Try “SSH”, “passkeys”, “WordPress” or “Content-Security-Policy”.
Security Intelligent Code
Practical guides for safer systems and fair comparisons of servers, language models, CMS, operating systems and apps. Every comparison shows its criteria, every guide its sources, and every tool runs in your browser.
Start with the baseline Compare options
95d9576a e780e60f 75df843b 4d8457fb b77dbb89 81d99882 b0b5446b eb78fdd5
Change one character and the whole fingerprint changes. That is how a checksum proves a download is untouched.
Sections
Start where your systems are. Each section opens with the guide that removes the most risk.
Start here
One per section, chosen for impact.
Twelve controls, ordered by impact, that protect a team of one to fifty people against the break-ins that actually happen, from MFA and a password manager to offboarding and an incident contact list.
Critical impact6 min
Four web servers, one question: which one leaves the fewest gaps once it is running? We compare defaults, automatic HTTPS, configuration risk, attack surface and how fast fixes reach you.
Medium impact6 min
Free chat app, business plan, API, cloud region or your own server: the deployment type decides who sees your prompts, how long they are kept and what you can prove later.
High impact6 min
Six ways to run a website, scored on security process, extension risk, updates, support windows and attack surface. The right choice depends less on the code than on the routine you can keep.
High impact6 min
All four are safe enough when they are updated, encrypted and used without admin rights. The real differences lie in defaults, support periods and how much of the work stays with you.
Medium impact6 min
Five popular messengers, five different answers to the questions that matter: is encryption on by default, what does the operator keep, and are your backups as safe as your chats?
High impact6 min
The 2025 edition of the OWASP Top 10 reorders the classic web risks and adds a new one about error handling. What each category means, how it shows up in real code and what stops it.
High impact6 min
Compare before you commit
Move the sliders and the ranking follows your priorities. 13 comparisons in total.
Interactive comparison
Five web server options scored from 1 to 5 for a small, self-managed site; higher is always better.
Best for small teams that want HTTPS and renewal handled without any extra work.
Best for admins who want a lean, well-documented server and are happy to add an ACME client.
Best where a hosting control panel provides it as an Apache replacement.
Best for applications that rely on .htaccess rules and for teams that know Apache well.
Best for self-managed WordPress hosts that want LiteSpeed caching without a licence.
| Criterion | Caddy | Nginx | LiteSpeed Enterprise | Apache HTTP Server | OpenLiteSpeed |
|---|---|---|---|---|---|
| Secure defaults | |||||
| Automatic HTTPS | |||||
| Low configuration risk | |||||
| Small attack surface | |||||
| Patch delivery | |||||
| Resilience under load |
Editorial assessment as of 31 October 2026. Scores from 1 to 5, higher is better. Your weights only change the order. Read the full comparison
Interactive comparison
Editorial scores from 1 to 5 for teams that run their own website, where higher is always better.
Best for publishers and newsletters that need no plugins.
Best for sites that change rarely and teams comfortable with git.
Best for mid-sized sites that want MFA and clear support dates without many add-ons.
Best for organisations with agency support that value long, predictable LTS windows.
Best for complex sites with a developer or agency and a deployment pipeline.
Best for small teams that want a familiar editor and will keep plugins to a minimum.
| Criterion | Ghost | Static site generator | Joomla | TYPO3 | Drupal | WordPress |
|---|---|---|---|---|---|---|
| Core security process | ||||||
| Low extension risk | ||||||
| Update automation | ||||||
| Long-term support | ||||||
| Small attack surface | ||||||
| Admin protection | ||||||
| Low maintenance effort |
Editorial assessment as of 31 October 2026. Scores from 1 to 5, higher is better. Your weights only change the order. Read the full comparison
Interactive comparison
Five password managers scored from 1 to 5 on transparency, passkeys, sharing, platforms, recovery and control; higher is always better.
Best for people and teams who want open code, every platform and the option to self-host.
Best for families and small teams who value polish and administration.
Best for people who want encrypted metadata and already use Proton services.
Best for individuals who want no cloud account at all and can manage their own sync.
Best for households that use Apple devices only.
| Criterion | Bitwarden | 1Password | Proton Pass | KeePassXC | Apple Passwords |
|---|---|---|---|---|---|
| Open code and audits | |||||
| Passkey support | |||||
| Sharing for teams | |||||
| Platform coverage | |||||
| Recovery and emergency access | |||||
| Control over your data |
Editorial assessment as of 31 October 2026. Scores from 1 to 5, higher is better. Your weights only change the order. Read the full comparison
Interactive comparison
Five messengers scored from 1 to 5 on what protects the content and context of your conversations; higher is always better.
Best for private conversations where you want strong defaults and minimal data kept.
Best for people and teams who do not want to link a phone number or email address.
Best when everyone you need to reach already uses it.
Best for households and teams that use Apple devices only.
Best for public channels and large communities, not for confidential chats.
| Criterion | Signal | Threema | iMessage | Telegram | |
|---|---|---|---|---|---|
| Encryption by default | |||||
| Metadata restraint | |||||
| Sign-up privacy | |||||
| Backup protection | |||||
| Transparency | |||||
| Contact verification | |||||
| Reach |
Editorial assessment as of 31 October 2026. Scores from 1 to 5, higher is better. Your weights only change the order. Read the full comparison
Interactive comparison
Six ways to use language models, scored by how well each protects business data by default and how much effort it takes; higher is always better.
Organisations already on a large cloud that need a chosen region and existing contracts.
Teams that want a chat interface for internal and confidential work under one contract.
Sensitive data or high volume, for teams that can run and secure a server.
Developers building AI features into their own software.
Individuals who want stronger models for work that contains nothing sensitive.
Public information and personal experiments, never customer or personal data.
| Criterion | Models through a cloud platform | Business or enterprise plans | Self-hosted open-weight models | Direct API access | Paid consumer plans | Free consumer chat apps |
|---|---|---|---|---|---|---|
| No training by default | ||||||
| Retention control | ||||||
| Admin control and audit logs | ||||||
| Data residency choice | ||||||
| Contractual clarity | ||||||
| Quality for little effort |
Editorial assessment as of 31 October 2026. Scores from 1 to 5, higher is better. Your weights only change the order. Read the full comparison
Tools
Passwords, files, headers, links and tokens you enter never leave your browser.
The magazine
37 guides in 7 sections. Filter by section or by type.
Twelve controls, ordered by impact, that protect a team of one to fifty people against the break-ins that actually happen, from MFA and a password manager to offboarding and an incident contact list.
Critical impact6 min
Passkeys, hardware security keys, authenticator apps, push approval, SMS and email codes all count as MFA, but they fail in very different ways. A comparison by phishing resistance, recovery and everyday use.
Critical impact5 min
Ransomware looks for your backups before it encrypts anything else. How to keep copies it cannot reach: the 3-2-1-1-0 rule, immutable storage, separate credentials, SaaS data and restore drills that prove it all works.
Critical impact5 min
Attackers routinely exploit flaws that already have a fix. A realistic update routine for small teams: automatic updates, a weekly slot, priorities from the known exploited list, firmware, testing and end of support.
High impact5 min
Length beats complexity, reuse is the real danger and forced rotation does more harm than good. What current NIST guidance says, how cracking works online and offline, and where password managers fit in.
High impact5 min
AI-written phishing leaves no spelling mistakes to spot. The signals that still work: sender domains, look-alike and IDN homograph tricks, link targets, QR codes, callback scams, surprise MFA prompts and payment changes.
High impact5 min
Four web servers, one question: which one leaves the fewest gaps once it is running? We compare defaults, automatic HTTPS, configuration risk, attack surface and how fast fixes reach you.
Medium impact6 min
Every hosting model splits security work between you and the provider. We compare shared hosting, unmanaged and managed servers, platforms as a service and static hosting by who patches, isolates and restores.
High impact5 min
Support periods, update processes and default protection differ more than package names. We compare Debian, Ubuntu LTS, Rocky Linux, AlmaLinux and Alpine as systems you leave running for years.
Medium impact5 min
Most attacks on SSH are automated guessing. Keys, a small drop-in file and an allow list make that guessing pointless. Here are the settings and how to apply them without locking yourself out.
High impact6 min
A padlock in the browser is the start, not the finish. This guide covers TLS 1.2 and 1.3, sensible ciphers, HSTS and preloading, and the shrinking certificate lifetimes that make automation mandatory.
High impact5 min
Free chat app, business plan, API, cloud region or your own server: the deployment type decides who sees your prompts, how long they are kept and what you can prove later.
High impact6 min
A language model cannot reliably tell your instructions apart from text it happens to read. How direct and indirect prompt injection work, why agents raise the stakes and which defences help.
High impact5 min
Running open-weight models on your own hardware keeps prompts in house, but only while the server stays off the open network. Four popular runners compared on defaults, authentication and serving.
High impact5 min
Code assistants and agents write useful code fast, and now and then insecure code, invented packages or a shell command you did not expect. These habits keep the speed without the surprises.
High impact5 min
Your staff already use AI tools, with or without a policy. A short, clear one sets which tools are approved, which data stays out, who checks the output and what the EU AI Act expects of you.
High impact5 min
Six ways to run a website, scored on security process, extension risk, updates, support windows and attack surface. The right choice depends less on the code than on the routine you can keep.
High impact6 min
When a WordPress site is broken into, the cause is rarely WordPress core. These steps close the usual gaps in order of impact, with settings and server rules you can copy.
High impact6 min
No database, no login page, no code running on each request: static sites are hard to break into directly. The risks move to the build pipeline, the accounts, the DNS and the scripts you embed.
Medium impact5 min
A handful of HTTP response headers tell browsers to enforce HTTPS, block framing and limit what scripts may load. Here is what each one does, which ones to drop and how to add them on Apache and Nginx.
Medium impact5 min
The week before launch is the cheapest time to fix security. These checks cover HTTPS, logins, error pages, forms, privacy, DNS and email records, backups and monitoring, whatever the site is built with.
High impact5 min
All four are safe enough when they are updated, encrypted and used without admin rights. The real differences lie in defaults, support periods and how much of the work stays with you.
Medium impact6 min
Both platforms are well protected while they receive updates. The bigger gap runs between phones: an iPhone, a Pixel, a Samsung flagship and a budget Android phone age very differently.
High impact5 min
Standard accounts for daily work, prompt updates, Defender's ransomware protection, encryption with a stored recovery key and app control: the settings that make a Windows 11 PC hard to misuse.
High impact5 min
Updates, FileVault, the firewall, app sources, privacy permissions and background items: the macOS settings that decide how well a Mac is protected, with paths for macOS Golden Gate and Tahoe.
High impact5 min
Windows 10 lost regular support in October 2025, and the consumer ESU programme now runs to October 2027. Your options for old PCs, Macs, phones, routers and NAS devices, from upgrade to isolation.
High impact5 min
Five popular messengers, five different answers to the questions that matter: is encryption on by default, what does the operator keep, and are your backups as safe as your chats?
High impact6 min
Cloud vault or local file, open source or polished subscription: five password managers compared on audits, passkeys, sharing and recovery, with the lessons of the 2022 LastPass breach.
Critical impact6 min
Five browsers, one job: run code from strangers safely. We compare update speed, isolation, tracking defaults, Manifest V3, site warnings, vendor data collection and enterprise management.
High impact5 min
A VPN hides your traffic from the local network and your provider, and your IP address from websites. It does not stop phishing, malware or tracking through logins. Here is where it really helps.
Medium impact5 min
Extensions, connected apps and site permissions pile up quietly. This fifteen minute audit removes what you do not use, trims risky permissions and moves your passwords to where they belong.
High impact5 min
The 2025 edition of the OWASP Top 10 reorders the classic web risks and adds a new one about error handling. What each category means, how it shows up in real code and what stops it.
High impact6 min
An API key in a repository is copied to every clone and every fork. How to keep secrets out of code, where to store them instead and what to do in the first hour after a key was committed.
High impact5 min
Much of the code you ship was written by someone else. How to pin and review dependencies, avoid typosquatting and dependency confusion, produce an SBOM and check what you install.
High impact6 min
SQL injection and cross-site scripting share one root cause: data that ends up being treated as code. Parameterised queries, context aware encoding and a Content Security Policy close that gap.
High impact5 min
Four algorithms are fit for storing passwords, and fast hashes such as SHA-256 are not. How Argon2id, scrypt, bcrypt and PBKDF2 compare, which parameters OWASP recommends and how to migrate.
High impact5 min
JSON Web Tokens are compact and convenient, and easy to get subtly wrong. What a token contains, which checks every verifier must make and when a plain session cookie is the better choice.
High impact5 min
No guide matches both filters yet. Choose another type or section.
FAQ
sicovis (Security Intelligent Code) is an independent English language magazine about practical cybersecurity. It publishes guides for safer systems and fair comparisons of servers, language models, CMS, operating systems and apps.
For people who run systems without a security department: small business owners, freelancers, web agencies, administrators and developers. Every guide says who it is for, how long it takes and how much risk it removes.
Each option gets 1 to 5 points per criterion, higher is better, as an editorial assessment based on official documentation, release notes and advisories. You can weight the criteria yourself, and the ranking follows your priorities. No vendor pays for a mention.
No. The Password Lab, Checksum Verifier, Header Check, URL Inspector, CSP Builder, SSH Config Builder, JWT Decoder and the Security Self-Check run entirely in your browser. Nothing you type is transmitted.
Its fingerprint: the SHA-256 hash of the article address, drawn with the “drunken bishop” algorithm that OpenSSH uses to visualise host keys. Change one character of the input and the picture changes completely.
