11 steps
Your website is the most visible part of your attack surface. Misconfigured TLS, missing security headers, and weak content policies leave it open to interception, cross-site scripting, clickjacking, and data injection. These steps cover the essential controls every website should enforce at the transport and presentation layer.
Use automated certificate issuance and renewal (Let's Encrypt, ACME protocol) to prevent expired certificates. Monitor certificate expiration across all domains and subdomains. Implement certificate transparency log monitoring to detect unauthorized certificate issuance.
Disable TLS 1.0 and 1.1 across all endpoints. Enforce TLS 1.2 minimum with TLS 1.3 preferred. Remove weak cipher suites and prioritize those with forward secrecy (ECDHE, DHE). Regularly scan your TLS configuration with tools like SSL Labs or testssl.sh.
Set X-Content-Type-Options: nosniff, X-Frame-Options: DENY or SAMEORIGIN, Referrer-Policy: strict-origin-when-cross-origin, and Permissions-Policy to restrict browser feature access. Apply these headers consistently via server configuration or middleware on every response.
Define a CSP that restricts script sources to trusted origins, disallows inline scripts, and blocks eval(). Use nonce-based or hash-based script execution for dynamic content. Start with Content-Security-Policy-Report-Only to tune directives before enforcing.
Set the Strict-Transport-Security header with a long max-age (at least 31536000 seconds), includeSubDomains, and preload directives. Submit your domain to the HSTS preload list so browsers always use HTTPS, even on first visit.
Set the Secure, HttpOnly, and SameSite=Strict (or Lax) flags on all session and authentication cookies. Use the __Host- and __Secure- cookie name prefixes for additional browser-enforced restrictions. Avoid storing sensitive tokens in localStorage.
Add integrity and crossorigin attributes to all externally hosted scripts and stylesheets. SRI ensures the browser rejects modified third-party resources. Host critical libraries locally when possible to eliminate third-party dependency risk.
Audit all third-party scripts (analytics, tag managers, chat widgets) and restrict their loading through CSP directives. Use script nonces or hashes to prevent unauthorized script injection. Monitor third-party script behavior for unexpected network requests or DOM modifications.
Redirect all HTTP traffic to HTTPS with 301 permanent redirects. Ensure redirect chains do not leak sensitive data in URLs. Disable mixed content by setting upgrade-insecure-requests in your CSP and reviewing all asset references for hardcoded HTTP URLs.
Mark session cookies Secure, HttpOnly, and SameSite=Lax or Strict. Use the __Host- prefix so the cookie is only set over HTTPS, without a Domain attribute, and with Path=/. Keep lifetimes short and never store sensitive data in client-readable cookies.
Publish an SPF record listing authorized senders, sign outbound mail with DKIM, and deploy DMARC starting at p=none with reporting, then move to quarantine and reject. Add a null SPF and DMARC reject policy to parked domains that never send mail.
