Learning track

Security and ethical hacking

This path is defensive and teaches nothing about attacking. What it does is turn a vague worry into a specific list: what is worth protecting, who actually comes for it, and which cheap habit covers the most risk.

  • 12 lessons
  • Free, no signup

Four groups, in the order you learn them

It starts at the layer closest to you and works out to the furthest.

  • The frame

    The first two lessons: what security protects, and where the ethical and legal line sits. Without them the rest is a chore list with no reason behind it.

  • You yourself

    Passwords and two factor, phishing, malware. Where the most is actually lost, and where fixing it costs the least.

  • Your site

    Common attacks, WordPress security, data breaches. All three from the view of whoever keeps the site running, not the attacker.

  • Data and tools

    Privacy, safe browsing, the security risks of AI, and the tools an ordinary user genuinely benefits from.

These four groups are a learning order, not a formal security model. Professional frameworks have their own taxonomies and are needed for organisational work; for somebody with one site and a handful of accounts, these four are enough.

The path, step by step

Lessons are ordered so each stands on the previous one. You can also jump in anywhere.

  1. 1What cybersecurity isCybersecurity means keeping three things at once: that nobody who should not see your information sees it, that nobody changes it without permission, and that it is there when you need it. Almost nobody picks you personally; what knocks on your door is a list a machine is running against thousands of addresses.Beginner
  2. 2What ethical hacking isEthical hacking means exactly the skills an attacker has, but with the prior written permission of whoever owns the system and an obligation to report whatever is found. The difference between the two is neither in the tools nor in the knowledge; it is a document signed before the work starts, and the law stands on exactly that word.Beginner
  3. 3Strong passwords and two-factor authenticationThe strongest thing you can do for an account is to make sure its password is used nowhere else and that two-factor authentication is switched on. Length matters more than complexity, and the NIST guideline says so outright: no service is allowed to force a mixture of letters, digits and symbols.Beginner
  4. 4What phishing is and how to spot itPhishing is a message posing as a sender you trust so that you hand over a password, a code or money with your own hands. You cannot spot it by whether it looks professional; you can spot it with a fixed sequence of four questions.Beginner
  5. 5Malware and its typesMalware is not one category but several different behaviours: one copies itself, one holds a door open, one encrypts your files and one only watches. The useful way to sort them is by behaviour, because the symptom you see and the response you need both come from behaviour, not from the name.Beginner
  6. 6The common attacks on websitesFive attacks account for most of what a small website faces: password guessing, SQL injection, cross site scripting, denial of service and defacement. None of them picked your site; every one of them is walking a list of addresses, and your address is one line on that list.Intermediate
  7. 7Hardening WordPress, in the order that mattersWordPress security is six jobs, and their order matters more than the jobs do: keeping everything updated, least privilege on every account, two factor authentication, a backup you have restored once, a security plugin that is still maintained, and hardening the login page. If you only ever do the first one, you have prevented more than any other combination of the remaining five.Intermediate
A glass shield with three glowing layers in red, green and blue and white cards pinned behind it

The lessons start with you and work outward to the site, not the other way round. The reason is plain: your accounts, passwords and email are what actually get lost, far more often than any technical weakness, and if that layer is loose the hardest server configuration in the world buys you nothing.

The first two lessons are the frame. One says what security is protecting in the first place and who really comes for it; the second draws the line that separates ethical hacking from a crime, and that line is not skill, it is permission. The next three are about you: passwords and two factor, phishing, malware. Then the site, and last the data, the privacy and the tools.

And one thing this path deliberately does not do, better said at the start: no lesson writes exploitation steps, attack commands, or a way around somebody else system. Even where the subject of a lesson is an attack, what you learn is recognition and defence. If you are looking for how to get into a particular target, this is the wrong place and we do not write that.

Real follow-up questions

Do I need to know programming to start with security?

Not for this path. The lessons here deal in concepts, recognition and decisions, and most of them can be practised in the settings of the device you already own. If you later want to go professional, programming and networking become necessary, and the ethical hacking lesson says where that road starts.

Does this path teach hacking?

No, and that is a choice rather than a gap. No lesson carries an exploitation step, a payload or an attack command; even the lessons whose subject is an attack are written from the view of whoever has to stop it. The real way to learn is in labs built for exactly that, and the ethical hacking lesson names them.

Should I do my site security myself or hand it over?

A large part of it is yours and handing it over changes nothing: nobody can fix your password, your two factor or which link you click on your behalf. What can be handed over is the server layer, the monitoring and the recovery after an incident, which need both tooling and somebody who answers at night. Honestly: if your site does not earn, start by reading this path and keep the money.

This path is written for somebody who wants to understand it and decide for themselves. If your site earns and you would rather hand over the server layer, the monitoring and the recovery, See the website security page