I’m continuing my dive into security terminology and the bigger picture. Here are a few things that I discovered more about this month.
SSL vs TLS: the name that never left
SSL has been outdated for years, yet we still call it that.
Even though TLS replaced SSL more than 25 years ago 😀, people still commonly say:
- “SSL certificate” instead of “TLS certificate”
- “SSL encryption”
- “SSL/TLS” (using both names together)
Technically, we’ve been using TLS since 1999. SSL is obsolete, but the name stuck.
In reality, all modern websites use TLS (usually TLS 1.2 or 1.3). The certificates are still often marketed as “SSL certificates,” but under the hood, it’s TLS. It’s a reminder that tech terminology often lags behind reality.
OWASP: the open security community
There is a dedicated open-source security community called OWASP (the Open Web Application Security Project).
It’s essentially a free, worldwide community of security experts working together to make websites and applications safer.
Key facts I discovered:
- Completely free and all information is public
- Non-profit
- Volunteer-run: experts donate their time
- Trusted worldwide: banks, hospitals, governments, and tech companies rely on their guidelines
- Founded in 2001
One of their most well-known resources is the OWASP Top 10.
OWASP Top 10 (2025)
The OWASP Top 10 is a list of the 10 biggest security risks for web applications. It’s updated every few years based on community research and real-world data – latest version (2025).
For WordPress site owners, this list works well as a practical security checklist. It covers the most common and impactful classes of vulnerabilities.
What caught my attention in the 2025 update: A02:2025 – Security Misconfiguration moved up from #5 (2021) to #2 (2025).
That made me pause. Could this be related to the “vibe coding” boom? When development speeds up, security could be left behind.
As a result, I’m becoming more careful about the software I choose, whether it’s a WordPress plugin or a daily productivity app. If configuration risk is now #2 globally, that says something about how software and apps are built today.
Data breaches: check your email
You can check whether your email address has been involved in a known data breach here:
If your email appears there, it doesn’t automatically mean your account is compromised right now. It means your data was included in a breach at some point.
What to do with that information:
- Change passwords for affected services
- Do not reuse passwords across sites
- Enable two-factor authentication where possible
IPv4 vs IPv6: a slow transition
We officially ran out of IPv4 addresses in 2011. Today, no new IPv4 addresses are available unless you buy or recycle them from existing holders.
IPv6 was finalized in 1998. WOW, more than 25 years ago. 😀
And yet, global adoption is still only around 40–45%. Why? As I discovered:
- Costly infrastructure updates
- No immediate crisis forcing migration
- Operational complexity
- Staff training requirements
In many environments, IPv4 “still works,” so organizations postpone the switch. Eventually, we’ll get there, but slowly.
Sum up
I understood that security is not a feature, it’s processes, habits, education, and everyday decisions. What habits have you changed to have a more secure environment?
Leave a Reply