For MSPs, web agencies & technical teams

Uncover Security Gaps Before AI Attackers Do.

Practical checklists, security tools, and evidence workflows for MSPs, agencies, and technical teams securing web, DNS, Cloudflare, WordPress, and automation stacks—without enterprise theatre.

Check My Website Security → See Sample Security Report
  • 18+ years in cybersecurity & infrastructure
  • Cloudflare
  • WordPress
  • AWS/Azure/GCP
  • security practitioner
  • speaker
  • open-source builder

Get the free checklist →

Myles Agnew, cyber security practitioner and tool builder
18+
Years in Tech
25
Baseline Checks
5
Areas Reviewed
Website Security Operations

Built for teams responsible for websites, DNS and client environments

MSPs and web agencies

Run one repeatable baseline across client websites, DNS, Cloudflare and WordPress — and hand over a report the client can actually read.

See the agency baseline workflow →

Small technical teams

Get clear risk priorities and evidence-backed fixes for a business-critical site, without an enterprise security programme.

What the baseline checks →

Operators and builders

Use the practical checklists, tools and workflows behind the baseline to make website security a repeatable system.

Start with the free checklist →

Explore the Website Security Baseline →

The Baseline Workflow

Find it. Fix it. Prove it.

The Website Security Baseline turns scattered website, DNS, Cloudflare and WordPress checks into a repeatable workflow: identify the real gaps, prioritise what should be fixed first, and keep evidence of what was checked.

01

Find it

Assess the real exposure

Check the public website, DNS, Cloudflare posture, WordPress exposure, security headers, admin surfaces, backups and recovery assumptions.

Output: a clear list of gaps, evidence and severity notes.

Explore the baseline →
02

Fix it

Prioritise what matters

Turn findings into a practical remediation sequence for the site owner, agency, MSP, internal team or existing provider — without trying to fix everything at once.

Output: a priority fix list and 30/60/90-day action plan.

Get the checklist →
03

Prove it

Keep evidence and next actions

Capture evidence, decisions, scores, screenshots and next actions in a report format that can be shared with owners, managers, agencies, MSPs or clients.

Output: a sample-report style evidence pack and next-step plan.

See Sample Report →

Proof asset · Sample report

See what a Website Security Baseline report looks like

Review an example report with an executive summary, findings by area, priority fixes, evidence notes, and the checks behind the baseline workflow.

  • Executive summary
  • Findings by area
  • Priority fixes
  • Evidence notes
  • What was checked
  • Next actions
See Sample Security Report → Explore the baseline →

Start with the public baseline guide. Use the free checklist if you want to self-assess, or review the sample report to see what a structured, evidence-backed baseline looks like.

Baseline Assets

Website Security Operations Assets

The public tools and resources that support the baseline workflow.

Website Security BaselineStart here

What the baseline looks at across DNS, Cloudflare, headers, WordPress, admin exposure and recovery — and what you receive.

Explore the baseline →
Sample Baseline ReportProof

An illustrative report: findings, severity, priorities and what was checked, fixed and handed over.

See the sample report →
Cloudflare + Website Security ChecklistFree

The 25-point public checklist behind the baseline, with a printable PDF.

Get the checklist →
Agency Security Baseline WorkflowMSPs & agencies

How to run the baseline repeatably across client sites and hand it over as client-ready evidence.

See the agency workflow →
Cloudflare DNS BackupRecovery

Keep every Cloudflare zone versioned and restorable off-platform, before a bad change or account issue causes downtime.

Back up DNS →
Redirect TracerDiagnostic

Follow every redirect hop, header and TLS certificate for a URL — useful for checking HTTPS, redirects and suspicious links.

Trace a URL →
Open Source & Lab

More security tools and lab assets

These tools support broader security automation, AI security, backup and lab workflows. They are useful, but the Website Security Baseline remains the primary path for website and client-environment reviews. Browse everything on the tools page.

Post-Quantum Tester HTML/JS

Enter any website and run a real post-quantum TLS handshake against its server to check whether it supports quantum-safe key exchange (X25519MLKEM768 / ML-KEM).

Use case: Check whether a site is quantum-safe against “harvest-now, decrypt-later” before it carries long-lived data.

Test a site →
cloudflare-backup Shell

Automated Cloudflare DNS record backup script. Keep DNS configuration versioned and recoverable without manual exports.

Use case: Version and recover DNS configs before client migrations or account restructuring.

View Tool →
S3 + CloudFront Cost Calculator HTML/JS

Browser-based monthly cost estimator for static websites, download assets, CDN traffic, cache misses, and invalidation paths.

Use case: Price S3-backed static hosting and client asset delivery before quoting or changing architecture.

Open Calculator →
promptgenie Python

Prompt linting, static risk scanning, testing, and CI workflows for safer AI-agent prompt pipelines.

Use case: Integrate into CI pipelines to catch risky agent prompts before they reach production.

View Tool →
github-backup Shell

Bash scripts that snapshot every GitHub repository owned by an account. Off-platform backup for your entire GitHub presence.

Use case: Off-platform backup before account restructuring or platform incidents.

View Tool →
dns-blocklists Text

Curated DNS blocklists for Pi-hole and similar resolvers. Blocks ads, trackers, and malicious domains at the network level.

Use case: Network-level blocking for home labs, small office, and MSP client networks.

View Lists →
n8n-json Python

Ready-to-import automation workflows for security alerts, notifications, and operational pipelines.

Use case: Drop-in automation for security alerts, notifications, and operational reporting.

View Workflows →
poc_opencti Shell

Complete Docker deployment for OpenCTI as a proof of concept. Spin up a full threat intelligence platform for home lab or evaluation.

Use case: Spin up a threat intel lab for evaluation or home lab research.

View Deployment →
casaos-installation-deb13 Shell

Quick Bash script to install CasaOS on Debian 13. Streamlines self-hosted home lab setup with a clean, reproducible approach.

Use case: Reproducible home lab setup on commodity Debian 13 hardware.

View Script →
Free Resources

More free checklists

Practical checklists for teams that want to improve security without turning every problem into a consulting engagement.

Cloudflare + Website Security Baseline

A practical checklist for reviewing DNS, Cloudflare, WordPress, security headers, backups, and admin exposure.

Get Checklist →

DNS Backup and Recovery

A checklist for making DNS records versioned, recoverable, and auditable before a bad change or account issue causes downtime.

Get Checklist →

AI Agent Prompt Security

A starting checklist for reviewing AI-agent prompts, tool access, risky instructions, and CI-friendly prompt checks.

Get Checklist →

Passive Cyber OSINT Triage

A task-first OSINT page for passive domain, URL, exposure, archive, breach-context, and evidence-preservation workflows.

Open OSINT Page →
Tool Categories

Security areas I build for

The focus is practical security tooling: repeatable workflows, checklists, evidence systems, and automations that reduce real operational risk.

☁️

Cloud Security Automation

Tools and templates for cloud baselines, exposure reduction, configuration checks, and repeatable review workflows across AWS, Azure, and GCP.

🌐

Web & WordPress Hardening

Checklists and automation for Cloudflare, headers, backups, plugin risk, and practical website security baselines.

📡

DNS Backup & Recovery

Utilities for making DNS changes versioned, auditable, and recoverable before something breaks.

🔍

Incident Readiness

Templates and workflows for logging, endpoint visibility, first-hour response, and operational readiness before a real incident forces the issue.

🛡️

Security Evidence Packs

Reporting and evidence workflows that leave a trail: what was checked, what was found, and what was fixed.

🤖

AI Prompt Security

Prompt linting, risk scanning, CI checks, and safer AI-agent workflow patterns to reduce prompt injection and trust boundary risk.

🧭

OSINT & Exposure Triage

Passive-first public-source workflows for domains, URLs, exposed services, archives, breach context, and evidence preservation.

About

Building practical
security systems

I'm Myles — a cyber security practitioner and tool builder based in Sydney, Australia.

I build practical security utilities, automation workflows, and repeatable templates for cloud, web, and operational security. My bias is toward tools that reduce real risk, make recovery easier, and turn manual security work into systems that can be reused.

I'm most interested in secure-by-default infrastructure, DNS and web hardening, incident readiness, evidence packs, and security automation that helps small teams operate with more confidence. I've spoken at WordCamp Brisbane, run cloud security tooling across AWS, Azure, and GCP, and been in the trenches with Cloudflare, Splunk, and Velociraptor.

When I'm not building security tools, you'll find me surfing, snowboarding, mountain biking, or on the back of a motorbike. Dad. Tech geek. Coffee addict. In that order.

Reduce real risk Make recovery boring Keep systems observable Automate repeatable work Prefer practical controls Avoid security theatre
Cloud Platforms
AWS Azure Google Cloud DigitalOcean Cloudflare Linode
Security Tooling
Splunk Pi-hole Bitwarden Velociraptor Cisco Ubiquiti
Infrastructure & DevOps
Docker Kubernetes Terraform Ansible Nginx Apache
Languages & Scripting
Python Bash PowerShell HTML5
Latest Notes

From the blog

3 Jun 2026

Cloudflare DNS Backup

An automated Bash script that retrieves all Cloudflare zones, converts records to BIND format, and creates timestamped daily backups.

Read post →

Updated weekly

Weekly Security Briefing

The last seven days of security news in one place: what to patch now, what is actively exploited, and the incidents worth knowing about.

Read the briefing →

Most days

Daily Security News

A daily roundup of security headlines, prioritised for exploited vulnerabilities, critical CVEs and breaches — filterable by vendor and severity.

Browse the archive →
View all posts →
Follow the Tools

Subscribe for updates

Practical security checklists, workflows and new free tools for website, DNS, cloud, and automation hardening. No enterprise theatre, no fluff.

Please do not include passwords, secrets, client data, or sensitive credentials. No spam — unsubscribe any time.