CSRF is easier to understand as an attack than as a defence. Build the attack page first — it is nine lines — then the token makes obvious sense, and so does why SameSite cookies are not the whole answer.
Read article
The most common attack a small site actually sees, and the fix most tutorials get wrong: a per-IP limit locks out a whole office behind one NAT and misses the attack it was built for. A database-backed limiter that does neither.
Read article
md5 and sha1 are still in production codebases, usually behind a salt somebody was proud of. What password_hash actually does, why the salt argument is gone, how to rehash on login, and the comparison that leaks.
Read article
