Practical security implementation guides
Users frequently input sensitive data on websites, such as names, addresses, passwords, and banking details. As a web developer, it's crucial to protect this information from bad actors who use a wide range of exploits to steal such information and use it for personal gain. The focus of web security is to help you protect your website against these exploits and secure your users' sensitive data.
This page lists guides that detail the best practices for implementing security features on websites. While these guides do not cover all possible security scenarios and cannot guarantee complete security of your website, following the information and best practices in these guides will make your sites significantly more secure.
Content security fundamentals
Most of these guides are directly related to the HTTP Observatory tool. Observatory performs security audits on a website and provides a grade and score along with recommendations for fixing the security issues it finds. These guides explain how to resolve issues surfaced by the HTTP Observatory tests: the tool links to the relevant guide for each issue, helping guide you towards an effective resolution. Interestingly, Mozilla's internal developer teams use this guidance when implementing websites to ensure that security best practices are applied.
The guides in the table below are listed in the order that we recommend implementing the security features they describe. This order is based on a combination of each feature's security impact and the ease of its implementation from both operational and developmental perspectives. The table provides information about each feature's impact, difficulty of implementation, whether or not it is required, and a brief description.
| Guide | Impact | Difficulty | Required | Description |
|---|---|---|---|---|
| TLS configuration | Medium | Medium | Yes | Use the most secure Transport Layer Security (TLS) configuration available for your user base. |
| TLS: Resource loading | Maximum | Low | Yes | Load both passive and active resources via HTTPS. |
| TLS: HTTP redirection | Maximum | Low | Yes | Websites must redirect to HTTPS; API endpoints should disable HTTP entirely. |
| TLS: HSTS implementation | High | Low | Yes | Notify user agents to connect to sites only over HTTPS, even if the original scheme chosen was HTTP, by using HTTP Strict transport security (HSTS). |
| Clickjacking prevention | High | Low | Yes | Control how your site may be framed within an <iframe> to prevent clickjacking. |
| CSRF prevention | High | Unknown | Varies | Protect against Cross-site request forgery (CSRF) using SameSite cookies and anti-CSRF tokens. |
| Secure cookie configuration | High | Medium | Yes | Set all cookies as restrictively as possible. |
| CORP implementation | High | Medium | Yes | Protect against speculative side-channel attacks by using Cross-Origin Resource Policy (CORP). |
| MIME type verification | Low | Low | No | Verify that all your websites are setting the proper MIME types for all resources. |
| CSP implementation | High | High | Yes | Provide fine-grained control over where site resources can be loaded from with Content Security Policy (CSP). |
| CORS configuration | High | Low | Yes | Define the non-same origins that are allowed to access the content of pages and have resources loaded from them by using Cross-Origin Resource Sharing (CORS). |
| Referrer policy configuration | Low | Low | Yes | Improve privacy for users and prevent leaking of internal URLs via the Referer header. |
| robots.txt configuration | Low | Low | No | Tell robots (such as search engine indexers) how to behave by instructing them not to crawl certain paths on the website. |
| SRI implementation | Low | Low | No | Verify that fetched resources (for example, from a CDN) are delivered without unexpected manipulation by using Subresource Integrity (SRI). |
User information security
- How to turn off form autocompletion
-
Form fields support autocompletion; that is, their values can be remembered and automatically filled out next time a user visits your site. For certain types of data, you may wish to disable this feature; this article explains how.