The padlock is not enough: enforce HTTPS with HSTS
Your site has a certificate, yet a visitor can still arrive over HTTP. The HSTS header fixes that in one line. What it is, how to set it, the pitfalls.
Advice
What you need to know, without jargon.
Short articles, checked against official sources, to understand what is happening on your site and act yourself when you can.
SPF, DKIM, DMARC: stop people sending email in your name
Three DNS settings decide whether your emails get delivered, and whether a fraudster can pose as you. A plain explanation and a 5-minute check.
Hacked website: what to do in the first hour
Home page replaced, strange redirects, a Google warning: what to do right away, what not to do, and in which order. Based on the official French response sheet.