GuideBest practicesBeginner
Web security: understand the essential protections of a website
Understand the layers that protect a website: HTTPS, HTTP security headers, CSP, SRI, authentication, passwords and integrity.
29 August 20262 minRead
Tag
Resources for “Best practices”
Discover 7 resources related to Best practices.
Guides and articles
GuideBest practicesBeginner
Content Security Policy (CSP): reduce XSS risks and unwanted loads
Learn how to introduce a CSP progressively, understand its main directives, Report-Only mode, nonces and common mistakes.
29 August 20261 minRead
GuideBest practicesBeginner
HTTP security headers: which ones to enable and why
Understand HSTS, CSP, X-Content-Type-Options, Referrer-Policy and Permissions-Policy and how to verify the headers actually returned.
29 August 20261 minRead
GuideBest practicesBeginner
Subresource Integrity (SRI): verify external resource integrity
Understand how SRI hashes help detect unexpected changes to static third-party scripts and stylesheets, and where SRI does not apply.
29 August 20261 minRead
GuideBest practicesBeginner
JWT: understand structure, signature, expiration and common mistakes
Learn what a JWT contains, why decoding is not verification, how claims such as exp, nbf, iss and aud work, and common security mistakes.
29 August 20261 minRead
GuideBest practicesBeginner
Passwords: generation, strength and useful policies
Understand why length and uniqueness matter, how password managers, MFA and passkeys complement passwords, and how servers should store them.
29 August 20262 minRead
GuideBest practicesBeginner
Hashes, integrity and fingerprint comparison: what a hash can really prove
Distinguish hashing from encryption and encoding, understand SHA-256 and SHA-3, collisions and the limits of a hash without authentication.
29 August 20262 minRead