability with Redis Sentinel!
  7. Automation improvements after a Tesla Powerwall outage!
  8. OWASP ASVS 5.0.0 is here!
  9. Trillion with a T: Surpassing 2 Trillion Events Processed!🚀🚀
  10. V2: Hacking my Tesla Powerwalls to be the ultimate home energy solution!
  11. Shorter certificates are coming!
  12. Hacking my Tesla Powerwalls to be the ultimate home energy solution!
  13. PCI DSS FAQ SAQ WTF BBQ...
  14. Report URI: Launching Policy Watch and other improvements!
  15. Let's Encrypt to offer 6-day certificates!
  16. Updating to Pi-hole v6 and enabling HTTPS!
  17. Stronger Than Ever: How We Turned a DDoS Attack Into a Lesson in Resilience

2024 11

  1. Let's Encrypt to end OCSP support in 2025
  2. XSS Ranked #1 Top Threat of 2024 by MITRE and CISA
  3. Report URI Penetration Test 2024
  4. Report URI: Simplifying pricing and changes to free accounts
  5. Are shorter certificates finally coming?!
  6. iOS 18 Quick Tips; Security Edition
  7. Introducing Frame Watch: Monitor payment page activity with ease!
  8. I'm a Microsoft MVP again!
  9. PCI DSS 4.0.1; What's Changed?
  10. Warning users of the Polyfill[.]io supply chain attack!
  11. PCI DSS 4.0; Certificate Transparency Monitoring is mandatory!

2023 20

  1. Google update their Minimum Viable Secure Product
  2. Report URI Penetration Test 2023
  3. Report URI: A week in numbers! (2023 edition)
  4. A Balanced Approach: New Security Headers Grading Criteria
  5. What the QWAC?!
  6. Holiday fun with my UniFi G4 Doorbell Pro!
  7. Sockets - Under The Hood: Understanding Truncated Request Behaviour
  8. Processing Truncated Requests? A PHP Debugging Deep Dive
  9. Unravelling The Mystery Of Truncated POST Requests On Report URI
  10. Do breached sites take security seriously?
  11. Celebrating 250,000,000 scans on Security Headers! 🥳🎉
  12. Cryptographic Agility Part 1: Server Certificates
  13. Security Headers is joining Probely! 🎉
  14. Overriding HTTP Response Headers in Chrome Dev Tools
  15. Goodbye, old friend 👋🔒
  16. Report URI to partner with PCI Security Standards Council
  17. 5 Years On: What did we learn from the Government Cryptojacking Attack?
  18. Boosting password security! Pwned Passwords, zxcvbn, and more!
  19. Strengthening security on my Apple account!
  20. Announcing the new Security Headers API, New Features and Upgrades!

2022 18

  1. Report URI Penetration Test 2022
  2. The M140i project post - Part 17
  3. New pricing for Report URI
  4. Expanding the Threat Intelligence capabilities on Report URI
  5. Report URI has a new look!
  6. Implementing all the Stripe things for Report URI
  7. I'm now a Microsoft Most Valuable Professional!!
  8. Another free CA to use via ACME!
  9. The first ever issue with my Pi-hole, and I don't know what happened...
  10. Report URI: Major new features, Threat Intelligence and more!
  11. The M140i project post - Part 16
  12. Top 1 Million Analysis - June 2022
  13. Increasing entropy in our CSP nonces
  14. PCI DSS 4.0; It's time to get serious on Magecart
  15. Re-bloom! Pwned Passwords v8
  16. Can you get pwned with CSS?
  17. Projects I Support
  18. If it looks like a duck, swims like a duck, and QWACs like a duck, then it's probably an EV Certificate

2021 33

  1. Responding to the Log4j 2 vulnerability (CVE-2021-44228)
  2. Top 1 Million Analysis - November 2021
  3. Frequency analysis on hundreds of billions of reports at Report URI: Top-K
  4. Report URI is now using CSP nonces in an enforced policy
  5. Report URI Penetration Test 2021
  6. Sketchy Pwned Passwords
  7. Frequency analysis on hundreds of billions of reports at Report URI: Count-Min Sketch
  8. When Pwned Passwords Bloom!
  9. Frequency analysis on hundreds of billions of reports at Report URI: Bloom Filters
  10. Working around expired Root Certificates
  11. Let's Encrypt Root Expiration - Post-Mortem
  12. Let's Encrypt's Root Certificate is expiring!
  13. The M140i project post - Part 15
  14. The danger of open redirects!
  15. Creating a Home Alarm System with Home Assistant
  16. Setting up HTTPS for Home Assistant
  17. I turned on CSP and all I got was this crappy lawsuit!
  18. Here's another free CA as an alternative to Let's Encrypt!
  19. Setting up HTTPS on the UniFi Protect NVR
  20. Introducing Data Watch: Detect Magecart style attacks, fast!
  21. Magecart are still going strong, join us and fight back!
  22. Introducing Script Watch: Detect Magecart style attacks, fast!
  23. Securing my house with Ubiquiti's UniFi Protect range
  24. What the FLoC?!
  25. Transparency about Data Protection at Report URI
  26. Enabling COOP and COEP reports on Report URI
  27. The M140i project post - Part 14
  28. Supercharging your DNS with Cloudflare for Teams!
  29. Catching and dealing with naughty devices on my home network - V2
  30. Setting up a quick and easy status page with Cloudflare Workers!
  31. The M140i project post - Part 13
  32. COEP COOP CORP CORS CORB - CRAP that's a lot of new stuff!
  33. Running my own DoH relay and getting Pi-hole protection away from home!

2020 16

  1. Report URI Penetration Test
  2. The M140i project post - Part 12
  3. Introducing another free CA as an alternative to Let's Encrypt
  4. The M140i project post - Part 11
  5. The M140i project post - Part 10
  6. The M140i project post - Part 9
  7. The M140i project post - Part 8
  8. The M140i project post - Part 7
  9. Setting up HTTPS on the UDM Pro
  10. The M140i project post - Part 6
  11. The M140i project post - Part 5
  12. The M140i project post - Part 4
  13. The M140i project post - Part 3
  14. The M140i project post - Part 2
  15. The M140i project post - Part 1
  16. CRLite: Finally a fix for broken revocation?

2019 2

  1. The Hack Yourself First UK Tour now has Hotel Packages
  2. Having a backup CA for Let's Encrypt

2018 1

  1. Say hello to security.txt

2017 2

  1. Certificate Transparency, an introduction
  2. Tough Cookies

2016 4

  1. Brotli Compression
  2. Still think you don't need HTTPS?
  3. The vulnerable web API for my Nissan Leaf
  4. Security headers in the Alexa Top 1 Million

2015 2

  1. Fixing mixed content with CSP
  2. Hardening the CSP on report-uri.io

2014 2

  1. Content Security Policy - An Introduction
  2. EE BrightBox router patched - still vulnerable

2013 1

  1. HSTS - The missing link in Transport Layer Security

Undated 300

  1. Firefox https only mode
  2. Deja vu macos hits ocsp hurdles
  3. Lets encrypts new root and intermediate certificates
  4. The final symantec distrust is coming
  5. Lets encrypt postpone isrg root transition
  6. Goodbye feature policy and hello permissions policy
  7. Top 1 million analysis march 2020
  8. Building certificate chains
  9. Hot tub wifi machine
  10. Cross signing alternate trust paths how they work
  11. Complexities chain building ca infrastructure
  12. Impending doom root ca expiring legacy clients
  13. Launching a brand new theme
  14. Running dodgy programs safely with windows sandbox
  15. Boosting my pc performance whilst working from home
  16. My ubiquiti home network v2
  17. Upgrading my crawler to do http 2 0 tlsv1 3 and other cool stuff
  18. Setting up https on the unifi cloudkey
  19. Launching smtp tls reporting
  20. Stabilising failover detection on the usg
  21. Building my work from home setup
  22. Announcing our partnership with joomla as official reporting partner
  23. Im looking for sponsors for my blog and security headers
  24. Securing your home network for wfh
  25. Deprecating xss reports
  26. Pumping up your internet speeds
  27. Revocation checking is pointless
  28. Lets encrypt to revoke
  29. Certificate lifetime capped to 1 year from sep 2020
  30. Supporting other projects in the community
  31. Improving email security with mta sts
  32. Legacy tls is on the way out
  33. Hpkp is no more
  34. Big https changes coming in chrome
  35. Top 1 million analysis september 2019
  36. Csp nonces the easy way with cloudflare workers
  37. Extended validation not so extended
  38. Ballot sc22 reduce certificate lifetimes
  39. Announcing ct monitoring for report uri
  40. Csrf is really dead
  41. Gone for ever
  42. Thinking more about bots and whether we do enough
  43. Security headers updates
  44. Maintaining state in a cloudflare worker with the http cache
  45. Deprecating tlsv1 0 and tlsv1 1 with cloudflare workers
  46. Lets encrypt to transition to isrg root
  47. Nomx the worlds most secure communications protocol
  48. Hack yourself first uk tour
  49. Alexa top 1 million analysis february 2019
  50. Creating a twitter follower count display
  51. Alexa top 1 million analysis august 2018
  52. Overclocking my my to extend its life
  53. Getting cyber essentials
  54. Hardening payment forms with csp
  55. Network error logging deep dive
  56. Dmarc reporting is here
  57. Year in review 2019
  58. We dont do https for backwards compatibility
  59. Fishing for certs
  60. Dealing with account recovery and 2fa
  61. A new security header clear site data
  62. Unleashing the power of cloudflare workers
  63. Building a gps tracker for my car
  64. Using ghostpro and taking control of your cloudflare settings
  65. Edge to remove xss auditor
  66. Going async with azure and the php sdk for massive performance
  67. Changes to free accounts on report uri
  68. Introducing the reporting api nel other major changes to report uri
  69. Upgrading my pc with a tpm
  70. Urls are hard
  71. Security and convenience with biometrics and windows hello
  72. Alexa top 1 million additional analysis
  73. Sites that used to have ev
  74. Hacking chrome to look more awesome
  75. Chrome to the future
  76. Launching crawler ninja
  77. Im branching out and learning how to do marketing
  78. Hacking iot cameras
  79. Xss on etherscan io
  80. One small step browser one giant leap web security
  81. How the eu made our website slow
  82. A new security header feature policy
  83. Report uri proxy
  84. Fast scaling with digitalocean
  85. Delivering hack yourself first and finding real issues whilst training
  86. Alexa top 1 million analysis february 2018
  87. Report uri a week in numbers
  88. Hsts preloading
  89. Lets encrypt is only a click away
  90. Our journey to a https only world
  91. Finding phishing sites with ct
  92. Https anti vaxxers
  93. European security blogger award most educational blog
  94. Report uri is the best emerging technology 2018
  95. Managing servers with ansible
  96. When logging causes security incidents what we learned from github and twitter
  97. Ct is coming
  98. Coinhive need to tidy up their act
  99. Adding expect ct and expect staple entries to the hsts preload list
  100. Csrf is dead
  101. The power to revoke lies with the ca
  102. You can now sponsor scotthelme co uk
  103. Catching naughty devices on my home network
  104. Cloudflare workers report uri
  105. Security headers is changing domain and branding
  106. Securing dns across all of my devices with pihole dns over https 1 1 1 1
  107. Report uri csp wizard
  108. Introducing xss reporting to report uri
  109. Security headers cloudflare worker
  110. Debunking the fallacy that paid certificates are better than free certificates and other related nonsense
  111. When crawlers are hungry for porn
  112. Do ssl warranties protect you as much as rocks keep tigers away
  113. Why we need to do more to reduce certificate lifetimes
  114. Seasonal variations in ev efficiency
  115. Are you ready for the symantec distrust
  116. Protect site from cryptojacking csp sri
  117. Year in review 2016
  118. Hacking table storage to do order by on timestamp
  119. Launching report uri js
  120. Https deployment tips
  121. Optimising twitters csp header
  122. We need more phishing sites on https
  123. Hacking table storage like queries
  124. How we turned average joe into psychic joe
  125. Powerful filtering and other updates for report uri
  126. Designing a new security header expect staple
  127. Year in review 2017
  128. Overcoming the hurdles of vat and vat moss in the eu
  129. Ee brightbox router hacked
  130. Bypassing hsts or hpkp in chrome is a badidea
  131. Malware hunting with csp
  132. Tracking caa usage
  133. Mitigating http get dos attack
  134. Getting an a on the qualys ssl test windows edition
  135. Are ev certificates worth the paper theyre written on
  136. Report uri journey to a permanent redirect
  137. Wifi pineapple setup
  138. Adding security headers to prism js
  139. The next steps for report uri io
  140. The death knell for hpkp
  141. Sarahah
  142. A new security header expect ct
  143. Security expose match com
  144. You can now support me on patreon
  145. New grading on securityheaders io
  146. Hardening your http response headers
  147. Moving to ghost pro
  148. Alexa top 1 million analysis aug 2017
  149. Im giving up on hpkp
  150. My week in vegas
  151. What happens in vegas
  152. Fear and coding in las vegas
  153. Wifi insecurity wps
  154. Vpn security privacy online
  155. Windows xp end of support
  156. Wifi pineapple mark v introduction setup
  157. Linkedin intro
  158. Wifi insecurity wifi map
  159. The adobe hack
  160. Manually enforcing hsts chrome
  161. Issuing hsts policy in php
  162. Web security rightmove zoopla
  163. Hsts polish dns hijacking attack
  164. Tls conundrum and leaving cloudflare
  165. Public wifi hotspots
  166. Setting up hsts in nginx
  167. Ocsp stapling speeding up ssl
  168. Replacing dyndns cloudflare ddns
  169. Certificate revocation google chrome
  170. A plus rating qualys ssl test
  171. Perfect forward secrecy
  172. Trusting security in smartphone apps
  173. Make website faster spdy
  174. Hotel hippo insecure
  175. Encrypted email is easy
  176. Encrypted email android phone
  177. Ssl does not make site secure
  178. Explaining ddos attacks
  179. Goodbye wordpress hello ghost
  180. Squeezing a little more out of your qualys score
  181. Cloudflares great new features and why i wont use them
  182. Do browsers tell us enough about secure connections
  183. Sslv3 goes to the dogs poodle kills off protocol
  184. Pagespeed performance optimisation made easy
  185. Hpkp http public key pinning
  186. Introducing securityheaders io
  187. Creating a pgp contact form
  188. Csp and hpkp violation reporting with report uri io
  189. Infosecurity badge encryption
  190. Choosing and using azure table storage for report uri io
  191. Combat ad injectors with csp
  192. Chrome address spoofing poc
  193. Steelcon 2015
  194. Working with azure table storage
  195. Major update for report uri io
  196. Offloading php session storage to azure table storage
  197. Demonstrating hpkp validation failures
  198. How widely used are security based http response headers
  199. Running the numbers on report uri io
  200. Hpkp toolset
  201. Guidance on setting up hpkp
  202. Safari doesnt like csp
  203. Subresource integrity
  204. Http 2 is here
  205. Migrating from http to https ease the pain with csp and hsts
  206. Further improvements to report uri io
  207. Supporting http 2 with nginx
  208. Monitoring http 2 usage in the wild
  209. Launching the new version of securityheaders io
  210. Setting up le
  211. Scoring transparency on securityheaders io
  212. Micro optimisation for fun
  213. Lets encrypt smart renew
  214. Securityheaders io update
  215. The securityheaders io chrome extension
  216. Server and app health monitoring new relic
  217. Csrf protection in framework
  218. Performance optimising for azure table storage
  219. Ecdsa certificates
  220. Sites tell us store password
  221. Hybrid rsa and ecdsa certificates with nginx
  222. Alexa top 1 million crawl aug 2016
  223. Short urls for securityheaders io
  224. One password reset to rule them all
  225. Hsts preload test
  226. Keep cyber criminals at bay use 2fa
  227. Should we tighten up security on our cdns
  228. Death by copy paste
  229. Using security features to do bad things
  230. Just how much traffic can you generate using csp
  231. Securityheaders io updates
  232. Time for a refresh
  233. The encryted web is coming
  234. Introducing sensible limits to report uri io
  235. Yahoo the largest breach in history
  236. End to end encryption with facebook messenger
  237. Caching ghost with nginx
  238. Signal for desktop is here
  239. Wifi wardriving
  240. Wardriving results
  241. Accelerated mobile pages
  242. Https scotthelme co uk
  243. Easy cheap and secure backup with google cloud platform
  244. Email security spf
  245. Email security dkim
  246. Securityheaders io updates and sponsorship
  247. Email security dmarc
  248. The best tls training in the world coming up north
  249. Why closing port 80 is bad for security
  250. Driving an electric vehicle the nissan leaf
  251. Using alexa to control my car
  252. My ubiquiti home network
  253. Doing the chacha with nginx
  254. Enforcing the use of sri
  255. Csp nonce support in nginx
  256. Bug bounties and extortion
  257. Ocsp must staple
  258. Ocsp expect staple
  259. A new security header referrer policy
  260. Alexa top 1 million analysis feb 2017
  261. Azure functions with the php storage sdk
  262. Launching my new server monitoring dashboard horizon
  263. Lets encrypt are enabling the bad guys and why they should
  264. Weekend project server upgrade
  265. Weekend project macbook pro upgrade
  266. Report uri io new features new reports new tools
  267. Report uri io needs your support
  268. Csp reports now indicate their disposition
  269. Publishing my daily crawler data for wider analysis
  270. Certificate authority authorization
  271. Imperva incapsula are now supporting report uri io
  272. How i almost burnt my house down with a genuine macbook charger
  273. Analysing massive traffic volumes on report uri io
  274. Customising server header over http 2 in nginx
  275. Lets encrypt with dns round robin
  276. Steelcon 2017
  277. Revocation is broken
  278. How to revoke a lets encrypt certificate
  279. Why my blog is creative commons licensed
  280. Advanced session hijacking
  281. Better performance and custom subdomains on report uri io
  282. Wifi insecurity wep
  283. Wifi insecurity wpa
  284. Privacy settings on facebook
  285. Android location services
  286. Facebook privacy settings explained
  287. Password reminders are bad
  288. Speed and security from cloudflare
  289. Subway takes sandwiches seriously not security
  290. Sql injection the basics
  291. Session hijacking ssl doesnt mean secure
  292. Tor anonymity online
  293. Exif and geotagging
  294. Ssl about integrity too
  295. Wifi pineapple usb storage and infusions
  296. Wifi pineapple occupineapple
  297. Storing passwords in browser
  298. Password security
  299. Wifi pineapple karma dnsspoof
  300. Wifi pineapple karma sslstrip