Website Security Basics: HTTPS, Headers and Common Attacks

Every website is a target. Most attacks are automated, scanning the internet for known weaknesses rather than aiming at a specific business. The good news is that a handful of well-known practices stop the large majority of problems. You do not need to be a security specialist to cover the basics.

This guide explains the essentials in plain language. For mobile app security specifically, see our mobile app security checklist.

1. Use HTTPS everywhere

HTTPS encrypts traffic between visitors and your site, protecting passwords, form data and session cookies from eavesdropping and tampering. It is also a baseline expectation: browsers warn visitors about sites without it.

Install a TLS certificate (many hosts and CDNs provide free certificates)
Redirect all HTTP requests to HTTPS
Enable HSTS (HTTP Strict Transport Security) so browsers always use HTTPS
Fix mixed content, where an HTTPS page loads resources over HTTP

2. Add security headers

HTTP response headers tell browsers how to treat your pages. Useful ones include:

Header	Purpose
`Strict-Transport-Security`	Forces HTTPS
`Content-Security-Policy`	Restricts which scripts, styles and resources can load, reducing the damage from cross-site scripting
`X-Content-Type-Options: nosniff`	Stops browsers guessing file types
`X-Frame-Options` or CSP `frame-ancestors`	Prevents clickjacking by controlling who can frame your site
`Referrer-Policy`	Controls how much referrer information is shared
`Permissions-Policy`	Disables browser features you do not use

Roll out a Content Security Policy carefully, since overly strict rules can break legitimate scripts. Test with report-only mode first. Online scanners can grade your headers.

3. Keep software updated

Outdated software is the most common way sites get compromised.

Update your CMS, plugins, themes, frameworks and libraries promptly
Remove plugins and dependencies you do not use
Subscribe to security announcements for the tools you rely on
Use dependency scanning (such as your package manager’s audit feature) to catch known vulnerabilities

Static sites with few dependencies have a smaller attack surface. See static sites vs CMS.

4. Secure authentication

If your site has logins:

Require strong passwords and check against known breached passwords
Offer multi-factor authentication, especially for admin accounts
Hash passwords with a modern algorithm (such as bcrypt, scrypt or Argon2). Never store them in plain text.
Add rate limiting and temporary lockouts against brute-force attacks
Use secure, HttpOnly, Secure, SameSite cookies for sessions
Protect the admin area, for example by restricting by IP or placing it behind additional authentication

5. Defend against common attacks

Cross-site scripting (XSS)

Attackers inject malicious scripts into pages viewed by others. Prevent it by escaping output, validating input and using a Content Security Policy. Modern frameworks escape by default, so avoid bypassing it.

SQL and other injection

Malicious input manipulates database queries or commands. Use parameterised queries or prepared statements and never build queries by concatenating user input.

Cross-site request forgery (CSRF)

An attacker tricks a logged-in user’s browser into performing unwanted actions. Use CSRF tokens and SameSite cookies.

Broken access control

Users access data they should not, for example by changing an ID in a URL. Enforce authorisation on the server for every request and never rely on hidden links.

Insecure file uploads

Restrict file types and sizes, store uploads outside the web root, scan them where appropriate and never execute uploaded files.

The OWASP Top Ten is the standard reference list of the most critical web risks, and worth reading.

6. Protect forms and APIs

Validate on the server, even if you also validate in the browser
Add spam protection: honeypot fields, rate limits or CAPTCHAs where needed
Keep secrets (API keys, passwords) out of client-side code and public repositories
Return minimal error details to users, but log full details privately
Rate-limit APIs to slow abuse

7. Back up and plan for recovery

Backups save you from ransomware, mistakes and failed updates.

Automate regular backups of files and databases
Store copies off the primary server
Test restoring. A backup you cannot restore is not a backup.
Document who does what if the site is compromised

8. Monitor and log

Review server and application logs for unusual activity
Set up uptime and error monitoring
Use a web application firewall (WAF) or CDN protection to filter malicious traffic and absorb attacks
Monitor Google Search Console for security warnings

9. Limit access and permissions

Give people only the access they need (least privilege)
Remove accounts when people leave
Use separate accounts rather than shared passwords
Secure hosting, DNS and domain registrar accounts with MFA, since taking over a domain is catastrophic

10. Respect privacy and compliance

Collect only what you need, explain it in your privacy policy and honour deletion requests. Laws such as GDPR carry obligations, and breaches may need to be reported. Keep your policies accurate, as ours are on the privacy page.

Quick security checklist

Final thoughts

Security is a habit, not a product. Cover the basics, keep things updated and plan for the day something goes wrong. If you would like a fast, secure site built with these practices from the start, see our web development service or contact us.