Scott Helme
Security researcher; built Report URI and Security Headers, and writes about web security in practice.
Scott Helme did not write this page. ppll compiled it from their own words, each linked to the source. Is this you? · Report a mistake
Latest x.com
What they believe
-
HTTPS is now simply how the web works, and the long tail of plain-HTTP sites shrinks every year.
HTTPS is now simply how the web works, and the long tail of plain-HTTP sites is shrinking every year.
scotthelme.co.ukSaid 29 Jun 2026This on korrents
-
Every website needs HTTPS, including a static site with no login and nothing sensitive on it.
Supporting HTTPS on your site has so much more to offer than just protecting passwords and user's sensitive data.
scotthelme.co.ukSaid 28 Mar 2016This on korrents
The bold line is korrents’ wording; the quote is theirs. These 2: what they wrote before what they said aloud, one per source, newest first.
Feed
As its own page →Hiding
30 October
28 October
25 October
23 October
22 October
21 October
20 October
14 October
9 October
7 September
24 August
-
Recommendsrcmnd.app
UniFi Travel RouterTheir words
Overall, I'd say the UTR is definitely worth it. I didn't use the VPN feature much, it wasn't what I needed or wanted from it, but I did test it out and it worked perfectly.
-
Lovedrcmnd.app
Starlink MiniTheir words
We plugged it in, set it up, mounted it, and that's it. It just worked. Every single day, every single time. The damn thing is annoyingly flawless. I'm not one for hype or fanfare, but I feel like Starlink will be a transformational technology.
21 August
11 August
10 August
26 July
8 July
1 July
29 June
From one piece Top 1 Million Analysis – June 2026: Ten Years of Web Security 4 beliefs · scotthelme.co.uk
-
Their words
So while CSP adoption has more than doubled, nearly half of all policies are in need of some TLC.
-
Their words
A lot of HSTS deployments are weaker than they look.
-
Their words
The web really is more secure than it was a decade ago.
+ 1 more
-
korrents.com
HTTPS is now simply how the web works, and the long tail of plain-HTTP sites shrinks every year.Their words
HTTPS is now simply how the web works, and the long tail of plain-HTTP sites is shrinking every year.
24 June
22 June
15 June
8 June
25 July 2023
7 May 2023
29 April 2023
11 December 2022
1 December 2021
15 November 2021
1 November 2021
24 May 2021
-
Lovedrcmnd.app
UniFi NVR (UNVR)Their words
I still absolutely love this thing, it looks so awesome in there!
-
Lovedrcmnd.app
UniFi Protect cameras (G4 range)Their words
After setting up the new Ubiquiti kit it really was night and day compared to the old CCTV system, so much so that it actually made us want to fully replace the old system with Ubiquiti cameras, which is exactly what we're now going to do.
6 July 2020
5 March 2020
Nothing matches.
Beliefs
Korrents What they believe 6 beliefs — each backed by an exact quote.
Each is a — compiled by korrents.com, not by them: the one-line wordings are korrents', the quotes are theirs.
Recent
HTTPS is now simply how the web works, and the long tail of plain-HTTP sites shrinks every year.
HTTPS is now simply how the web works, and the long tail of plain-HTTP sites is shrinking every year.
Top 1 Million Analysis – June 2026: Ten Years of Web Security Said 29 Jun 2026
The web really is more secure than it was a decade ago.
The web really is more secure than it was a decade ago.
Top 1 Million Analysis – June 2026: Ten Years of Web Security Said 29 Jun 2026
A security header being present is not the same as it being deployed well, and most HSTS deployments are weaker than they look.
A lot of HSTS deployments are weaker than they look.
Top 1 Million Analysis – June 2026: Ten Years of Web Security Said 29 Jun 2026
Show 3 more
Content Security Policy adoption has more than doubled while nearly half of the policies still contain directives that undermine them.
So while CSP adoption has more than doubled, nearly half of all policies are in need of some TLC.
Top 1 Million Analysis – June 2026: Ten Years of Web Security Said 29 Jun 2026
Every website needs HTTPS, including a static site with no login and nothing sensitive on it.
Supporting HTTPS on your site has so much more to offer than just protecting passwords and user's sensitive data.
Still think you don't need HTTPS? Said 28 Mar 2016
Plain HTTP lets anyone on the path rewrite the page, so HTTPS is about the integrity of what readers get, not only secrecy.
When you serve your pages over HTTP, anyone along the transport layer can do basically anything they want to your pages. More and more often it's becoming increasingly common for somebody in the chain of custody to do something to your pages that you don't want them to do.
Still think you don't need HTTPS? Said 28 Mar 2016
Beliefs others hold too
Every website needs HTTPS, including a static site with no login and nothing sensitive on it. 2 hold this
Supporting HTTPS on your site has so much more to offer than just protecting passwords and user's sensitive data.
Still think you don't need HTTPS? Said 28 Mar 2016
What is a korrent?
A korrent is a belief a person has stated in their own words: one sentence stating the claim, backed by a quote and a source, kept at korrents.com.
Under a name here, the quoted block is what they actually said. The korrent beneath it is the claim those words support, in korrents' wording — tap it to see the record, its source, and who else holds it.
Nobody here wrote their own korrents. They are compiled from public statements, and a person can change their mind, which is recorded too.
Recommends rcmnd
rcmnd What they recommend 4 things — each backed by an exact quote.
Compiled by rcmnd.app, not by them: the quotes are theirs, and each links to the post it was copied from.
Recent
Loved Starlink Mini
We plugged it in, set it up, mounted it, and that's it. It just worked. Every single day, every single time. The damn thing is annoyingly flawless. I'm not one for hype or fanfare, but I feel like Starlink will be a transformational technology.
scotthelme.co.uk 24 Aug 2026
Recommends UniFi Travel Router
Overall, I'd say the UTR is definitely worth it. I didn't use the VPN feature much, it wasn't what I needed or wanted from it, but I did test it out and it worked perfectly.
scotthelme.co.uk 24 Aug 2026
Loved UniFi Protect cameras (G4 range)
After setting up the new Ubiquiti kit it really was night and day compared to the old CCTV system, so much so that it actually made us want to fully replace the old system with Ubiquiti cameras, which is exactly what we're now going to do.
scotthelme.co.uk 24 May 2021
Show 1 more
Loved UniFi NVR (UNVR)
I still absolutely love this thing, it looks so awesome in there!
scotthelme.co.uk 24 May 2021
Where they publish
Blog scotthelme.co.uk His blog on web security, certificates and headers. Has a feed.
Recent
- Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds 20 Oct 2026 One of eMudhra's certificate authority private keys is the number 4. Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, be…
- Passkeys Are Not a Trap 14 Oct 2026 A post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is this true?' kind of vibe. It&
- The First Reduction in Their History: 64-Day Let's Encrypt Certificates 9 Oct 2026 I remember being in the room at DEF CON 23 in Las Vegas, in 2015, listening to "Let's Encrypt – Minting Free Certificates to Encrypt the Entire Web". It was still months before Let's Encrypt would launch their public be…
Show 12 more
- No Hacking Required: The Manchester Airports Group Data Breach 7 Sept 2026 On 27 August 2026, Manchester Airports Group told customers that "an unauthorised third party" had stolen their data. Car park bookings, lounge bookings, Fast Track purchases for airport security and passport control, a…
- The ultimate road trip combo: Starlink Mini + UniFi Travel Router 24 Aug 2026 I recently went on an epic road trip around Europe, covering 1,645 miles (2,647 km), and we took in some amazing sights and locations. As a tech geek, I was worried about my connectivity on the trip, so before we set of…
- Introducing dbsc.dev: Does Your Browser Support DBSC? 21 Aug 2026 Every other web platform feature I've ever written about, I've been able to test in some easy way. Open DevTools, type the name of the thing, see if it's there. Device Bound Session Credentials doesn't work like that: t…
- Device Bound Session Credentials lands in Chrome on macOS 11 Aug 2026 Device Bound Session Credentials (DBSC) is Chrome's answer to session cookie theft, usually by InfoStealer malware. Instead of a cookie being a bearer token that works anywhere it's pasted, DBSC binds the session to a p…
- Everything I Learned Shipping Device Bound Session Credentials 10 Aug 2026 We shipped Device Bound Session Credentials at Report URI, open-sourced the server-side implementation, and then discovered a long list of things the specification doesn't prepare you for. Some caused random logouts. On…
- Connection Allowlist: a network firewall, built into the browser 8 Jul 2026 Connection Allowlist is a new browser security mechanism that lets a document declare, up front, the exact set of destinations it's permitted to open network connections to. Anything not on the list is blocked by the br…
- Top 1 Million Analysis – June 2026: The State of Crypto 1 Jul 2026 This is part two of the ten-year anniversary Top 1 Million Analysis. Part one covered the broad state of the web — HTTPS, the security headers, cookies, email and DNS hygiene. This part is the bit I've been most excited…
- Top 1 Million Analysis – June 2026: Ten Years of Web Security 29 Jun 2026 It's been a long time since the last one of these! The previous Top 1 Million Analysis was way back in June 2022, and a lot has happened since then. But there's a much bigger reason to dust off the crawler and publish a…
- A dead CDN, a wildcard, and an attack waiting to happen: the netdna-ssl.com takeover 24 Jun 2026 Every now and then I go digging through Report URI's Threat Intelligence data feeds, looking for domains that show up in CSP reports where they really shouldn't. Last week one jumped out at me: netdna-ssl.com. If you've…
- Why No Passkeys? Naming the Top Sites That Still Don't Support Them 22 Jun 2026 Back in 2017, Troy Hunt and I built a little website called whynohttps.com. The idea was simple: take the most popular sites on the internet, check which ones still weren't redirecting visitors to HTTPS, and put the lag…
- The Instructure Canvas Breach (2026): How XSS in a Support Ticket Compromised 275 Million Students 15 Jun 2026 A single support ticket became the front door to 275 million student records. The Canvas breach shows how quickly untrusted user content can become a serious security incident when it is rendered inside privileged inter…
- Open-Sourcing dbsc-php: a Server Library for Device Bound Session Credentials in PHP 8 Jun 2026 We’ve open-sourced dbsc-php, a small PHP library that makes it easier to deploy Device Bound Session Credentials and turn stolen session cookies into something far less useful. It's MIT-licensed, pure-PHP, and available…
Link verified 20 Sept 2026. Recent items update automatically from the channel.
x.com @Scott_Helme Their X account.
Recent
- Hahaha Norway!! 🤣 🇳🇴🇳🇴🇳🇴🇳🇴 30 Oct 2026 visitnorway.com
- I've been digging into the ~$2.6M Polymarket crypto theft. The attackers replaced a third-party JS file with targeted malware by compromising the performance monitoring tool DebugBear. We can't keep blindly loading and running other people's code with no checks in place!! 30 Oct 2026 blog.report-uri.com
- €120 cleaning fee on a 3 night stay and we got this from our host, I’m glad AirBnB stepped in. We started the dishwasher on departure (obviously couldn’t empty) and no, I didn’t take out the trash. Paying premium prices, then paying a cleaning fee, then doing the cleaning? Nope! 🤷♂️ 30 Oct 2026
Show 17 more
- -----BEGIN DH PARAMETERS----- 4 -----END DH PARAMETERS----- Again?! 28 Oct 2026 foxio.io
- Here's storm Boelo that's currently battering us with winds! I had to go out and fix some fence panels this morning... 😅 Pics are: Sat 24th 13:09 Sun 25th 02:58 Sun 25th 10:52 25 Oct 2026
- "Sorry we didn't get back to you yet, we've been too busy on Twitter and trying to keep our investors happy" Unbelievable statement from eMudhra! 23 Oct 2026
- eMudhra claim they're leaving the SSL/TLS business because they're being criticised on social media. It's more likely that they've realised they will probably be fully removed anyway, so they're bowing out now. 22 Oct 2026
- This escalated really quickly and I can't believe we ended up in a rabbit hole of tearing apart DarkSword exploit kits! 22 Oct 2026
- Aww shit, here we go! 🚀 22 Oct 2026
- What an utterly terrifying, yet completely fair, question to ask of eMudhra. 21 Oct 2026
- Phew! It's nice to have that wrapped up. A big part of the delay for us was the package repository not being able to serve the updates. I think we're clear to say that there was no impact 💪 21 Oct 2026
- -----BEGIN EC PRIVATE KEY----- 4 -----END EC PRIVATE KEY----- 😬 21 Oct 2026
- Here's everything we've done so far for @reporturi in response to php2shell. Feedback and suggestions welcome 👍 21 Oct 2026
- 🤦♂️ 21 Oct 2026
- Damn, this is really bad. Mainstream browsers will probably be fine, but there is a long tail of other stuff that will be affected by this: 20 Oct 2026 scotthelme.co.uk
- I know that "criminals be criminals" and all, but really? Impersonating a children's charity?.. 16 Oct 2026
- If passkeys have people this upset, wait until they hear about DBSC 🤣 Your session is hardware bound to your device... Somewhere, a cookie just found out it can be device-bound 🍪🔐 15 Oct 2026 scotthelme.co.uk
- Quite a few people have sent me the "Passkeys are a trap. Do not use them." post on Substack. The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation as the primary reason. I’ve written a rebuttal as this is really dangerous advice and it's based on some incorrect technical claims. 14 Oct 2026 scotthelme.co.uk
- Making space to add more AI 😎 I’ve got my UniFi AI Key that does analysis on my CCTV cameras, a Mac Mini M4 that’s now maxed out, and a Mac Mini M5 Pro on the way! 🤖 This little rack is quite cool to hold them all with space for ventilation 🔥 13 Oct 2026
- I had to double check this one 😅 10 Oct 2026
Link verified 23 Sept 2026. Recent items update automatically from the channel.
GitHub @ScottHelme Their code.
Recent
- passkeys-directory — Open directory of websites that support passkeys — top 1M scope, no global-rank cap. Data source for whynopasskeys.com. 26 Jul 2026
- hibp-breached-sites-security-analysis 25 Jul 2023
- new-lets-encrypt-logo 7 May 2023
Show 9 more
- ubiquiti-https-scripts — Scripts to deploy HTTPS certificates to Ubiquiti hardware. 29 Apr 2023
- scotthelme.co.uk — Theme for https://scotthelme.co.uk 11 Dec 2022
- revocation-endpoints — A list of CRL and OCSP endpoints. 1 Dec 2021
- sketchy-pwned-passwords — A Count-Min Sketch Implementation of Pwned Passwords 15 Nov 2021
- when-pwned-passwords-bloom — When Pwned Passwords Bloom! 1 Nov 2021
- Chain-Build 6 Jul 2020
- ocsp-responder-list — A hosts list to block known OCSP Responders 5 Mar 2020
- le-scan — Let's Encrypt Revocation Event 5 Mar 2020
- symantec-certificate-checker — Checks for Symantec issued certificates that will be distrusted. 12 Dec 2018
Link verified 23 Sept 2026. Recent items update automatically from the channel.
About the English under a post
Some people here publish in a language other than English. Where they do, this site shows a machine translation beneath the post, in this typeface — the site's own, not theirs.
The post itself is never changed, moved or hidden: what is set in the serif above is exactly what the person published, and it is what to quote them on. A translation can be wrong in ways that matter, especially about tone.
Only the post's own words are translated. A quoted post, a linked article and a belief on korrents.com are left in their original language.