---
title: "Security | Blog | Phát Lâm"
url: https://phatdev.net/en/blog/c/security
lang: en
updated: 2026-10-21
alternate:
  vi: https://phatdev.net/vi/blog/c/security
markdown: https://phatdev.net/en/blog/c/security.md
---

# Security

Technical notes drawn from real projects: frontend, backend, AI, security, SEO, media and mobile apps.

## Posts

- [What Is a Passkey? Passwordless Sign-In Explained, and Whether Your Website Should Add It](https://phatdev.net/en/blog/passkeys-explained.md) (Security | 2026-10-21 | 6 min read): A strong password is useless when you type it into a fake page. Passkeys block exactly that. How they work in plain words, how to turn them on for Google and Apple, what happens if you lose your phone, and when a site owner should add them.
- [Monthly Website Maintenance: What It Includes and Why Neglect Costs More](https://phatdev.net/en/blog/website-maintenance-monthly.md) (Security | 2026-10-21 | 5 min read): Six monthly jobs that keep a website from dying on the road: updates, backups, security, speed, broken links and renewals, and why neglect always costs more.
- [Website Hacked: How to Spot It and What to Do in the First 24 Hours](https://phatdev.net/en/blog/website-hacked-what-to-do.md) (Security | 2026-10-21 | 6 min read): Signs your site was compromised and a clear order for the first 24 hours: isolate, change passwords, restore a clean backup, find the hole and tell Google, written for non-technical readers.
- [Website Backups Done Right: The 3-2-1 Rule and Testing Your Restores](https://phatdev.net/en/blog/website-backup-3-2-1.md) (Security | 2026-10-21 | 6 min read): What to back up, how often, the 3-2-1 rule and why you must test restores regularly, explained for non-technical readers.
- [Testing Your Own Website's Defenses With Permission: The Basics](https://phatdev.net/en/blog/authorized-web-pentest-basics.md) (Security | 2026-10-19 | 6 min read): How to legally test your own website's defenses: permission and scope, a five-step process, testing permissions with two accounts, and writing a report others can act on.
- [Encrypting Sensitive Data the Right Way with AES-GCM](https://phatdev.net/en/blog/aes-gcm-done-right.md) (Security | 2026-10-19 | 7 min read): How to encrypt phone numbers, addresses and customer notes so a leaked backup is unreadable, with Node.js, Python and PHP code that was actually run.
- [Making Your Nginx Website Safer, Step by Step](https://phatdev.net/en/blog/nginx-web-hardening.md) (Security | 2026-10-19 | 6 min read): Five things to do after installing Nginx: security headers, blocking sensitive files, HTTPS, login rate limits and the fake-IP trap via X-Forwarded-For, all built and tested.
- [Self-Check Your Website's Security with the OWASP Top 10 (2025)](https://phatdev.net/en/blog/owasp-top10-audit-checklist.md) (Security | 2026-10-19 | 6 min read): The ten OWASP Top 10 (2025) items explained for business owners and developers: what each means, how to test with two accounts, plus an automated check script that was run.
- [Rotating Login Keys Without Logging Anyone Out](https://phatdev.net/en/blog/jwt-rs256-key-rotation.md) (Security | 2026-10-19 | 6 min read): How to rotate JWT signing keys step by step so signed-in users are not kicked out: RS256/ES256 key pairs, the JWKS key list, and the order of publish, sign and retire.
- [A Shared JWT Login Token for Node.js, PHP, Python and C#](https://phatdev.net/en/blog/jwt-across-languages.md) (Security | 2026-10-19 | 6 min read): One login token across services written in different languages: what a JWT is, what to check, where to keep it safely, with code run across three languages.

RSS: https://phatdev.net/en/blog/rss.xml