Key takeaways
- Most real-world compromises come from basics skipped: weak or reused passwords, missing updates, exposed services.
- Understanding how attacks work (SQL injection, XSS, port scanning) is what makes defence practical.
- Only test systems you own or have written permission to test.
- Learning is safest in your own lab, with tools that run locally.
What this topic covers
Cybersecurity is one of my supporting skills and an area I keep studying. I treat it as a learning path: fundamentals first, then practical habits, then hands-on practice in labs and authorised settings only. The notes below come from my own learning and testing, so they focus on explaining ideas clearly rather than promising results.
The four articles in this section move from the individual to the website. Passwords protect your accounts, SQL injection and XSS explain how web applications get attacked, Nmap shows what an attacker (or a defender) can see from the network, and the WordPress checklist turns the lessons into steps for a real site.
Articles on this topic
Password Security in 2026: Why Length Beats Complexity
Why long passphrases and unique passwords protect you better than short, symbol-heavy ones, how entropy works, and the habits that stop most account takeovers.
Read article →SQL Injection and XSS, Explained Simply
Two of the most common web vulnerabilities, their shared root cause, short safe-versus-unsafe code examples and the standard fixes.
Read article →Nmap Basics: Reading Your First Scan
Open, closed and filtered ports explained, what -sV adds, how to read your first result and the rule that you only scan what you’re authorised to test.
Read article →A Practical WordPress Hardening Checklist
Most WordPress compromises come from basics being skipped. This checklist covers updates, logins, backups and security headers.
Read article →Principles I keep coming back to
- Fix the basics before the exotic. Unique passwords, two-factor authentication, updates and backups prevent more incidents than any advanced tool.
- Reduce what is exposed. Every open port, plugin and admin page is something to defend. Remove what you do not need.
- Validate input, encode output. That one sentence is the root of the standard fixes for injection and cross-site scripting.
- Defence in depth. Assume one control will fail and make sure another one catches it.
- Stay ethical and legal. Authorisation is not a formality; it is what separates security testing from an offence. See the responsible disclosure policy for how to report issues on this site.
Where to practise safely
The Tools page includes browser-based utilities for password checking, hashing, encoding, JWT decoding, HTTP header analysis and log review. They run locally, so nothing you type is uploaded. The security reference tools there are for learning and legitimate security work only.
For scanning and testing, use your own lab machines or platforms that explicitly invite testing. My Cyber Security Specialist training certificate from CipherShadow is part of my training, and the Projects page shows the security focus areas and lab work I am learning and practising now.
Frequently asked questions
Is this site a source of hacking instructions?
No. The articles explain concepts, defences and safe practice. Anything that touches testing stresses authorisation and lab use.
Where should a beginner start?
With your own accounts: a password manager, unique passwords and two-factor authentication. Then read about how common web attacks work and practise in a lab you control.
Can you test my website?
Please contact me with details first. I only discuss work on systems where the owner has clearly authorised it, and I do not guarantee outcomes.