Exposed .env and .git Files: How They Leak and How to Block Them
How .env, .git and backup files end up publicly downloadable, how to check your own site in a minute, and Nginx, Apache and Cloudflare rules to block them.
332 practical guides to website speed, SEO, email deliverability, DNS, security and automation, with fixes you can copy and paste.
How .env, .git and backup files end up publicly downloadable, how to check your own site in a minute, and Nginx, Apache and Cloudflare rules to block them.
Check which TLS versions your server accepts, find out who still uses old ones, then disable TLS 1.0 and 1.1 on Apache, Nginx, IIS, cPanel and Cloudflare.
Learn Content Security Policy step by step: start in report-only mode, use nonces or hashes, and fix the inline scripts and widgets that usually break.
The biggest website security threats for UK small businesses in 2026, backed by government breach data, plus a practical checklist to cut your risk this month.
TLS 1.3 explained for website owners: what changed from TLS 1.2, the faster handshake, 0-RTT risks, disabling TLS 1.0 and 1.1, and how to check your server.
Post-quantum encryption for websites: harvest now, decrypt later, hybrid X25519MLKEM768 key exchange, NCSC timelines and the steps a small business needs.
Passkeys for business websites explained: how FIDO2 and WebAuthn stop phishing, support in Google, Microsoft, WordPress and Shopify, and a rollout plan.
A complete Nginx security headers config: HSTS, CSP, nosniff, frame-ancestors, Referrer-Policy and Permissions-Policy, plus the add_header inheritance trap.
A practical .htaccess guide for Apache, cPanel and LiteSpeed: one-hop HTTPS and www redirects, 301s, caching, security headers and fixing 500 errors.
A web application firewall (WAF) blocks malicious requests such as SQL injection and bad bots before they reach your site. See if you need one and free options.
How to back up your website: automatic daily backups of files and database, a copy kept off your host, 30+ days of history and regular test restores.
How to add two-factor authentication to WordPress, cPanel, your hosting account and registrar, with backup codes and passkeys so you never get locked out.
Popular topics
Free website audit
Speed, SEO, DNS, email (SPF/DKIM/DMARC) and security in one scan, with a prioritised fix list.
Make It Flow assistant
Tools, guides and AI automation
Hi! I can find the right free tool, explain an audit result, or tell you how Make It Flow can automate any part of your business. What do you need?
Book a free 15-minute call
Pick a time that suits you. Times are shown in your time zone ().
A Make It Flow agent will confirm the call by email within 24 hours.
AI answers can be wrong. Chats are stored so the team can follow up. Privacy