There is a lot you can do to improve the security of a website. In my case the site sits behind Cloudflare, which means some protection is already available. The important part is actually enabling the right features and complementing them with a few clear security headers.

Cloudflare

The first thing I wanted to verify was that the basic Cloudflare settings were sensible:

  • SSL mode: Full (strict)
  • Always Use HTTPS: on
  • Automatic HTTPS Rewrites: on
  • DNSSEC: on
  • HSTS enabled

These are simple settings, but they make a big difference. Most importantly, they ensure the site consistently uses HTTPS and that the certificate chain is validated properly.

Headers

In addition to the Cloudflare settings, I added a _headers file to the project. That file lets me define headers that are sent with every response from the site.

Among other things, I added:

  • X-Content-Type-Options
  • Referrer-Policy
  • Permissions-Policy
  • Content-Security-Policy
  • Cross-Origin-Opener-Policy
  • Cross-Origin-Resource-Policy

These are not magical solutions on their own, but together they reduce the attack surface and make it clearer what the site does and does not allow.

HSTS

HSTS is worth calling out separately because it is often mentioned without always being explained clearly.

HSTS stands for HTTP Strict Transport Security and in practice means that the browser learns that a given domain should only ever be loaded over HTTPS.

Strict-Transport-Security: max-age=63072000; includeSubDomains

This means the browser should remember for a long time that the domain must only be used over HTTPS.

With includeSubDomains, the same rule applies to subdomains as well, which is useful as long as you know all subdomains should also use HTTPS.

The next step is often preload. That means asking browser vendors to include the domain in their built-in HSTS lists so HTTPS is required from the very first visit.

A few practical takeaways

  • Use HTTPS everywhere
  • Set clear security headers
  • Keep the site simple
  • Load as little JavaScript as possible
  • Avoid unnecessary third-party resources

Further reading