What is Subdomain Takeover?
Seizing a subdomain whose DNS still points at a deleted external service, then serving attacker content under a trusted name. BYOB custom-domain setup keeps DNS records verified so stale pointers get caught early.
Example
A retired docs site leaves a subdomain pointed at a deleted host while DNS still answers. BYOB custom-domain verification ties records to live projects, so stale pointers surface during setup instead of after an attacker claims them.
What people get wrong
Removing the app but leaving its DNS records behind. Dangling records are the whole vulnerability; retire records and services together.
Related terms
HTTP Strict Transport Security (HSTS)
A response header that obliges browsers to use HTTPS only for a domain, blocking protocol-downgrade attacks. BYOB’s Traefik edge already redirects port 80 to 443, and HSTS pins that behavior client-side.
HTTPS
Encrypted HTTP via TLS, a lightweight ranking signal and a trust requirement. Mixed HTTP resources on HTTPS pages still split signals and trigger browser warnings.
Open Redirect
A redirect endpoint that forwards users to any attacker-supplied URL, weaponized in phishing. Allowlists of destinations or signed redirect parameters keep navigation features from becoming launchpads.
Cross-Site Request Forgery (CSRF)
An attack that tricks a logged-in browser into submitting unwanted state-changing requests to a trusted site. SameSite cookies, anti-CSRF tokens, and origin checks break the forgery chain.
SQL Injection
An attack that smuggles database commands through unsanitized input into application queries. Parameterized statements and least-privilege database roles keep hostile input as data, never executable code.
CSP Directives
The individual rules inside a Content Security Policy, such as script-src, object-src, and frame-ancestors. Each directive narrows one resource class, so auditing means reviewing directives one by one.