How websites get attacked, in plain English

When people imagine a website being "hacked", they picture a genius in a dark room typing fast, targeting one company. That does happen, to banks and governments. It almost never happens to a restaurant in Osu or a salon in Manchester.

What does happen to small sites is far more boring, and far more common. Programs called bots visit millions of websites a day, trying the same few tricks on every one. They don't know or care whose site it is. They fill in every form they find. They try common passwords on every login page. They search GitHub for keys that someone pushed by mistake. They check whether a site's database answers questions it shouldn't.

That's actually good news. Because the attacks are the same few tricks, the defences are a short, known list. You can learn that list in one module and apply it to every site you ever build. This lesson is the map. The rest of the module is the walk-round, door by door.