# Learn with Pick

Short lessons on how websites get attacked and what to do about it, in plain words and about two minutes each.

Pick is the padlock who walks you through them. Each lesson explains one thing a scan can find, why it matters and what to do, and ends with something to try in Lockpick.

- [Anyone can send email as you. Here's why](/docs/learn/email-anyone-can-send.md). Why a stranger can send email that looks like it came from your domain, and the three records that stop it.
- [What the lock in the address bar really means](/docs/learn/the-lock-in-the-address-bar.md). The padlock icon means the connection is private, not that the site is trustworthy, and a few settings keep it that way.
- [Security settings your site sends to browsers](/docs/learn/security-settings-for-browsers.md). A handful of short instructions your site can send with every page, telling browsers how to protect your visitors.
- [A secret key in your website's code](/docs/learn/a-secret-key-in-your-code.md). Why a password or key that ends up in your site's public code can be read by anyone, and what to do when it happens.
- [Your admin page is on the internet](/docs/learn/your-admin-page-is-online.md). Why sign-in pages, admin panels and data connections that anyone can reach deserve extra care.
- [Files you forgot were public](/docs/learn/files-you-forgot-were-public.md). Backups, settings files and folders that end up on a live site, and how a scan finds them before someone else does.
- [Lookalike domains and why they matter](/docs/learn/lookalike-domains.md). Addresses that look like yours, and parts of your own domain that point somewhere you no longer control.
- [How attackers find your site in the first place](/docs/learn/how-attackers-find-your-site.md). Most attacks aren't personal. Automated tools scan the whole internet, and small sites get found the same way as big ones.
- [What a Deep scan does, and why it asks for proof](/docs/learn/what-a-deep-scan-does.md). How a Deep scan looks further than a Pulse, and why Lockpick only runs one on a site you've shown you control.
- [Letting your AI fix things safely](/docs/learn/letting-your-ai-fix-things.md). How to hand a finding to your coding assistant so it fixes the right thing, and how to check its work.
- [When Monitor says something may affect you](/docs/learn/when-monitor-says-may-affect-you.md). What a Monitor alert means, why it says "may", and how to decide in a few minutes whether you need to act.
- [Checking again, and how to know a fix worked](/docs/learn/rechecking-a-fix.md). How Lockpick confirms a fix, what "fixed" means in a report, and how auto-checks catch problems that come back.